Revocation and updating of tokens in a public key infrastructure system
View Patent ↗A method and computer program to revoke and update a token ( 130 ) having several encryption, signature and role certificates/private keys contained in the token ( 130 ). The certificates/private keys in the token 130 are transmitted wrapped by a public key and may only be activated by a private key contained in the token ( 130 ). The activation of any certificate/private key requires the entry of a passphrase by a user ( 132 ). Further, all certificates/private keys contained in a token ( 130 ) are stored in an authoritative database 104 . In the event that a token ( 130 ) is lost then all certificates/private keys associated with the token ( 130 ) are revoked. Further, when new certificates/private keys are issued to a user ( 132 ) these certificates/private keys are encrypted using the token's ( 130 ) public key and downloaded to the token ( 130 ).
1. A method of updating a token, comprising:
accessing a database by user identification and token identification, wherein the database has a plurality of certificates/private keys associated with each token identification;
determining which certificates/private keys of the plurality of certificates/private keys have not been downloaded to the token since the last update;
encrypting all certificates/private keys of the plurality of certificates/private keys which have been not been downloaded to the token using a public key associated with the token identification in the database to form a download packet;
downloading the download packet to the token; and
activating the certificates/private keys in the download packet using a private key in the token.
2. A method as recited in claim 1 , further comprising:
accessing the database by token identification to identify certificates/private keys which are expired or no longer valid; and
deleting the certificates/private keys identified which are expired or no longer valid from the token.
3. The method recited in claim 2 , further comprising:
transmitting a message to the user indicating no new certificates/private keys were found in the database when determined that all certificates/private keys of the plurality of certificates/private keys have been downloaded to the token since the last update from the database.
4. The method recited in claim 3 , wherein the plurality of certificates/private keys are at least one signature certificate/private key, encryption certificate/private key, and role certificate/private key.
5. The method recited in claim 4 , wherein the token is a smart card.
6. A computer program embodied on a computer readable medium and executable by a computer for updating a token, comprising:
accessing a database by user identification and token identification, wherein the database has a plurality of certificates/private keys associated with each token identification;
determining which certificates/private keys of the plurality of certificates/private keys have not been downloaded to the token since the last update;
encrypting all certificates/private keys of the plurality of certificates/private keys which have been not been downloaded to the token using a public key associated with the token identification in the database to form a download packet;
downloading the download packet to the token;
and activating the certificates/private keys using a private key in the token.
7. The computer program as recited in claim 6 , further comprising:
accessing the database by token identification to identify certificates/private keys which are expired or no longer valid; and
deleting the certificates/private keys identified which are expired or no longer valid from the token.
8. The computer program embodied on a computer readable medium and executable by a computer as recited in claim 6 , further comprising: accessing the database by token identification to identify certificates/private keys which are expired or no longer valid; and deleting the certificates/private keys identified which are expired or no longer valid from token.
9. The computer program embodied on a computer readable medium and executable by a computer recited in claim 8 , wherein the plurality of certificates/private keys are at least one signature certificates/private key, encryption certificates/private key, and role certificates/private key.
10. The computer program embodied on a computer readable medium and executable by a computer recited in claim 9 , wherein the token is a smart card.
11. The method recited in claim 1 , wherein the activating the certificates/private keys further comprises the entry of a passphrase.
12. The method recited in claim 1 , further comprising:
revoking each certificate/private key associated with a selected token identification for a given token.
13. The method recited in claim 1 , wherein the token identification is assigned by the token manufacturer at the time the token is created and stored in the database when assigned to a user.
14. The computer program embodied on a computer readable medium and executable by a computer recited in claim 6 , wherein the activating occurs in response to receipt of a passphrase.
15. The computer program embodied on a computer readable medium and executable by a computer recited in claim 6 , wherein the token identification is assigned by the token manufactured at the time the token is created and stored in the database when assigned to a user.
16. The computer program embodied on a computer readable medium and executable by a computer recited in claim 6 , further comprising: revoking each certificates/private key associated with a selected token identification for a given token.