Northrop Grumman Systems Corporation

Vincent J McCullough

Kenneth Wagner Aull

James I Northrup

A method of automatically tracking a certificate pedigree is provided, in which a new user is provided with a piece of hardware containing a predetermined pedigree certificate stored therein, the predetermined pedigree certificate having a level of trust bearing a relationship to a category of hardware of which the provided piece of hardware is a member. An automated registration arrangement is provided which can be accessed only by users having a piece of hardware containing a predetermined pedigree certificate having a specified level of trust stored therein. When the new user accesses the automated registration arrangement using the provided piece of hardware, the automated registration arrangement provides the new user with an individual signature certificate having a level of trust commensurate with that of the pedigree certificate. The automated registration arrangement flags the new user's individual signature certificate with the level of trust of the pedigree certificate in an appropriate storage area, including the certificate itself.

Automated tracking of certificate pedigree

System and method for revocation of a signature certificate in a Public Key Infrastructure (PKI) that includes an enterprise with one or more servers, a directory, a registration web server, and one or more client platforms that allow users to access the servers of the enterprise. A user may desire to revoke a potentially compromised signature certificate of the user, or a manger of the user may revoke a signature certificate because it has been lost by the user, or the manager no longer desires that the user has access to servers of an enterprise. A user or personal revocation authority (manager) initiates a revocation process by creating an authenticated secure channel with a registration web server. Using the authenticated secure channel, the user or personal revocation authority requests the registration web server revoke a user signature certificate. The registration web server queries a directory to verify that the personal revocation authority is permitted to revoke the signature certificate of the user. The user signature certificate is revoked. The directory is notified by the registration web server of revocation of the user signature certificate. A user entry in the directory is set to a state without a signature certificate. A process for a new signature certificate for the user may now occur.

System and method for efficient and secure revocation of a signature certificate in a public key infrastructure

A method and computer program in which a user () may access the registration web server for the purpose of creating and utilizing a role certificate. This role certificate has policies associated with it and may be utilized for both encryption and as a digital signature. Individuals in a group share the same role certificate and can sign on behalf of the group. Further, individuals may decrypt messages sent to the group or any member of the group which have been encrypted using the role certificate. This method and computer program utilizes a directory () to maintain a list of all role certificates, their respective role administrators and all members of the organization that may utilize them. A key recovery authority () is utilized to recover expired role certificates. A certificate authority () is utilized to create and delete these role certificates. Further, a registration authority () is utilized to add and remove a previously created role.

Growing community of inventors

Chantilly, VA, United States of America

Vincent J McCullough