Red Hat, Inc.

Chandrasekar Kannan

Steven William Parkinson

Nang Kon Kwan

Shuk Yee Ho

Christina Fu

Embodiments of the present invention provide identity management security domains that may be used in an enterprise security system. A security domain provides a centralized registry of services provided by the enterprise security system. For example, certificate authorities and other services, such as key archives, and the like, in the enterprise security system may register information about themselves in the security domain. Authorized users can then discover the location of these services. In some embodiments, the security domain may provide an interface that indicates a topology between services of the enterprise security system. The security domain may also serve as a distribution point for security policies. A security policy may comprise information that indicates, for example, a set of trusted certificate authorities, certificate templates, certificate revocation lists, and the locations of the services in the enterprise security system.

Methods and systems for managing identity management security domains

Embodiments of the present invention provide a profile framework for handling enrollment requests. In particular, when a token processing system receives an enrollment request, it selects an applicable profile based on information in the request. The profile may indicate a variety of parameters for fulfilling the enrollment request, such as the locations of the applicable certificate authority, token key service, and the like. The profile may also indicate items, such as the number of keys to generate on a token, a token label, and connection information to securely communicate with other components and the client making the enrollment request.

Profile framework for token processing system

Methods, systems and computer readable mediums are provided for recovering subject keys and/or certificates for a token. A unique identifier associated with the token is obtained. The token is associated with subject keys and with a first status of statuses, the statuses including a lost status state and an other status state. In response to the token being in the lost status state, a key recovery plan is determined to recover at least one of the subject keys and the certificates associated with the token.

Methods and system for a key recovery plan

Embodiments of the present invention provide a compression capability for compressing a CRL, such as an X.509 CRL, stored as a file, data structure or data object in a computer system having a certification authority (CA) and a security client. An exemplary method provides for accessing the CRL contents including a certificate revocation record and performing compression procedure, such as a lossless compression procedure on the contents of the CRL. The compressed CRL contents can be stored in another file, data structure or data object. A request for the compressed CRL is from a security client whereupon the compressed CRL is returned to the security client by transferring the compressed CRL contents to the security client. The security can client un-compress the compressed CRL contents. In some cases the uncompressed CRL contents can be transferred to the security client. The compression procedure can further compress a body portion of the CRL and modify a header portion of the CRL to indicate that the body portion is compressed. The security client can read the header portion to determine that the CRL is compressed and can un-compresses the CRL.

Method and system for certificate revocation list compression

A method and apparatus for accessing a remote machine from a local machine via a smart card. In one embodiment, the presence of the smart card coupled to the local machine is detected. A card reader reads the credentials from the smart card and communicates them to a remote access client application of the local machine. The remote access client application transmits the credentials to the remote machine. The remote machine sends a query for login information to the local machine upon valid credentials. The local machine transmits the login information to the remote machine and is granted permission to access the remote machine upon valid login information.

Growing community of inventors

Mountain View, CA, United States of America

Chandrasekar Kannan