US 7,600,123 B2 · Certificate registration after issuance for secure communication

Abstract

Techniques for registering certificates after the issuance of the certificates are provided. A service provider securely registers a client's identity and its certificate without depending on or using an existing basis of trust, such as that provided by domain-joined clients or a security directory (e.g., MICROSOFT's ACTIVE DIRECTORY). The service provider provides services, such as, by way of example and not a limitation, email services, web application services, application services, etc., based on identifiers (e.g., service IDs) issued to registered clients. The service provider subsequently uses the issued identifier to authenticate a client requesting a service or services, and to authorize the client to receive the requested service or services.

Claims16

Dependent claims

A method in a computer system with a processor and memory for registering a certificate after issuance of the certificate, the method comprising:

receiving a certificate registration request from a client to register the certificate that has already been issued and that is to be registered, wherein the certificate registration request comprises the certificate and a signature, and wherein the certificate includes a unique token;
determining by the computer system whether the certificate is a valid certificate;
determining by the computer system whether the client is an authentic client based on the signature of the certificate registration request;
determining by the computer system whether the unique token is already associated with a registered certificate;
and
when it is determined that the certificate is valid and the client is authentic,
registering the certificate when the unique token is not already associated with a registered certificate, wherein registering the certificate comprises:
determining whether a service ID is included in the certificate registration request;
when it is determined that a service ID is included in the request, determining whether the service ID is associated with a registration record for a less trusted certificate;
when it is determined that the service ID is associated with a registration record for a less trusted certificate, updating the registration record associated with the service ID, wherein the updating the registration record includes indicating that the registration record is for the certificate included in the certificate registration request;
and
sending a successful registration response to the client;
and
renewing the registration of the certificate when the unique token is already associated with a registered certificate for the authentic client.

11 more elements

A method in a computer system with a processor and memory for registering a certificate after issuance of the certificate, the method comprising

receiving a certificate registration request from a client to register the certificate that has already been issued and that is to be registered, wherein the certificate registration request comprises the certificate and a signature, and wherein the certificate includes a unique token;
determining by the computer system whether the certificate is a valid certificate;
determining by the computer system whether the client is an authentic client based on the signature of the certificate registration request;
determining by the computer system whether the unique token is already associated with a registered certificate;
and
when it is determined that the certificate is valid and the client is authentic,
registering the certificate when the unique token is not already associated with a registered certificate;
and
renewing the registration of the certificate when the unique token is already associated with a registered certificate for the authentic client, wherein renewing the registration comprises:
determining whether a service ID that is included in the certificate registration request matches a service ID that is associated with a registration record that is associated with the unique token associated with the registered certificate;
and
when it is determined that the service ID that is included in the request does not match the service ID that is associated with the registration record, sending the service ID that is associated with the registration record that is associated with the unique token associated with the registered certificate to the client.

9 more elements

A method in a computer system with a processor and memory for registering a certificate after issuance of the certificate, the method comprising

receiving a certificate registration request from a client to register the certificate that has already been issued and that is to be registered, wherein the certificate registration request comprises the certificate and a signature, and wherein the certificate includes a unique token;
determining by the computer system whether the certificate is a valid certificate;
determining by the computer system whether the client is an authentic client based on the signature of the certificate registration request;
determining by the computer system whether the unique token is already associated with a registered certificate;
and
when it is determined that the certificate is valid and the client is authentic,
registering the certificate when the unique token is not already associated with a registered certificate;
and
renewing the registration of the certificate when the unique token is already associated with a registered certificate for the authentic client, wherein renewing the registration comprises:
determining whether a service ID that is included in the certificate registration request matches a service ID that is associated with a registration record that is associated with the unique token associated with the registered certificate;
when it is determined that the service ID that is included in the request matches the service ID that is associated with the registration record, replacing a current certificate associated with the registration record with the certificate included in the certificate registration request;
and
sending a successful registration response to the client.

10 more elements

A computer-readable storage medium containing computer-executable instructions that when executed by a server register certificates after issuance of the certificates, by a method comprising:

receiving a certificate registration request from a client to register a certificate that has already been issued and that is to be registered, wherein the certificate registration request comprises the certificate and a signature, and wherein the certificate includes a subject name;
determining whether the certificate is a valid certificate;
determining whether the client is an authentic client based on the signature of the certificate registration request;
determining whether the subject name included in the certificate is associated with a registration record for a registered certificate;
when it is determined that the subject name included in the certificate is not associated with a registration record for a registered certificate, determining whether a service ID is included in the certificate registration request;
when it is determined that a service ID is included in the certificate registration request,
determining whether the service ID included in the certificate registration request is associated with a registration record for a non-issued certificate;
and
when it is determined that the service ID included in the certificate registration request is associated with a registration record for a registered certificate,
updating the registration record associated with the service ID included in the certificate registration request, wherein the updating the registration record includes indicating that the registration record is for the certificate included in the certificate registration request;
and
sending a successful registration response to the client;
and
when it is determined that a service ID is not included in the certificate registration request,
generating a service ID;
associating the generated service ID with the subject name included in the certificate;
registering the certificate;
and
sending a successful registration response to the client, the successful registration response including the service ID.

16 more elements

A computer-readable storage medium containing computer-executable instructions that when executed by a server register certificates after issuance of the certificates, by a method comprising:

receiving a certificate registration request from a client to register a certificate that has already been issued and that is to be registered, wherein the certificate registration request comprises the certificate and a signature, and wherein the certificate includes a subject name;
determining whether the certificate is a valid certificate;
determining whether the client is an authentic client based on the signature of the certificate registration request;
determining whether the subject name included in the certificate is associated with a registration record for a registered certificate;
when it is determined that the subject name included in the certificate is associated with a registration record for a registered certificate,
determining whether a service ID included in the certificate registration request matches a service ID associated with the registration record;
and
when it is determined that the service ID included in the certificate registration request does not match the service ID associated with the registration record, sending the service ID associated with the registration record to the client;
when it is determined that the subject name included in the certificate is not associated with a registration record for a registered certificate, determining whether a service ID is included in the certificate registration reguest;
and
when it is determined that a service ID is not included in the certificate registration request,
generating a service ID;
associating the generated service ID with the subject name included in the certificate;
registering the certificate;
and
sending a successful registration response to the client, the successful registration response including the service ID.

13 more elements

A computer-readable storage medium containing computer-executable instructions that when executed by a server register certificates after issuance of the certificates, by a method comprising:

receiving a certificate registration request from a client to register a certificate that has already been issued and that is to be registered, wherein the certificate registration request comprises the certificate and a signature, and wherein the certificate includes a subject name;
determining whether the certificate is a valid certificate;
determining whether the client is an authentic client based on the signature of the certificate registration request;
determining whether the subject name included in the certificate is associated with a registration record for a registered certificate;
when it is determined that the subject name included in the certificate is associated with a registration record for a registered certificate;
determining whether a service ID included in the certificate registration request matches a service ID associated with the registration record;
when it is determined that the service ID included in the certificate registration request matches the service ID associated with the registration record,
replacing a current certificate associated with the registration record with the certificate passed with the certificate registration request;
and
sending a successful registration response to the client;
when it is determined that the subject name included in the certificate is not associated with a registration record for a registered certificate, determining whether a service ID is included in the certificate registration request;
and
when it is determined that a service ID is not included in the certificate registration request,
generating a service ID;
associating the generated service ID with the subject name included in the certificate;
registering the certificate;
and
sending a successful registration response to the client, the successful registration response including the service ID.

15 more elements

Dependencies are inferred from the claim text.

Certificate registration after issuance for secure communication

Life of this patent

Certificate registration after issuance for secure communication

Life of this patent

Abstract

Claims16