Method for certificate-based authentication

A communication network, comprising:

• at least one of a wired network and a wireless network;
• and
• first and second computer systems of first and second subscribers, respectively, communicating via the at least one of the wired network and the wireless network, performing certificate-based authentication of the second subscriber as an authenticated verifier for the first subscriber, wherein:
• the first computer system of the first subscriber is configured to transmit a certificate of the first subscriber that (a) specifies at least one characteristic which must be fulfilled by the second subscriber to authenticate the second subscriber as the authenticated verifier and (b) contains a public key;
• and
• the second computer system of the second subscriber is configured to:
• receive the certificate of the first subscriber;
• access the at least one characteristic specified in the certificate of the first subscriber;
• verify whether the second subscriber fulfills the at least one characteristic specified in the certificate of the first subscriber to authenticate the second subscriber as the authenticated verifier;
• and
• the first and second computer systems of first and second subscribers are configured to, only after a successful verification by the second subscriber that the second subscriber fulfills the at least one characteristic specified in the certificate of the first subscriber, perform a challenge-response exchange including:
• the second computer system of the second subscriber sending a challenge to the first subscriber;
• the first computer system of the first subscriber generating a response to the challenge based on a private key of the first subscriber, and sending the response to the second subscriber;
• and
• the second computer system of the second subscriber verifying the response of the first subscriber using the public key contained in the certificate of the first subscriber.

A method for certificate-based authentication in which a first subscriber provides self-authentication to a second subscriber using a certificate assigned to the first subscriber, comprising:

• receiving, at a first computer system of the first subscriber, from a second computer system of the second subscriber, a request for the certificate of the first subscriber that (a) specifies at least one characteristic which must be fulfilled by the second subscriber to authenticate the second subscriber and (b) contains a public key;
• accessing, by the first computer system of the first subscriber, at least one actual characteristic of the second subscriber;
• determining, by the first computer system of the first subscriber, wherein the at least one actual characteristic of the second subscriber matches the at least one characteristic specified in the certificate of the first subscriber;
• in response to determining that the at least one actual characteristic of the second subscriber matches the at least one characteristic specified in the certificate of the first subscriber, sending the certificate from the first computer system of the first subscriber to the second computer system of the second subscriber;
• verifying, by the second computer system of the second subscriber, the received certificate of the first subscriber;
• after a successful verification, performing a challenge-response exchange including:
• sending, by the second computer system of the second subscriber, a challenge to the first subscriber;
• generating a response to the challenge, by the first computer system of the first subscriber, based on a private key of the first subscriber, and sending the response to the second subscriber;
• and
• verifying, by the second computer system of the second subscriber, the response of the first subscriber using the public key contained in the certificate of the first subscriber.