System and method for transparently providing certificate validation and other services within an electronic transaction
A system and method are disclosed for transparently providing certificate validation and other services without requiring a separate service request by either a relying customer or subscribing customer. In a preferred embodiment, after the subscribing customer digitally signs a document (e.g., a commercial document such as a purchase order), it forwards the document to a trusted messaging entity which validates the certificates of both the subscribing customer and relying customer and the respective system participants of which they are customers. If the certificates are valid, the trusted messaging entity appends a validation message to the digitally-signed document and forwards the document to the relying customer. A validation message is also preferably appended to a digitally-signed receipt from the relying customer and transmitted to the subscribing customer. In this way, both the relying customer and subscribing customer obtain certification of their respective counterparty to the transaction.
1. A method for providing one or more services via a network comprising:
receiving at a trusted messaging entity a digitally-signed document;
identifying a subscribing customer that digitally signed the document;
identifying an issuing participant associated with the subscribing customer;
identifying a relying customer that is intending to rely on the digitally-signed document;
identifying a relying participant associated with the relying customer;
transmitting a first validation request for a digital certificate of the issuing participant to a root entity, the first validation request being signed with a private key associated with a first digital certificate that names the relying customer;
receiving a validation response for the first validation request from the root entity;
transmitting a second validation request for a digital certificate of the subscribing customer to the issuing participant, the second validation request being signed with a private key associated with the first digital certificate that names the relying customer;
receiving a validation response for the second validation request from the issuing participant;
transmitting a third validation request for a digital certificate of the relying participant to the root entity, the third validation request being signed with a private key associated with a first digital certificate that names the subscribing customer;
receiving a validation response for the third validation request from the root entity; transmitting a fourth validation request for a digital certificate of the relying customer to the relying participant, the fourth validation request being signed with a private key associated with the first digital certificate that names the subscribing customer;
receiving a validation response for the fourth validation request from the relying participant;
determining whether the first, second, third, and fourth validation responses are positive;
if the first, second, third, and fourth validation responses are positive, creating a first digitally-signed message that indicates the validity of the subscribing-customer digital certificate, the first digitally-signed message being created using a private key associated with a second digital certificate that names the relying participant;
transmitting the digitally-signed document and the digitally-signed message to the relying customer.
2. The method of claim 1 , wherein the first validation request is made by the trusted messaging entity acting on behalf of a disclosed principal, and wherein the disclosed principal is the relying participant.
3. The method of claim 1 , wherein the second validation request is made by the trusted messaging entity acting on behalf of a disclosed principal, and wherein the disclosed principal is the relying participant.
4. The method of claim 1 , wherein the third validation request is made by the trusted messaging entity acting on behalf of a disclosed principal, and wherein the disclosed principal is the issuing participant.
5. The method of claim 1 , wherein the fourth validation request is made by the trusted messaging entity acting on behalf of a disclosed principal, and wherein the disclosed principal is the issuing participant.
6. The method of claim 1 , wherein the first digitally-signed message is made by the trusted messaging entity acting on behalf of a disclosed principal, and wherein the disclosed principal is the relying participant.
7. The method of claim 1 , further comprising:
receiving a digitally-signed receipt from the relying customer;
creating a second digitally-signed message that indicates the validity of the relying customer digital certificate, the second digitally-signed message being created using a private key associated with a second digital certificate that names the issuing participant; and
transmitting the digitally-signed receipt and the second digitally-signed message to the relying customer.
8. The method of claim 7 , wherein the second digitally-signed message is made by the trusted messaging entity acting on behalf of a disclosed principal, and wherein the disclosed principal is the issuing participant.
9. The method of claim 7 , wherein the first digital certificate that names the issuing participant and the second digital certificate that names the issuing participant are the same digital certificate.
10. The method of claim 1 , wherein the first digital certificate that names the relying participant and the second digital certificate that names the relying participant are the same digital certificate.
11. The method of claim 1 , wherein the first, second, third, and fourth validation requests are formatted in accordance with the Online Certificate Status Protocol.
12. A system for providing one or more services via a network comprising:
a receiver to receive a digitally signed document at a trusted messaging entity;
a subscribing customer identifier for identifying a subscribing customer that digitally signed the document;
an issuing participant identifier for identifying an issuing participant associated with the subscribing customer;
a relying customer identifier for identifying a relying customer that is intending to rely on the digitally signed document;
a relying participant identifier for identifying a relying participant associated with the relying customer;
a first validation request transmitter for transmitting a first validation request for a digital certificate of the issuing participant to a root entity, the first validation request being signed with a private key associated with a first digital certificate that names the relying customer;
a first validation response receiver for receiving a validation response for the first validation request from the root entity;
a second validation request transmitter for transmitting a second validation request for a digital certificate of the subscribing customer to the issuing participant, the second validation request being signed with a private key associated with the first digital certificate that names the relying customer;
a second validation response receiver for receiving a validation response for the second validation request from the issuing participant;
a third validation request transmitter for transmitting a third validation request for a digital certificate of the relying participant to the root entity, the third validation request being signed with a private key associated with a first digital certificate that names the subscribing customer;
a third validation request receiver for receiving a validation response for the third validation request from the root entity;
a fourth validation request transmitter for transmitting a fourth validation request for a digital certificate of the relying customer to the relying participant, the fourth validation request being signed with a private key associated with the first digital certificate that names the subscribing customer;
a fourth validation request receiver for receiving a validation response for the fourth validation request from the relying participant;
a validation response analyzer for determining whether the first, second, third, and fourth validation responses are positive;
a first digitally-signed message generator for creating a first digitally-signed message that indicates the validity of the subscribing-customer digital certificate if the first, second, third, and fourth validation responses are positive, the first digitally-signed message being created using a private key associated with a second digital certificate that names the relying participant;
a first digitally-signed message transmitter for transmitting the digitally-signed document and the first digitally-signed message to the relying customer.
13. The system of claim 12 , wherein the first validation request is made by the trusted messaging entity acting on behalf of a disclosed principal, and wherein the disclosed principal is the relying participant.
14. The system of claim 12 , wherein the second validation request is made by the trusted messaging entity acting on behalf of a disclosed principal, and wherein the disclosed principal is the relying participant.
15. The system of claim 12 , wherein the third validation request is made by the trusted messaging entity acting on behalf of a disclosed principal, and wherein the disclosed principal is the issuing participant.
16. The system of claim 12 , wherein the fourth validation request is made by the trusted messaging entity acting on behalf of a disclosed principal, and wherein the disclosed principal is the issuing participant.
17. The system of claim 12 , wherein the first digitally-signed message is made by the trusted messaging entity acting on behalf of a disclosed principal, and wherein the disclosed principal is the relying participant.
18. The system of claim 12 , further comprising:
a digitally-signed receipt receiver for receiving a digitally-signed receipt from the relying customer;
a second digitally-signed message generator for creating a second digitally-signed message that indicates the validity of the relying-customer digital certificate, the second digitally-signed message being created using a private key associated with a second digital certificate that names the issuing participant; and
a second digitally-signed message transmitter for transmitting the digitally-signed receipt and the second digitally-signed message to the relying customer.
19. The system of claim 18 , wherein the second digitally-signed message is made by the trusted messaging entity acting on behalf of a disclosed principal, and wherein the disclosed principal is the issuing participant.
20. The system of claim 18 , wherein the first digital certificate that names the issuing participant and the second digital certificate that names the issuing participant are the same digital certificate.
21. The system of claim 18 , wherein the first digital certificate that names the relying participant and the second digital certificate that names the relying participant are the same digital certificate.
22. The system of claim 18 , wherein the first, second, third, and fourth validation requests are formatted in accordance with the online Certificate Status Protocol.