Method and apparatus for authenticating a digital certificate status and authorization credentials

A method for obtaining access to a requested service at a relying party by providing authentication and authorization attributes of a service requesting certificate subject to the relying party, the method comprising:

• prior to requesting the requested service at the relying party:
• sending, by the certificate subject, a certificate status request to a certificate validation server requesting validity status of a certificate associated with the certificate subject;
• receiving, by the certificate subject and from the certificate validation server, a status information object in response to the status request, the status information object including an aggregation of (i) certificate validity status information indicative of a validity of the certificate and (ii) authorization attributes indicative of services that the certificate subject is authorized to access;
• and
• after receiving the status information object, providing, by the certificate subject, the status information object with the certificate to a relying party processing device to gain access to the requested service at the relying party processing device;
• wherein the status information object includes sufficient information to allow the certificate subject to be authenticated and authorized by the relying party processing device for access to the requested service using the contents of the status information object alone.

A method for determining at a relying party processing device, an authentication and authorization status of a certificate subject making a request for a requested service at the relying party processing device, the method comprising:

• prior to requesting the requested service at the relying party processing device, sending, by the certificate subject, a certificate status request to a certificate validation server requesting validity status of a certificate associated with the certificate subject;
• receiving, by the certificate validation server, the certificate status request from the certificate subject;
• obtaining, by the certificate validation server via a first message exchange with a certificate status database, a validation status for the certificate associated with the certificate subject indicative of a validity of the certificate;
• obtaining, by the certificate validation server via a second message exchange with an authorization database, authorization attributes associated with the certificate subject indicative of services at the relying party processing device that the service requesting certificate subject is authorized to access, wherein the second message exchange is separate from the first message exchange;
• aggregating, by the certificate validation server, the validation status for the certificate and the authorization attributes, both associated with the certificate subject, into a status information object;
• sending, by the certificate validation server, the status information object to the certificate subject;
• receiving, by the certificate subject and from the certificate validation server, the status information object;
• and
• after receiving the status information object, providing, by the certificate subject, the status information object with the certificate to the relying party processing device for validation and to gain access to the requested service at the relying party processing device;
• wherein the status information object includes sufficient information to allow the certificate subject to be authenticated and authorized by the relying party processing device for access to the requested service using the contents of the status information object alone.