Red Hat, Inc.

Thomas Alexander Wood

John Joseph Eckersberg, Ii

Daniel P Radez

Adrian Karstan Likins

Christopher L Rog

Efficient certificate revocation list (CRL) processing is disclosed. A desired modification to an encoded CRL is determined. A computing device sequentially processes, during a first pass, a first CRL stream comprising the CRL to identify a CRL length difference between the CRL and a modified CRL based on the desired modification. The computing device sequentially processes, during a second pass, a second CRL stream comprising the CRL. The computing device, during the second pass, streams a modified encoded header portion to a modified CRL stream that identifies a new length of the modified CRL based on the length difference, streams a modified encoded CRL entries portion comprising a plurality of CRL entries to the modified CRL stream that contains the desired modification, and streams a modified encoded trailer portion to the modified CRL stream that contains a new digital signature based on the desired modification.

Efficient certificate revocation list processing

Embodiments of the present teachings relate to systems and methods for generating modular security delegates for application instances, including, for example, applications usable on physical machines, virtualized environments, in the cloud, etc. According to embodiments, in a multiple network environment, multiple machines (or clients) can be configured, each having a defined security level. Each machine can include a plurality of application instances and corresponding security delegates for various defined security levels. For example, the defined security levels can be based on various authentication mechanisms, including, Kerberos, NT Lan Manager (NTLM) authentication protocol, secure sockets layer/transport security layer (SSL/TSL), token authentication, virtual private network (VPN), remote access security (RAS), digest authentication, etc.

Generating modular security delegates for applications

Embodiments of the present teachings relate to systems and methods for generating modular security delegates for applications. According to embodiments, in a multiple network environment, multiple machines (or clients) can be configured. Each machine can include a plurality of application instances and an authentication delegate. In addition, each network environment can include a communication interface to security services. The applications can include logic that indicates what security delegate to use for a given set of user authentication credentials. The logic can be configured to determine the appropriate authentication delegate using various methods. The authentication delegates can receive a set of user authentication credentials from application instances and determine whether the set of user authentication credentials are valid. Each authentication delegate corresponds to one and only one type of authentication mechanism.

In accordance with some aspects of the present disclosure, a method is disclosed that can include receiving, by a security delegate module, a set of user authentication credentials by an application running a first instance in a network for a user; determining, by the security delegate module, a type of the application; and selecting, by the security delegate module, a security service based on the set of user authentication credentials and the type of application.

Growing community of inventors

Raleigh, NC, United States of America

Thomas Alexander Wood