Revocation of Public Key Infrastructure Signatures
AssigneeCisco Technology, Inc.
InventorMax Pritikin
Life of this patent
Estimating the term…
Abstract
In one implementation, a public key infrastructure utilizes a two stage revocation process for a set of data. One stage authenticates or revokes the set of data based on the status of the digital signature and another stage authenticates or revokes the set of data based on the status of an individual signature by the digital certificate. For example, a digital certificate based is assigned a certificate number. A serial number is assigned for a signature for the set of data as signed by the digital certificate. A data transmission, data packet, or install package includes the set of data, the certificate number and the serial number. Therefore, individual instances of the signature may be revoked according to serial number.
Claims20
A method comprising:
- receiving a digital certificate derived from a cryptographic key, wherein the digital certificate includes a certificate number assigned to the digital certificate;
- generating a signature for a set of data using the digital certificate;
- assigning, by a processor, a signature serial number to the signature for the set of data;
- and
- generating, by the processor, a data packet including the certificate number and the signature serial number.
An apparatus comprising:
- a controller configured to assign a serial number to a signature of a digital certificate applied to authenticate a set of code, wherein the digital certificate includes a certificate number;
- a database configured to store a signature revocation flag associated with the serial number of the signature and the certificate number of the digital certificate;
- and
- a communication interface configured to receive an authentication request for the serial number of the signature and the certificate number of the digital certificate,
- wherein the controller is configured to access the signature revocation flag associated with the serial number of the signature and the certificate number of the digital certificate in response to the authentication request.
A non-transitory computer readable medium including instructions that when executed by a processor are operable to:
- receive a data packet including a digital certificate that identifies a signer of a set of data based on a cryptographic key and including a signature for an instance of the set of data using the digital certificate, wherein the digital certificate is indexed by a certificate number and the signature is assigned a serial number for the instance of the set of data;
- and
- generate a request for verification of revocation status including the certificate number of the digital certificate and the serial number of the signature for the instance of the set of data.
Dependencies are inferred from the claim text.