Entrust Technologies Limited

Northern Telecom Limited

Entrust Corporation

Josanne Mary Otway

Paul C Van Oorschot

Michael James Wiener

Stephen William Hillier

Warwick S Ford

Marek Buchler

Mark Christopher Batten-Carew

Stephen William Hiller

An adaptable cryptographic method and system provides updated digital signature key pairs in a public key system by providing, through a multi-client manager unit, selectable expiry data such as digital signature certificate lifetime data, public key expiry data and private key expiry data as selectable on a per client basis. The multi-client manager unit stores selected public key expiry data and private key expiry data for association with a new digital signature key pair and associates the stored selected expiry data with the new digital signature key pair to facilitate a transition from an old digital signature key pair to a new digital signature key pair.

Method and system for providing updated encryption key pairs and digital signature key pairs in a public key system

A first trusted authority, such as an originating certification authority, that stores key history data, such as private decryption keys for one or more subscribers, includes a key history exportation engine operative to generate a security key history exportation packet. The security key history exportation packet contains at least encrypted security key history data uniquely associated with a subscriber. A second trusted authority, such as a destination certification authority, includes a security key history importation engine operative to decrypt the security key history exportation packet. The retrieved security key history data then is stored and made accessible through the second trust authority for later access by the subscriber. The second trusted authority serves as a new trust anchor instead of the first trust authority.

Information security subscriber trust authority transfer system with private key history transfer

A method and apparatus for processing administration in a secure community, or communication system, is accomplished by dividing the single computing devices functionality of the administrator/officer/server into physically separate computing devices that function as a serving entity and an administrative entity. In the secure system, when an administrative entity has an administrative function to perform for one of its end-users, it requests a permissions matrix from the serving entity. The serving entity, after authenticating the administrative entity, sends the permissions matrix to the requesting administrative entity in an encoded format. The permissions matrix indicates which administrative functions the requesting administrative entity is authorized to perform for its affiliated end-users. Upon receiving the permissions matrix, the administrative entity verifies the authenticity of the permissions matrix based on the encoded format. When the authenticity of the permissions matrix is verified, the administrative entity generates an administrative request based on an administrator's input and the permissions matrix and sends it to the serving entity over a secure communication link. Upon receiving the administrative request, the serving entity verifies the identity of the administrative entity, verifies validity of the request according to the permissions matrix, and, if verified, processes the administrative requests on behalf of the particular end-user.

Method and apparatus for processing administration of a secured community

A method which allows implementation of the revocation of public-key certificates facilitates engineering of certificate revocation lists (CRLs). It solves the practical problem of CRLs potentially growing to unmanageable lengths by allowing CRLs to be segmented, based on size considerations or priority considerations related to revocation reasons. The method is used to distribute CRL information to users of certificate-based public-key systems. It is also applied more generally to update any field in a certificate by reference to a secondary source of authenticated information.

Growing community of inventors

Ottawa, Canada

Josanne Mary Otway