Digital certificate proxy
View Patent ↗The invention generates a temporary digital certificate with a useful life of only a few minutes to a few hours. An expiration time is attached to such temporary digital certificate by a secure computer platform that is presented with a user's smart-card. Expiration dates one or two years after the issuance of the smart-card are conventional. A digital certificate issued by a central authority is carried within the smart card and is used by the secure computer platform to generate temporary digital certificate. The temporary digital certificate functions as a proxy digital certificate that will allow the user to immediately pocket the smart card and thus avoid the possibility of forgetting it in a card reader.
1. A computer-user authentication system, comprising:
a physical token that can be carried by a user and introduced to a secure computing platform;
a long-term digital certificate disposed in the physical token; and
a short-term digital certificate authorized by the long-term digital certificate and generated by said physical token when the physical token is proximate thereto.
2. The computer-user authentication system of claim 1 , wherein:
the physical token comprises a smart-card and is introduced to said computing platform by bringing it into electrical contact such that the short-term digital certificate can be read.
3. The computer-user authentication system of claim 1 , wherein:
the long-term digital certificate is issued by a centralized certificate authentication authority and includes an expiration date.
4. The computer-user authentication system of claim 1 , wherein:
the short-term digital certificate is substantially a proxy of the long-term digital certificate and includes an expiration time that is dependent on a separation time in which the physical token leaves its proximity with said secure computing platform.
5. The computer-user authentication system of claim 1 , wherein:
the physical token comprises a microcomputer and is introduced to said secure computing platform by bringing it near enough to establish contact such that a short-term digital certificate proxy can be read.
6. The computer-user authentication system of claim 1 , wherein:
the physical token comprises a microcomputer and is introduced to said secure computing platform by bringing it first into actual electrical contact and then keeping it near enough to maintain contact such that the long-term digital certificate can be periodically read; and
the short-term digital certificate is a proxy of the long-term digital certificate and includes an expiration time that is dependent on a separation time in which said contact discontinues.
7. The computer-user authentication system of claim 1 , further comprising:
a centralized certificate authentication authority in network communication with said secure computing platform and which originally issued the long-term digital certificate; and
a time standard supplied to both the centralized certificate authentication authority and said secure computing platform, and providing for a test of an expiration time for the short-term digital certificate and an expiration date of long-term digital certificate.
8. A method of computer-user authentication, comprising the steps of:
introducing a long-term digital certificate with an expiration date to a computer platform through a physical token proximate thereto;
generating a short-term digital certificate with an expiration time from said long-term digital certificate; and
using said short-term digital certificate as a proxy digital certificate in subsequent secure communications.
9. The method of computer-user authentication of claim 8 , wherein:
said expiration time cannot exceed said expiration date.
10. The method of computer-user authentication of claim 8 , wherein:
proximity between a smart card within said physical token and said computer platform is a prerequisite to the step of generating.
11. The method of computer-user authentication of claim 8 , wherein:
a radio contact between a smart card within said physical token and said computer platform is a prerequisite to the step of generating.
12. The method of computer-user authentication of claim 8 , further comprising the step of:
dissolving said short-term digital certificate after said expiration time.
13. The method of computer-user authentication of claim 8 , further comprising the step of:
dissolving said short-term digital certificate when an electrical contact between a smart card within said physical token and said computer platform is discontinued.
14. The method of computer-user authentication of claim 8 , further comprising the step of:
dissolving said short-term digital certificate when a radio contact between a smart card within said physical token and said computer platform is discontinued.