# US 8,868,928 B2 · System and method that uses cryptographic certificates to define groups of entities

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,868,928 B2
- Document ID: US8868928B2
- Status: Granted
- Kind: B2
- Application number: 13/749,175
- Filed: 2013-01-24
- Published: 2013-06-20
- Granted: 2014-10-21
- Earliest claimed: 2008-05-16
- Assignees: Objective Interface Systems, Inc.
- Applicants: Objective Interface Systems, Inc.
- Inventors: Reynolds William Beckwith; Jeffrey Grant Marshall; Jeffrey William Chilton
- Web page: https://patentgrep.com/patent/US8868928B2

## CPC

- G06F 21/602: {Providing cryptographic facilities or services}
- H04L 9/3255: {using group based signatures, e.g. ring or threshold signatures}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system and method for issuing a cryptographic certificate comprises describing prerequisite condition on the cryptographic certificate. The prerequisite conditions comprise membership in prerequisite group of entities. An entity may be a participant, a resource or a privilege, etc. One or more target groups of entities may be named on the cryptographic certificate. One or more prerequisite group stakeholder that authorizes an entity in the prerequisite group of entities to be added as members in another group of entities sign the cryptographic certificate. The cryptographic certificate may also be signed by target group stakeholders that authorizes an entity to be added as a member of the one or more target groups. Exemplary prerequisite conditions relate to one or more of a membership in another group of entities, a physical characteristic, a temporal characteristic, a location characteristic or a position characteristic, among others.

## Claims

### Claim 1

A method for issuing a digital cryptographic certificate, comprising:
digitally describing on the cryptographic certificate:
at least one first prerequisite condition, wherein the at least one first prerequisite condition comprises membership in at least one first prerequisite group of entities;
at least one first prerequisite to-the-group stakeholder which permits membership in the at least one first prerequisite group of entities;
at least one second prerequisite condition, wherein the at least one second prerequisite condition comprises membership in at least one second prerequisite group of entities; and
at least one second prerequisite to-the-group stakeholder which permits membership in the at least one second prerequisite group of entities; and
digitally signing, using one or more hardware computing elements:
the cryptographic certificate by the at least one first prerequisite from-the-group stakeholder which approves use of the membership in the at least one first prerequisite group permitted by the at least one first prerequisite to-the-group stakeholder for making a decision; and
the cryptographic certificate by at least one first prerequisite from-the-group stakeholder which approves use of the membership in the at least one second prerequisite group permitted by the at least one second prerequisite to-the-group stakeholder for making a decision;
wherein the digitally signing authorizes the use of the membership as a condition for making the decision.

### Claim 2 (depends on 1)

The method of claim 1, wherein the decision relates to at least one of admitting an entity for membership in another group, granting access to a resource, granting a privilege or performing an action.

### Claim 3 (depends on 1)

The method of claim 1, wherein a name of the at least one first prerequisite group is associated with the identity of the first prerequisite from-the-group stakeholder.

### Claim 4 (depends on 3)

The method of claim 3, wherein the identity of the at least one first prerequisite from-the-group stakeholder comprises a public key of such stakeholder.

### Claim 5 (depends on 1)

The method of claim 1, wherein the cryptographic certificate is further signed by one more resource stakeholders that control access to a privilege or resource.

### Claim 6 (depends on 1)

The method claims 1, wherein the first one or more prerequisite from-the-group stakeholders authorize an entity in the at least first one prerequisite group to be an entity in at least one target group, and wherein the cryptographic certificate is further signed by at least one target group stakeholder that authorizes the entity to be added as a member to the at least one target group.

### Claim 7 (depends on 6)

The method of claim 6, wherein a name of the at least one target group comprises:
a name of at least one target group stakeholder that authorizes membership of the entity member of said at least one target group in another group; and
a name of the at least one target group stakeholder that authorizes the entity to become the member of said at least one target group.

### Claim 8 (depends on 7)

The method of claim 7, wherein the name of the at least one target group further comprises at least one target group disambiguating identifier.

### Claim 9 (depends on 7)

The method of claim 7, wherein the names of said at least one target group stakeholders comprises public keys of the at least one target group stakeholders and signatures of the at least one target group stakeholders comprise cryptographic signatures of the cryptographic certificate made using said at least one target group stakeholders' private keys.

### Claim 10 (depends on 1)

The method of claim 1, wherein the at least one first prerequisite condition relates to at least one of a membership in another group of entities, a physical characteristic, a non-physical characteristic, a temporal characteristic, a non-temporal characteristic, a location characteristic or a position characteristic.

### Claim 11 (depends on 1)

The method of claim 1, wherein a name of the at least one first prerequisite group comprises:
a name of at least one first prerequisite from-the-group stakeholder that authorizes an entity in the at least one first prerequisite group to be a member of another group of entities; and
a name of at least one first prerequisite to-the-group stakeholder that authorizes membership of the entity in the at least one first prerequisite group.

### Claim 12 (depends on 11)

The method of claim 11, wherein the name of the at least one first prerequisite group further comprises at least one first prerequisite group disambiguating identifier.

### Claim 13 (depends on 11)

The method of claim 11, wherein the names of the at least one first prerequisite from-the-group stakeholders comprise public keys of said at least one first prerequisite from-the-group stakeholders and signatures of said at least one first prerequisite from-the-group stakeholders comprise cryptographic signatures of the cryptographic certificate made using such stakeholders' private keys.

### Claim 14 (depends on 1)

The method of claim 1, wherein an entity comprises at least one of a participant, resource or privilege.

### Claim 15

A method for processing a digital cryptographic certificate, the method comprising:
receiving the cryptographic certificate, said cryptographic certificate describing:
at least one first prerequisite condition comprising membership in at least one first prerequisite group of entities;
at least one first prerequisite to-the-group stakeholder which permits membership in the at least one first prerequisite group of entities;
at least one second prerequisite condition comprising membership in at least one second prerequisite group of entities; and
at least one second prerequisite to-the-group stakeholder which permits membership in the at least one second prerequisite group of entities; and
determining, using one or more hardware computing elements:
whether the cryptographic certificate is validly digitally signed by at least one first prerequisite from-the-group stakeholder which approves use of membership in the first prerequisite group permitted by the at least one first prerequisite to-the-group stakeholder in making a decision; and
whether the cryptographic certificate is validly digitally signed by the at least one first prerequisite from-the-group stakeholder which approves use of membership in the second prerequisite group permitted by the at least one second prerequisite to-the-group stakeholder in making a decision;
wherein valid digital signatures of the certificate by the at least one first prerequisite from-the-group stakeholder authorize the use of membership as a condition for making the decision.

### Claim 16 (depends on 15)

The method of claim 15, wherein the decision relates to at least one of admitting an entity for membership in another group, granting access to a resource, granting a privilege, or performing an action.

### Claim 17 (depends on 15)

The method of claims 15, wherein the one or more first prerequisite from-the-group stakeholders authorize an entity in an at least one first prerequisite group to be an entity in at least one target group and wherein the method further comprises determining whether the cryptographic certificate is validly signed by at least one target group stakeholder that authorizes the entity to be added as a member to the at least one target group.

### Claim 18 (depends on 17)

The method of claim 17, wherein a name of the at least one target group comprises:
a name of at least one target group stakeholder that authorizes membership of an entity member of the at least one target group in another group; and
a name of the at least one target group stakeholder that authorizes the entity to become the member of the at least one target group.

### Claim 19 (depends on 18)

The method of claim 18, wherein the name of the at least one target group further comprises at least one target group disambiguating identifier.

### Claim 20 (depends on 18)

The method of claim 18, wherein the names of the at least one target group stakeholders comprise public keys of said at least one target group stakeholders and signatures of said at least one target group stakeholders comprise cryptographic signatures of the certificate made using said at least one target group stakeholders' private keys.

### Claim 21 (depends on 15)

The method of claim 15, wherein a name of the at least one first prerequisite group is associated with the identity of the at least one first prerequisite from-the-group stakeholder.

### Claim 22 (depends on 21)

The method of claim 21, wherein the identity of the at least one first prerequisite from-the-group stakeholder comprises a public key of such stakeholder.

### Claim 23 (depends on 15)

The method of claim 15, further comprises determining whether the cryptographic certificate is validly signed by at least one resource stakeholder who controls access to a privilege or resource.

### Claim 24 (depends on 15)

The method of claim 15, wherein the first prerequisite condition relates to at least one of a membership in another group of entities, a physical characteristic, a non-physical characteristic, a temporal characteristic, a non-temporal characteristic, a location characteristic or a position characteristic.

### Claim 25 (depends on 15)

The method of claim 15, wherein a name of the at least one first prerequisite group comprises:
a name of at least one first prerequisite from-the-group stakeholder that authorizes an entity in the at least one first prerequisite group to be a member of another group of entities; and
a name of at least one first prerequisite to-the-group stakeholder that authorizes membership of the entity in the at least one first prerequisite group.

### Claim 26 (depends on 25)

The method of claim 25, wherein the name of the at least one first prerequisite group further comprises at least one first prerequisite group disambiguating identifier.

### Claim 27 (depends on 25)

The method of claim 25, wherein the names of the at least one first prerequisite from-the-group stakeholders comprise public keys of said at least one first prerequisite from-the-group stakeholders and signatures of the at least one first prerequisite from-the-group stakeholders comprise cryptographic signatures of the cryptographic certificate made using such stakeholders' private keys.

### Claim 28 (depends on 15)

The method of claim 15, wherein an entity comprises at least one of a participant, a resource or a privilege.

### Claim 29

A digital cryptographic certificate stored on one or more tangible non-transitory computer-readable storage media, comprising:
names of one or more of first prerequisite groups;
one or more first prerequisite to-the-group stakeholders which permit membership in the one or more first prerequisite groups; and
names of one or more of second prerequisite groups;
one or more second prerequisite to-the-group stakeholders which permit membership in the one or more second prerequisite groups; and
one or more digital cryptographic signatures of:
one or more first prerequisite from-the-group stakeholders which approve use of membership in the first prerequisite group permitted by the one or more first prerequisite to-the-group stakeholders for making a decision; and
the one or more first prerequisite from-the-group stakeholders which approve use of membership in the second prerequisite group permitted by the one or more second prerequisite to-the-group stakeholders for making a decision;
wherein the one or more digital cryptographic signatures authorize the use of membership in the one or more first prerequisite groups as a condition for making the decision.

### Claim 30 (depends on 29)

The cryptographic certificate of claim 29, wherein the one or more first prerequisite from-the-group stakeholders authorize an entity in the one or more first prerequisite groups to be an entity in one or more target groups.

### Claim 31 (depends on 30)

The cryptographic certificate of claim 30 further comprising names of the one or more target groups and cryptographic signatures of one or more target group stakeholders that authorize adding the entity to the one or more target groups.

### Claim 32 (depends on 30)

The cryptographic certificate of claim 30 further comprising the names of one or more target groups.

### Claim 33 (depends on 32)

The cryptographic certificate of claim 32, wherein the names of the target groups comprise:
names of one or more target group stakeholders that authorize membership of an entity member of the one or more target groups in another group; and
names of one or more target group stakeholders that authorize the entity to become the member of the one or more target groups.

### Claim 34 (depends on 33)

The cryptographic certificate of claim 33, wherein the names of the one or more target groups further comprise at least one target group disambiguating identifier.

### Claim 35 (depends on 33)

The cryptographic certificate of claim 33, wherein the names of the target group stakeholders comprise public keys of the one or more target group stakeholders and signatures of the one or more target group stakeholders comprise cryptographic signatures of the cryptographic certificate made using the one or more target group stakeholders' private keys.

### Claim 36 (depends on 29)

The cryptographic certificate of claim 29, wherein the decision relates to at least one of admitting an entity for membership in another group, granting access to a resource, granting a privilege or performing an action.

### Claim 37 (depends on 29)

The cryptographic certificate of claim 29, wherein the names of the one or more first prerequisite groups are associated with the identity of the one or more first prerequisite from-the-group stakeholders.

### Claim 38 (depends on 37)

The cryptographic certificate of claim 37, wherein the identity of a first prerequisite from-the-group stakeholder comprises a public key of such stakeholder.

### Claim 39 (depends on 29)

The cryptographic certificate of claim 29, further comprising cryptographic signatures of one more resource stakeholders who control access to a privilege or a resource.

### Claim 40 (depends on 29)

The cryptographic certificate of claim 29, wherein the first prerequisite condition relates to at least one of a membership in another group of entities, a physical characteristic, a non-physical characteristic, a temporal characteristic, a non-temporal characteristic, a location characteristic or a position characteristic.

### Claim 41 (depends on 29)

The cryptographic certificate of claim 29, wherein the names of one or more first prerequisite groups comprise:
names of one or more first prerequisite from-the-group stakeholders that authorize an entity in the one or more first prerequisite groups to be a member of at least one target group of entities; and
names of one or more first prerequisite to-the-group stakeholders that authorize membership of the entity in the one or more first prerequisite groups.

### Claim 42 (depends on 41)

The cryptographic certificate of claim 41, wherein the name of the first prerequisite group further comprises at least one first prerequisite group disambiguating identifier.

### Claim 43 (depends on 41)

The cryptographic certificate of claim 41, wherein the names of the one or more first prerequisite from-the-group stakeholders comprise public keys of the one or more first prerequisite from-the-group stakeholders and the one or more signatures of the one or more first prerequisite from-the-group stakeholders comprise cryptographic signatures of the cryptographic certificate made using such stakeholders' private keys.

### Claim 44 (depends on 29)

The cryptographic certificate of claim 29, wherein an entity comprises at least one of a participant, a resource or a privilege.