# US 8,751,791 B2 · Method and device for confirming authenticity of a public key infrastructure (PKI) transaction event > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,751,791 B2 - Document ID: US8751791B2 - Status: Granted - Kind: B2 - Application number: 12/212,032 - Filed: 2008-09-17 - Published: 2010-03-18 - Granted: 2014-06-10 - Earliest claimed: 2008-09-17 - Assignees: Motorola Solutions, Inc. - Applicants: Erwin Himawan; Ananth Ignaci; Anthony R. Metke; Shanthi E. Thomas - Inventors: Erwin Himawan; Ananth Ignaci; Anthony R. Metke; Shanthi E. Thomas - Web page: https://patentgrep.com/patent/US8751791B2 ## CPC - H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and device for confirming authenticity of a public key infrastructure (PKI) transaction event between a relying node and a subject node in a communication network enables improved network security. According to some embodiments, the method includes establishing at a PKI event logging (PEL) server a process to achieve secure communications with the relying node (step 705). Next, the PEL server processes reported PKI transaction event data received from the relying node (step 710). The reported PKI transaction event data describe the PKI transaction event between the relying node and the subject node. The reported PKI transaction event data are then transmitted from the PEL server to the subject node (step 715). The subject node can thus compare the reported PKI transaction event data with corresponding local PKI transaction event data to confirm the authenticity of the PKI transaction event. ## Claims ### Claim 1 A method for confirming authenticity of a public key infrastructure (PKI) transaction event between a relying node and a subject node in a communication network, the method comprising: establishing at a PKI event logging (PEL) server a process to achieve secure communications with the relying node; processing at the PEL server reported PKI transaction event data received from the relying node, wherein the reported PKI transaction event data describe the PKI transaction event between the relying node and the subject node; and transmitting the reported PKI transaction event data from the PEL server to the subject node, wherein one or more of: the reported PKI transaction event data are transmitted from the PEL server to the subject node in response to a query message received at the PEL server from the subject node; the reported PKI transaction event data are automatically transmitted from the PEL server to the subject node in response to processing at the PEL server the reported PKI transaction event data; and whereby the subject node can compare the reported PKI transaction event data with corresponding local PKI transaction event data to confirm the authenticity of the PKI transaction event. ### Claim 2 (depends on 1) The method of claim 1, wherein confirming the authenticity of the PKI transaction event comprises determining that a private key of the subject node has not been compromised. ### Claim 3 (depends on 1) The method of claim 1, wherein the relying node obtains a uniform resource locator (URL) address of the PEL server from a PKI certificate of the subject node. ### Claim 4 (depends on 1) The method of claim 1, wherein the reported PKI transaction event data include data for a plurality of PKI transaction events. ### Claim 5 (depends on 1) The method of claim 1, wherein processing at the PEL server the reported PKI transaction event data comprises analyzing the reported PKI transaction event data to determine invalid use of PKI certificates associated with the reported PKI transaction event data. ### Claim 6 (depends on 1) The method of claim 1, wherein the PKI transaction event data comprise data selected from the following: a PKI certificate subject, a PKI certificate issuer distinguished name, a subject key identifier (SKI), an issuer key identifier (AKI), a PKI certificate serial number, a transaction identification, a transaction amount, a hash of transaction details, a digital signature of transaction details, a transaction date, a transaction time stamp, a requested transaction type, an originating internet protocol (IP) address of the relying node, and an identification of a triggering application of the relying node. ### Claim 7 (depends on 1) The method of claim 1, wherein the PKI transaction event includes a node authentication event or a message digital signature event. ### Claim 8 (depends on 1) The method of claim 1, wherein the subject node compares the reported PKI transaction event data with the corresponding local PKI transaction event data by comparing one or more of the following parameters included in both the reported PKI transaction event data and the corresponding local PKI transaction event data: a PKI certificate subject, a PKI certificate issuer distinguished name, a subject key identifier (SKI), an issuer key identifier (AKI), a PKI certificate serial number, a transaction identification, a transaction amount, a hash of transaction details, a digital signature of transaction details, a transaction date, a transaction time stamp, a requested transaction type, an originating internet protocol (IP) address of the relying node, and an identification of a triggering application of the relying node. ### Claim 9 (depends on 1) The method of claim 1, wherein the reported PKI transaction event data is received at the PEL server after the relying node has authenticated the subject node. ### Claim 10 (depends on 1) The method of claim 1, wherein the reported PKI transaction event data is received at the PEL server after the relying node has validated a certificate of the subject node. ### Claim 11 A method for confirming authenticity of a public key infrastructure (PKI) transaction event between a relying node and a subject node in a communication network, the method comprising: establishing at a PKI event logging (PEL) server a process to achieve secure communications with the relying node; processing at the PEL server reported PKI transaction event data received from the relying node, wherein the reported PKI transaction event data describe the PKI transaction event between the relying node and the subject node; establishing at the PKI event logging (PEL) server a process to achieve secure communications with the subject node; and confirming that a private key of the subject node has not been compromised by confirming the authenticity of the PKI transaction event at the PEL server, wherein confirming the authenticity of the PKI transaction event comprises comparing the reported PKI transaction event data and corresponding local PKI transaction event data received from the subject node. ### Claim 12 (depends on 11) The method of claim 11, wherein the reported PKI transaction event data is received at the PEL server after the relying node has authenticated the subject node. ### Claim 13 (depends on 11) The method of claim 11, wherein the reported PKI transaction event data is received at the PEL server after the relying node has validated a certificate of the subject node. ### Claim 14 (depends on 11) The method of claim 11, wherein confirming the authenticity of the PKI transaction event comprises determining that a private key of the subject node has not been compromised. ### Claim 15 (depends on 11) The method of claim 11, wherein the relying node obtains a uniform resource locator (URL) address of the PEL server from a PKI certificate of the subject node. ### Claim 16 (depends on 11) The method of claim 11, wherein the reported PKI transaction event data include data for a plurality of PKI transaction events. ### Claim 17 (depends on 11) The method of claim 11, wherein processing at the PEL server the reported PKI transaction event data comprises analyzing the reported PKI transaction event data to determine invalid use of PKI certificates associated with the reported PKI transaction event data. ### Claim 18 A public key infrastructure (PKI) event logging (PEL) server for confirming authenticity of a PKI transaction event between a relying node and a subject node in a communication network, the PEL server comprising: a network interface to communicate with the relying node and the subject node; a memory to store reported PKI transaction event data that describe the PKI transaction event between the relying node and the subject node; and a processor coupled to the network interface and the memory, the processor configured to: establish a process to achieve secure communications with the relying node; process the reported PKI transaction event data received from the relying node; and cause the network interface to transmit the reported PKI transaction event data to the subject node, wherein one or more of: the reported PKI transaction event data are transmitted from the PEL server to the subject node in response to a query message received at the PEL server from the subject node; the reported PKI transaction event data are automatically transmitted from the PEL server to the subject node in response to processing at the PEL server the reported PKI transaction event data; and whereby the subject node can compare the reported PKI transaction event data with corresponding local PKI transaction event data to confirm the authenticity of the PKI transaction event.