System and method for efficient and secure revocation of a signature certificate in a public key infrastructure

1. A method for revocation of a signature certificate in a Public Key Infrastructure (PKI) comprising:

creating an authenticated secure channel with a registration web server;

requesting the registration web server revoke a user signature certificate, the requesting occurring over the authenticated secure channel;

revoking the user signature certificate;

notifying a directory by the registration web server of revocation of the user signature certificate;

setting a user entry in the directory to a state without a signature certificate; and

notifying a personal revocation authority that a user has lost a user signature certificate, the notifying occurring before the creating.

2. The method according to claim 1 , further comprising generating a directory password for the user during creation of the user signature certificate.

3. The method according to claim 1 , wherein the creating and requesting are initiated by the personal registration authority.

4. The method according to claim 3 , further comprising requesting a personal registration authority's signature certificate to authenticate the personal registration authority before the creating.

5. The method according to claim 4 , wherein the personal registration authority is a supervisor of the user.

6. The method according to claim 4 , further comprising querying the directory after the requesting the registration web server revoke the user signature certificate to determine if the personal registration authority is permitted to revoke the user signature certificate.

7. The method according to claim 6 , further comprising revoking the user signature certificate by the registration web server only if the personal registration authority is permitted to revoke the user signature certificate.

8. The method according to claim 7 , further comprising generating a directory password for the user during creation of the user signature certificate.

9. The method according to claim 8 , further comprising sending the user one of a password and a personal identification number (PIN) by the registration web server after the setting of the user entry.

10. The method according to claim 9 , further comprising requesting a new signature certificate by the user using the directory password and one of the password and the PIN.

11. The method according to claim 1 , wherein the revoking is performed by the registration web server.

12. A server comprising a storage medium having instructions stored therein, the instructions when executed causing a processing device to perform:

creating an authenticated secure channel between the server and a personal revocation authority;

receiving a request from the personal revocation authority to revoke a user signature certificate;

revoking the user signature certificate;

notifying a directory of revocation of the user signature certificate; and

notifying the personal revocation authority that a user has lost a user signature certificate, the notifying the personal revocation authority occurring before the creating.

13. The server according to claim 12 , further comprising verifying the personal revocation authority is permitted to revoke the user signature certificate.

14. The server according to claim 13 , further comprising revoking the user signature certificate only if the personal registration authority is permitted to revoke the user signature certificate.

15. A system for revocation of a signature certificate in a Public Key Infrastructure (PKI) comprising:

at least one server operably connected to a network;

a directory operably connected to the network, the directory containing information on at least one user;

at least one client platform operably connected to the network, the at least one user having access to the at least one server from the at least one client platform; and

a registration web server operably connected to the network, the registration web server receiving a request for revocation of a user signature certificate from a personal revocation authority over an authenticated secure channel in response to the personal revocation authority being notified that the user has lost a user signature certificate, the registration web server revoking the user signature certificate only if the personal revocation authority is permitted to revoke the user signature certificate, the registration web server notifying the directory of revocation of the user signature certificate if revoked.

16. The system according to claim 15 , wherein the information on at least one user includes a user entry related to the user signature certificate, the directory setting the user entry in the directory to a state without a signature certificate if the user signature certificate is revoked.

17. The system according to claim 15 , further comprising an authenticated secure channel between the personal revocation authority and the registration web server, the requesting occurring over the authenticated secure channel.

18. The system according to claim 15 , wherein the personal revocation authority is a supervisor of the at least one user.