Back to results
US 8,788,811 B2Granted
Server-side key generation for non-token clients
AssigneeRed Hat, Inc.
InventorsChristina Fu, Andrew Wnuk
Life of this patent
Estimating the term…
Abstract
A method and system for server-side key generation for non-token clients is described.
Claims22
A method, comprising:
- receiving, at a certificate manager of a computing system from a requester, a certificate enrollment request for a digital certificate for a non-token client, the digital certificate of the non-token client comprising a soft token that does not employ a hardware security device;
- determining that the certificate enrollment request includes a server-side key indicator to generate a transport key pair, including a public key and a private key, for the digital certificate;
- generating the transport key pair for the digital certificate for the non-token client with the soft token by a server-side key generation engine of the computing system when the certificate enrollment request includes the server-side key indicator;
- receiving a password from the requester as part of the certificate enrollment request;
- encrypting the certificate enrollment request including the password with the public key of the transport key pair;
- encrypting the private key by the server-side key generation engine;
- and
- delivering the encrypted private key to the requester.
5 more elements
A certificate system, comprising:
- a data storage device to store data concerning key pairs of digital certificates issued by a certificate authority (CA);
- a certificate manager, coupled to the data storage device, to receive from a requester a certificate enrollment request for a digital certificate for a non-token client, the digital certificate of the non-token client comprising a soft token that does not employ a hardware security device, and to determine that the certificate enrollment request includes a server-side key indicator to generate a transport key pair, including a public key and a private key, for the digital certificate for the non-token client with the soft token;
- and
- a server-side key generation engine, coupled to the certificate manager, to generate the transport key pair for the digital certificate when the certificate enrollment request includes the server-side key indicator, to receive a password from the requester as part of the certificate enrollment request, to encrypt the certificate enrollment request including the password with the public key of the transport key pair, and to deliver the digital certificate and key pair to the requester.
1 more element
A non-transitory machine-readable storage medium having instructions, which when executed, cause a computing system to perform operations, comprising:
- receiving, at a certificate manager of the computing system from a requester, a certificate enrollment request for a digital certificate for a non-token client, the digital certificate of the non-token client comprising a soft token that does not employ a hardware security device;
- determining that certificate enrollment request includes a server-side key indicator to generate a transport key pair, including a public key and a private key, for the digital certificate;
- generating the transport key pair for the digital certificate for the non-token client with the soft token by a server-side key generation engine of the computing system when the certificate enrollment request includes the server-side key indicator;
- receiving a password from the requester as part of the certificate enrollment request;
- encrypting the certificate enrollment request including the password with the public key of the transport key pair;
- encrypting the private key by the server-side key generation engine;
- and
- delivering the encrypted private key to the requester.
5 more elements
Dependencies are inferred from the claim text.