Digital certificates with distributed usage information
AssigneeAmazon Technologies, Inc.
InventorsStefan Popoveniuc, David Ripton, Alexandr Ukrainchik, Yuk-Chung Eric Kam, Mikhail Denisenko, Robert Eric Fitzgerald, Matthew Allen Estes, Tyler Eckstein
Life of this patent
Estimating the term…
Abstract
Digital certificates include pointers to remote certificate information stores that maintain usage information associated with digital certificates. The pointers provide a mechanism for enabling the remote certificate information stores to be queried for usage information associated with a particular digital certificate. The usage information can be used to determine a validity of the digital certificate.
Claims20
A computer-implemented method, comprising:
- obtaining, from a network service, a digital certificate at an application executed by a client computer system;
- determining validity of the digital certificate by at least:
- obtaining a pointer to a remote certificate information store from a field of the digital certificate containing a constraining attribute of the digital certificate;
- transmitting, based at least in part on the pointer, a query to the remote certificate information store to obtain a value indicating the constraining attribute of the digital certificate;
- obtaining the value from the remote certificate information store in a response to the query;
- and
- generating a determination of validity of the digital certificate based at least in part on the value;
- and
- performing an interaction with the network service based at least in part on the determination.
A system, comprising:
- one or more processors;
- and
- memory that stores computer-executable instructions that, if executed, cause the one or more processors to:
- detect a pointer to a remote certificate information store in a digital certificate, the remote certificate information store containing usage information associated with the digital certificate, the usage information indicating a constraint on the digital certificate;
- obtain the usage information from the remote certificate information store;
- generate, based at least in part on the usage information, a determination whether to trust the digital certificate;
- and
- perform an operation in accordance with the determination.
A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
- establish a secure communications session with a second computer system by at least:
- obtaining a digital certificate from the second computer system;
- detecting a pointer to usage information associated with the digital certificate maintained in a remote certificate information store in the digital certificate, the usage information indicating a constraint on the digital certificate;
- transmitting a request to the remote certificate information store for the usage information based at least in part on the pointer;
- and
- determining whether the digital certificate is valid based at least in part on a response to the request.
Dependencies are inferred from the claim text.