Motorola Solutions, Inc.

Arris Enterprises LLC

Erwin Himawan

Anthony R Metke

Shanthi E Thomas

Ananth Ignaci

George Popovich

A certificate issuer () can periodically request, receive, and store current server-based certificate validation protocol (SCVP) staples () for supported relying parties () from at least one server-based certificate validation protocol (SCVP) responder (). The certificate issuer () can receive a contact initiation request () from one of the relying parties (). Responsive to receiving the contact initiation request (), the certificate issuer () can identify a current SCVP staple from the saved staples that is applicable to the relying party (). The certificate issuer () can conveying a response to the contact initiation request () to the relying party (). The response can comprise the identified SCVP staple and a public key infrastructure (PKI) certificate () of the certificate issuer. The SCVP staple can validate a certification path between the PKI certificate () and a different certificate trusted by the relying party ().

Utilizing a stapling technique with a server-based certificate validation protocol to reduce overhead for mobile communication devices

A first communication device having a secure access to a security module establishes a collaborative network by forming a collaborative security association with a second communication device associated with a user of the first communication device. The first communication device (a) sends an advertisement of services associated with the security module to the second communication device and receives an advertisement response from the second communication device or (b) receives a solicitation request for services associated with the security module from the second communication device. Responsive to receiving one of the advertisement response and the solicitation request, the first communication device determines whether the second communication device is authorized to access the security module. The first communication device processes and forwards security service messages between the second communication device and the security module, in response to determining that the second communication device is authorized to access the security module.

Apparatus and method for sharing a hardware security module interface in a collaborative network

A first device initiates a handshake message exchange with a second device according to a security protocol. The first device determines that an application datagram is to be transmitted according to a first transport protocol that limits a size of a datagram based on a defined size. The first device also determines that an application datagram size is larger than the defined size. The first device fragments the application datagram if the application datagram size is larger than the defined size and secures the application datagram with the security protocol. The first device also encapsulates the application datagram fragments in handshake messages, wherein an encapsulated application datagram fragment is transmitted from the first device to the second device in a first security protocol record. The first device may also transmit, to the second device, another application datagram secured with the security protocol.

Method and apparatus for transmitting a user datagram protocol message that is larger than a defined size

Methods and apparatuses for validating the status of digital certificates include a relying party receiving at least one digital certificate and determining if the at least one digital certificate is to be validated against a private certificate status database. The relying party accesses the private certificate status database and cryptographically validates the authenticity of data in the private certificate status database. The relying party also validates the at least one digital certificate based on information in at least one of the private certificate status database and a public certificate status database.

Private certificate validation method and apparatus

A relying party obtains a certificate of a certificate subject and acquires a status information object for the certificate. The relying party validates the certificate using information in the status information object and compares authorization attributes present in the status information object with policy attributes associated with the requested service. A policy attribute is a set of constraints used by the relying party to determine if the authorization attributes associated with the certificate subject are sufficient to allow the certificate subject to access the requested service. If the authorization attributes present in the status information object match the policy attributes associated with the requested service, the relying party may grant the certificate subject access to the requested service.

Method and apparatus for authenticating a digital certificate status and authorization credentials

A method and device for confirming authenticity of a public key infrastructure (PKI) transaction event between a relying node and a subject node in a communication network enables improved network security. According to some embodiments, the method includes establishing at a PKI event logging (PEL) server a process to achieve secure communications with the relying node (step). Next, the PEL server processes reported PKI transaction event data received from the relying node (step). The reported PKI transaction event data describe the PKI transaction event between the relying node and the subject node. The reported PKI transaction event data are then transmitted from the PEL server to the subject node (step). The subject node can thus compare the reported PKI transaction event data with corresponding local PKI transaction event data to confirm the authenticity of the PKI transaction event.

Method and device for confirming authenticity of a public key infrastructure (PKI) transaction event

A method and device for distributing public key infrastructure (PKI) certificate path data enables relying nodes to efficiently authenticate other nodes in an autonomous ad-hoc network. The method includes compiling, at a certificate path management unit (CPMU), the PKI certificate path data (step). One or more available certificate paths are then determined at the CPMU for at least one relying node (step). Next, the PKI certificate path data are distributed by transmitting a certificate path data message from the CPMU to the at least one relying node (step). The certificate path data message includes information identifying one or more trusted certification authorities associated with the one or more available certificate paths.

Method and device for distributing public key infrastructure (PKI) certificate path data

A method and apparatus for distributing Certificate Revocation List (CRL) information in an ad hoc network are provided. Ad hoc nodes in an ad hoc network can each transmit one or more certificate revocation list advertisement message(s) (CRLAM(s)). Each CRLAM includes an issuer certification authority (CA) field that identifies a certification authority (CA) that issued a particular certificate revocation list (CRL), a certificate revocation list (CRL) sequence number field that specifies a number that specifies the version of the particular certificate revocation list (CRL) that was issued by the issuer certification authority (CA). Nodes that receive the CRLAMs can then use the CRL information provided in the CRLAM to determine whether to retrieve the particular certificate revocation list (CRL).

Growing community of inventors

Chicago, IL, United States of America

Erwin Himawan