# US 9,882,728 B2 · Identity-based certificate management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,882,728 B2 - Document ID: US9882728B2 - Status: Granted - Kind: B2 - Application number: 15/279,191 - Filed: 2016-09-28 - Published: 2017-01-19 - Granted: 2018-01-30 - Earliest claimed: 2009-04-07 - Assignees: SecureAuth Corporation - Applicants: SecureAuth Corporation - Inventors: Garret Florian Grajek; Jeffrey Chiwai Lo; Mark V. Lambiase - Web page: https://patentgrep.com/patent/US9882728B2 ## CPC - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3252: {using DSA or related signature schemes, e.g. elliptic based signatures, ElGamal or Schnorr schemes} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/3271: {using challenge-response} - H04L 9/3297: {involving time stamps, e.g. generation of time stamps} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash - H04L 2209/805: Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods for managing digital certificates, including issuance, validation, and revocation are disclosed. Various embodiments involve querying a directory service with entries that correspond to a particular client identity and have attributes including certificate issuance limits and certificate validity time values. The validity time values are adjustable to revoke selectively the certificates based upon time intervals set forth in validity identifiers included therein. ## Claims ### Claim 1 A method performed by a computer system for validating a digital certificate issued to a client system and associated with a specific client identity, the method comprising: receiving the digital certificate from the client system, the digital certificate including a user identifier and a certificate validity period identifier, the user identifier corresponding to the specific client identity; generating a first query to a directory service which includes a request for a first entry associated with the specific client identity, the first entry including a directory validity time value for the specific client identity; receiving the directory validity time value for the specific client identity returned by the directory service in response to the first query; validating the digital certificate, wherein validating the digital certificate comprises determining that a certificate validity period specified by the certificate validity period identifier is later than the received directory validity time value; and revoking the digital certificate in response to a modification of the directory validity time value to a value associated with the current date and time. ### Claim 2 (depends on 1) The method of claim 1, wherein the certificate validity period is defined by a validity start time and a validity end time. ### Claim 3 (depends on 2) The method of claim 2, wherein the certificate validity period is later than the directory validity time value only if the validity start time is later than the directory validity time value. ### Claim 4 (depends on 2) The method of claim 2, further comprising rejecting the digital certificate if the validity start time is prior to the received directory validity time value for the specific client identity. ### Claim 5 (depends on 2) The method of claim 2, further comprising rejecting the digital certificate if the validity end time is prior to the received directory validity time value for the specific client identity. ### Claim 6 (depends on 1) The method of claim 1, further comprising removing access restrictions to a network application resource upon validating the digital certificate. ### Claim 7 (depends on 1) The method of claim 1, further comprising revoking the digital certificate in response to a modification to the directory validity time value to be later than the certificate validity period of the digital certificate. ### Claim 8 (depends on 1) The method of claim 1, wherein the directory service is a Standard Query Language (SQL) database. ### Claim 9 (depends on 1) The method of claim 1, wherein the directory validity time value comprises a dynamic certificate validation date. ### Claim 10 (depends on 9) The method of claim 9, wherein the dynamic certificate validation date of a directory validity time value stored on a directory service may be modified through an administration panel user interface. ### Claim 11 (depends on 1) The method of claim 1, wherein the directory validity time value comprises a set of date values that identify a specific year, month, and day, and a set of time values that identify a specific hour and minute. ### Claim 12 A system for validating a digital certificate issued to a client system and associated with a specific client identity, the system comprising: a computing system comprising one or more computing devices, said computing system programmed via executable instructions to at least: receive the digital certificate from the client system, the digital certificate including a user identifier and a certificate validity period indicator, the user identifier corresponding to the specific client identity; generate a first query to a directory service which includes a request for a first entry associated with the specific client identity, the first entry including a directory validity time value for the specific client identity; receive the directory validity time value for the specific client identity returned by the directory service in response to the first query; and validate the digital certificate, wherein the computing system is programmed via executable instructions to at least validate the digital certificate by determining that a certificate validity period specified by the certificate validity period identifier is later than the received directory validity time value, and wherein the directory validity time value is editable to revoke the digital certificate that includes the user identifier. ### Claim 13 (depends on 12) The system of claim 12, wherein the certificate validity period is defined by a validity start time and a validity end time. ### Claim 14 (depends on 13) The system of claim 13, wherein the computing system is further programmed via executable instructions to reject the digital certificate if the validity start time or the validity end time is prior to the received directory validity time value for the specific client identity. ### Claim 15 A non-transitory computer storage medium that comprises executable instructions that when executed by a computing system, directs the computing system to at least: receive a digital certificate from the client system, the digital certificate including a user identifier and a certificate validity period indicator, the user identifier corresponding to the specific client identity; generate a first query to a directory service which includes a request for a first entry associated with the specific client identity, the first entry including a directory validity time value for the specific client identity; receive the directory validity time value for the specific client identity returned by the directory service in response to the first query; and validate the digital certificate, wherein validating the digital certificate comprises determining that a certificate validity period specified by the certificate validity period identifier is later than the received directory validity time value, and wherein the directory validity time value is editable to revoke the digital certificates that includes the user identifier. ### Claim 16 (depends on 15) The non-transitory computer storage medium of claim 15, wherein the certificate validity period is defined by a validity start time and a validity end time. ### Claim 17 (depends on 16) The non-transitory computer storage medium of claim 16, wherein the executable instructions, when executed by a computing system, further directs the computing system to reject the digital certificate if the validity start time or the validity end time is prior to the received directory validity time value for the specific client identity.