# US 7,412,524 B1 · Method and system for authentication when certification authority public and private keys expire

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 7,412,524 B1
- Document ID: US7412524B1
- Status: Granted
- Kind: B1
- Application number: 09/626,637
- Filed: 2000-07-27
- Granted: 2008-08-12
- Earliest claimed: 2000-07-27
- Assignees: International Business Machines Corporation
- Inventors: Deepak Gupta; Vamsavardhana Reddy Chillakuru
- Web page: https://patentgrep.com/patent/US7412524B1

## CPC

- G06Q 40/00: Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q 20/102: {Bill distribution or payments}
- H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

This invention relates to a method for enabling the use of valid authentication certificates when the public key and private keys of any of the certifying authority have expired, comprising obtaining a server certifying authority chain (SCAC) certificate by the server from the said certifying authority, presenting the original valid authentication certificate along with the said server certifying authority chain certificate by the server to the browser during the SSL handshake, accepting the transaction by the browser after verification of the original authentication certificate using the expired public key of the certifying authority, and verifying the said SCAC certificate using the new public key of the said certifying authority. This invention further includes a system conducting secure transactions including a certifying authority for authenticating such transactions.

## Claims

### Claim 1

A method for enabling use by a browser of valid authentication certificates in relation to a transaction between the browser and a server when a private key and public key of a certifying authority of the server has expired, comprising:
receiving an original authentication certificate together with a server certifying authority chain (SCAC) certificate by the browser from the server during a SSL handshake between the browser and the server, said SCAC certificate having been previously obtained by the server from the certifying authority;
verifying by the browser the original authentication certificate using the expired public key or the certifying authority; and
verifying by the browser the SCAC certificate using a new public key of the certifying authority.

### Claim 2 (depends on 1)

The method of claim 1, wherein the SCAC certificate is obtained by the server whenever the certifying authority invalidates its public key, wherein the certificate is obtained by:
contacting the certifying authority using the server's private key for authentication to make a request for the SCAC certificate;
verifying the request by the certifying authority using the server's public key; and
generating the SCAC certificate by the certifying authority using new private key of the certifying authority and forwarding the SCAC certificate to the server.

### Claim 3 (depends on 2)

The method of claim 2 wherein generating the SCAC certificate includes authenticating the server name, the server public key, old certifying authority public key, and certifying authority name.

### Claim 4 (depends on 1)

The method of claim 1, further comprising issuing by the certifying authority a client (CCAC) certificate, said CCAC certificate being functionally the same as the SCAC certificate subject to the roles of the browser and the server being interchanged.

### Claim 5 (depends on 1)

The method of claim 1, wherein the method further comprises presenting the CCAC certificate to the server during the handshake.

### Claim 6 (depends on 1)

The method of claim 1, further comprising accepting the transaction by the browser after said verifying the original authentication certificate and after said verifying the SCAC certificate.

### Claim 7 (depends on 1)

The method of claim 1, wherein obtaining the SCAC certificate comprises using the new private key of the certifying authority.