# US 7,610,484 B2 · Customizable public key infrastructure and development tool for same > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,610,484 B2 - Document ID: US7610484B2 - Status: Granted - Kind: B2 - Application number: 10/196,286 - Filed: 2002-07-17 - Published: 2003-06-19 - Granted: 2009-10-27 - Earliest claimed: 2000-01-17 - Assignees: Certicom Corp. - Inventors: Amit Kapoor - Web page: https://patentgrep.com/patent/US7610484B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 9/006: {involving public key infrastructure [PKI] trust models (network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/105: {Multiple levels of security} - H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash - H04L 2209/80: Wireless - H04L 2463/102: applying security measure for e-commerce - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A public key infrastructure comprises a client side to request and utilize certificates in communication across a network and a server side to administer issuance and maintenance of said certificates. The server side has a portal to receive requests for a certificate from a client. A first policy engine to processes such requests in accordance with a set of predefined protocols. A certification authority (CA) is also provided to generate certificates upon receipt of a request from the portal. The CA has a second policy engine to implement a set of predefined policies in the generation of a certificate. Each of the policy engines includes at least one policy configured as a software component e.g. a Java bean, to perform the discreet functions associated with the policy and generate notification in response to a change in state upon completion of the policy, and wherein said one policy is responsive to notification of a change in state from another policy in said policy engine. ## Claims ### Claim 1 A method for generating certificates used in communication across a network comprising: receiving at a portal on a server side of a public key infrastructure, a request for a certificate from a client; said portal scheduling said request and processing said request using a first policy engine in accordance with a first set of predefined protocols and thereby offload processing tasks from a certification authority, said portal being communicably interposed between said client and said certification authority, said first policy engine allowing policies to be defined and modified, said policies comprising a set of rules that define how a system operates; said portal determining whether to approve or deny said request according to said first set of predefined protocols, said portal configured to provide multiple protocol handling to accommodate different client types and configured to translate protocol requests and relay back protocol responses between said clients and said certification authority; for an approved request, said portal requesting a certificate from said certification authority; said certification authority receiving said request from said portal and generating said certificate according to a second set of predefined policies using a second policy engine to complete processing in generation of said certificate, said certification authority being configured to issue certificates through said portal and to store certificates in a directory; said certification authority issuing said certificate to said portal; and said portal providing said certificate to said client; wherein each of said policy engines includes at least one policy configured as a software component to perform the discrete functions associated with said policy and to generate a notification in response to a change in state upon completion of said policy to enable policies to be defined and modified to provide flexibility in said public key infrastructure. ### Claim 2 (depends on 1) A method according to claim 1 wherein said at least one policy is responsive to notification of a change in state from another policy in said first policy engine. ### Claim 3 (depends on 1) A method according to claim 1 wherein said at least one policy is implemented using JavaBean™ software components, wherein policy beans associated with said JavaBean™ software components correspond to said discrete functions. ### Claim 4 (depends on 1) A method according to claim 1 wherein said at least one policy is digitally signed to enhance security. ### Claim 5 (depends on 1) A method according to claim 1 further comprising enabling use of at least one toolkit to facilitate generation of new policies. ### Claim 6 (depends on 1) A method according to claim 1 wherein said first policy engine is adapted to enable new policies to be defined therefor and uploaded thereto. ### Claim 7 (depends on 1) A method according to claim 1 wherein said first set of predefined protocols includes all processing to produce said certificate, with the exception of policies related to the signing of said certificate. ### Claim 8 (depends on 1) A method according to claim 1 wherein said portal comprises a Registration Authority. ### Claim 9 (depends on 1) A method according to claim 1 wherein said first policy engine is subdivided into three sets of policies including business policies, protocol policies and routing policies. ### Claim 10 (depends on 1) A method according to claim 1 wherein said portal relays only said approved requests to said certification authority. ### Claim 11 A system to administer issuance and maintenance of certificates requested by one or more clients and used by said clients in communications across a network, said system comprising a certification authority and a portal communicably interposed between said certification authority and said clients, said system comprising at least one processor and at least one computer readable medium storing computer executable instructions for operating said certification authority and said portal using said at least one processor for generating certificates used in communications across said network, said at least one computer readable medium comprising instructions for: receiving at said portal, a request for a certificate from a client; said portal scheduling said request and processing said request using a first policy engine in accordance with a first set of predefined protocols and thereby offload processing tasks from a certification authority, said first policy engine allowing policies to be defined and modified, said policies comprising a set of rules that define how a system operates; said portal determining whether to approve or deny said request according to said first set of predefined protocols, said portal configured to provide multiple protocol handling to accommodate different client types and configured to translate protocol requests and relay back protocol responses between said clients and said certification authority; for an approved request, said portal requesting a certificate from said certification authority; said certification authority receiving said request from said portal and generating said certificate according to a second set of predefined policies using a second policy engine to complete processing in generation of said certificate, said certification authority being configured to issue certificates through said portal and to store certificates in a directory; said certification authority issuing said certificate to said portal; and said portal providing said certificate to said client; wherein each of said policy engines includes at least one policy configured as a software component to perform the discrete functions associated with said policy and to generate a notification in response to a change in state upon completion of said policy to enable policies to be defined and modified to provide flexibility in said public key infrastructure. ### Claim 12 (depends on 11) A system according to claim 11 wherein said at least one policy is responsive to notification of a change in state from another policy in said first policy engine. ### Claim 13 (depends on 11) A system according to claim 11 wherein said at least one policy is implemented using JavaBean™ software components, wherein policy beans associated with said JavaBean™ software components correspond to said discrete functions. ### Claim 14 (depends on 11) A system according to claim 11 wherein said at least one policy is digitally signed to enhance security. ### Claim 15 (depends on 11) A system according to claim 11 further comprising instructions for enabling use of at least one toolkit to facilitate generation of new policies. ### Claim 16 (depends on 11) A system according to claim 11 wherein said first policy engine is adapted to enable new policies to be defined therefor and uploaded thereto. ### Claim 17 (depends on 11) A system according to claim 11 wherein said first set of predefined protocols includes all processing to produce said certificate, with the exception of policies related to the signing of said certificate. ### Claim 18 (depends on 11) A system according to claim 11 wherein said portal comprises instructions for operating a Registration Authority. ### Claim 19 (depends on 11) A system according to claim 11 wherein said first policy engine is subdivided into three sets of policies including business policies, protocol policies and routing policies. ### Claim 20 (depends on 11) A system according to claim 11 wherein said portal relays only said approved requests to said certification authority.