Entrust Technologies Limited

Entrust Corporation

Ronald J Vandergeest

Sharon Marie Boeyen

James Steven Lloyd

Timothy E Moses

Glenn C Langford

An apparatus and method dynamically creates security keys for a subscriber, having at least one preexisting security credential set, and allows the configuration for N key pairs or N keys (where the cryptographic system is a symmetric key system). Such a system provides flexibility in assigning cryptographic algorithms and cryptographic keys to facilitate a change in algorithm without requiring reinitialization of a processing unit or subscriber. The apparatus and method provides a configurable security key manifest, such as a template or table, operative to contain a non-prespecified number of security keys. A security officer or other source may input key configuration data to a graphic user interface template or other suitable mechanism to configure the security key manifest. Once configured (populated), the apparatus dynamically controls the generation of at least one new security key for the subscriber based on received key attribute data and based on the differences in current and prior security key manifests.

Dynamic security credential generation system and method

An apparatus and method provides arbitration among a plurality of subscribers and also provides access isolation between a requester, such as a subscriber or other entity, and a security-related information source, such as a repository containing certificates and certificate revocation lists (CRLs) or other security-related information. The system and method isolates the requester from the source by generating separate security information release-data to obtain the security-related information from the source based on analyzed request criteria-data. The arbitration module generates a separate security-information release request to the repository to retrieve appropriate data from the internal repository in response to the externally generated request without allowing the request to filter directly through to the security-related information source.

Method and apparatus for providing access isolation of requested security related information from a security related information source

A certificate issuing apparatus and method creates a new certificate of a differing format from an existing certificate format to facilitate certificate conversion. A certificate converting unit receives first certificate data in a first format and desired certificate format criteria data, such as data representing the format of a certificate to which the first certificate is to be converted. The apparatus and method then generates second certificate data in a second format in response to the desired certificate format criteria data. In one embodiment, this is done using certificate format template data, such as templates representing the format and/or syntax of a plurality of differing certificate formats. The format template data is then mapped so that information from one certificate can be suitably mapped and then placed in a proper format and syntax for a different certificate format.

Information certificate format converter apparatus and method

An application registration data generator, on a per application basis, generates application registration data that contains at least application identification data, such as, the name of a software application or a pathname to a software application, and stored unique application verification data that is based on executable file data. A data access determinator determines whether a calling application should be allowed access to the limited access based data by, for example, computing a hash value of the executable file and checking whether this hash value matches the corresponding stored unique application verification data. If there is a match, the application is granted access to the user's cryptographic parameters, privilege data, or other limited access based data on a per application basis.

Method and apparatus for controlling application access to limited access based data

A certificate management system and method allows a requester, such as a subscriber using a software application, to customize certificates by selecting variable certificate content specification data. A certificate issuing unit, such as a certification authority issues a variable content based certificate in response to the requester based variable certificate content specification data, after the variable certificate content specification data has been compared with issuance criteria data to ensure that the requested certificate customization parameters do not conflict with security system constraints, such as security limits. The issuance criteria data is configurable by a security officer or other user through the certificate issuing unit. If desired, each differing software application (i.e., requester) may have its own customized certificates allowing greater flexibility for the security system and for the requesters.

Growing community of inventors

Kanata, Canada

Ronald J Vandergeest