Revocable pki signatures
AssigneeInternational Business Machines Corporation
InventorsMarcus Brandenburger, Franz-Stefan Preiss, Kai Samelin, Dieter M. Sommer
Life of this patent
Estimating the term…
Abstract
In a computer-implemented method for signing a message by a user device of a public key infrastructure (PKI) system, the message and a user public key are sent to at least one attestation server and a server signature on the message is received from the attestation server. The server signature attests the validity of the user public key and is bound to the user public key and the message. The message and the server signature are signed with a user private key, thereby providing a user signature on the message. An attestation server and a related computer program product are also provided.
Claims20
A computer-implemented method for signing a message by a user device of a public key infrastructure (PKI) system, the method comprising:
- sending the message and a user public key to at least one attestation server;
- receiving from the attestation server a server signature on the message, wherein the server signature attests the validity of the user public key and wherein the server signature is bound to the user public key and the message;
- and
- signing the message and the server signature with a user private key, thereby providing a user signature on the message.
An attestation server for attesting the validity of a public key of a public key infrastructure (PKI) system for a message to be signed by a user device, the server being configured to:
- receive, from the user device, the message and a user public key;
- check the validity of the user public key;
- sign the message with a server secret key of the attestation server, if the user public key is valid at the time of signing, thereby providing a server signature, wherein the server signature is bound to the user public key and the message;
- and
- send the server signature to the user device.
A non-transitory computer readable medium comprising computer executable instructions which when executed by a user device of a public key infrastructure (PKI) system cause the user device to perform a method for signing a message by the user device of the public key infrastructure (PKI) system, said method comprising the steps of:
- sending the message and a user public key to at least one attestation server;
- receiving from the attestation server a server signature on the message, wherein the server signature attests the validity of the user public key at the execution time of the server signature and wherein the server signature is bound to the user public key and the message;
- and
- signing the message and the server signature with a user private key, thereby providing a user signature on the message.
Dependencies are inferred from the claim text.