Method and system for the authentication of a public key certificate

A system, comprising a digital computer, said computer comprising an internal memory storing software code configured to be executed on the computer to perform a method for authentication of a public key certificate as a service to a relying party (RP) in response to a request for said authentication by the RP who desires to determine a level of trust in a Certificate Authority (CA) that issued the certificate, said method comprising:

• accessing a first quality level of each quality characteristic of a first set of quality characteristics required of the CA by the RP, said CA being a member of a Public Key Infrastructure (PKI) having a Certificate Policy (CP);
• ascertaining a second quality level of each quality characteristic of a second set of quality characteristics possessed by the CA, each ascertained quality characteristic of the second set corresponding to an accessed quality characteristic of the first set on a one-to-one basis, at least one quality characteristic of the second set relating to at least one element of the CP;
• comparing the ascertained second quality level of each quality characteristic of the second set with the accessed quality level of each corresponding quality characteristic of the first set;
• and
• communicating a first result of said comparing to the RP, said first result being that the certificate is authenticated if said comparing has determined that each first quality level is not greater than each corresponding second quality level, otherwise said first result being that the certificate is not authenticated, said accessing, ascertaining, comparing, and communicating being performed by a certificate classification service,
• wherein the at least one element of the CP to which the at least one quality characteristic of the second set is related comprises items selected from the group consisting of:
• disaster recovery plans for the CA;
• allowed or intended application areas for certificates issued by the CA;
• liabilities and responsibilities of the CA and of the customers of the CA;
• a legal environment and jurisdiction in which the CA operates;
• privacy statements used by the CA;
• economical conditions pertaining to the CA;
• requirements and procedures for identification and authentication in connection with certificate issuing and naming by the C;
• requirements and procedures and rules for certificate revocation by the CA;
• operational requirements for certificate issuing, revocation, logging procedures, archival, and key management by the CA;
• procedures for termination of the CA's service or transfer of the CA's service to another CA;
• physical, logical, and administrative security related to operation of the CA's service;
• and
• technical security measures used by the CA relating to generation, storage, and destruction of private keys and public keys.

A computer program product, comprising software code stored in an internal memory of a digital computer, wherein the software code is configured to be executed on the computer to perform a method for authentication of a public key certificate as a service to a relying party (RP) in response to a request for said authentication by the RP who desires to determine a level of trust in a Certificate Authority (CA) that issued the certificate, said method comprising:

• accessing a first quality level of each quality characteristic of a first set of quality characteristics required of the CA by the RP, said CA being a member of a Public Key Infrastructure (PKI) having a Certificate Policy (CP);
• ascertaining a second quality level of each quality characteristic of a second set of quality characteristics possessed by the CA, each ascertained quality characteristic of the second set corresponding to an accessed quality characteristic of the first set on a one-to-one basis, at least one quality characteristic of the second set relating to at least one element of the CP;
• comparing the ascertained second quality level of each quality characteristic of the second set with the accessed quality level of each corresponding quality characteristic of the first set;
• and
• communicating a first result of said comparing to the RP, said first result being that the certificate is authenticated if said comparing has determined that each first quality level is not greater than each corresponding second quality level, otherwise said first result being that the certificate is not authenticated, said accessing, ascertaining, comparing, and communicating being performed by a certificate classification service,
• wherein the at least one element of the CP to which the at least one quality characteristic of the second set is related comprises items selected from the group consisting of:
• disaster recovery plans for the CA;
• allowed or intended application areas for certificates issued by the CA;
• liabilities and responsibilities of the CA and of the customers of the CA;
• a legal environment and jurisdiction in which the CA operates;
• privacy statements used by the CA;
• economical conditions pertaining to the CA;
• requirements and procedures for identification and authentication in connection with certificate issuing and naming by the C;
• requirements and procedures and rules for certificate revocation by the CA;
• operational requirements for certificate issuing, revocation, logging procedures, archival, and key management by the CA;
• procedures for termination of the CA's service or transfer of the CA's service to another CA;
• physical, logical, and administrative security related to operation of the CA's service;
• and
• technical security measures used by the CA relating to generation, storage, and destruction of private keys and public keys.