Using a portable security token to facilitate cross-certification between certification authorities

1. A method for using a portable security token to facilitate cross-certification between a first certification authority (CA) and a second CA, comprising:

using the portable security token to transfer certification information between the first CA and the second CA, wherein the first CA and associated subscriber devices constitute a first public-key infrastructure (PKI) domain, wherein the second CA and associated subscriber devices constitute a second PKI domain, and wherein the portable security token communicates with the first CA and the second CA through a location-limited communication channel;

using the certification information to issue a cross-certificate to the first CA signed by the second CA; and

propagating the cross-certificate from the first CA to associated subscriber devices in the first PKI domain, thereby allowing the associated subscriber devices in the first PKI domain to authenticate themselves to devices in the second PKI domain.

2. The method of claim 1 , further comprising:

using the certification information to issue a cross-certificate to the second CA signed by the first CA; and

propagating the cross-certificate from the second CA to associated subscriber devices in the second PKI domain, thereby allowing the associated subscriber devices in the second PKI domain to authenticate themselves to devices in the first PKI domain.

3. The method of claim 1 , wherein the cross-certificate issued to the first CA delegates limited access rights to devices in the first PKI domain during interactions with devices in the second PKI domain.

4. The method of claim 1 ,

wherein using the portable security token to transfer certification information between the first CA and the second CA involves,

installing the public key of the first CA on the portable security token,

moving the portable security token in close physical proximity to the second CA, and

communicating the public key of the first CA to the second CA through the location-limited communication channel; and

wherein using the certification information to issue a cross-certificate to the first CA involves,

creating the cross-certificate at the second CA by using the private key of the second CA to sign the public key of the first CA, and

communicating the cross-certificate from the second CA to the first CA.

5. The method of claim 1 ,

wherein using the portable security token to transfer certification information between the first CA and the second CA involves,

installing the private key of the second CA on the portable security token, and

moving the portable security token in close physical proximity to the first CA; and

wherein using the certification information to issue a cross-certificate to the first CA involves,

receiving the public key of the first CA at the portable security token through the location-limited communication channel,

creating the cross-certificate at the portable security token by signing the public key of the first CA with the private key of the second CA, and

communicating the cross-certificate from the portable security token to the first CA.

6. The method of claim 1 ,

wherein using the portable security token to transfer certification information between the first CA and the second CA involves,

causing the second CA and the portable security token to agree upon a secret key, and

bringing the portable security token in close physical proximity to the first CA; and

wherein using the certification information to issue a cross-certificate to the first CA involves,

receiving an authenticator for the first CA at the portable security token through the location-limited communication channel,

forming a ticket by signing the authenticator with the secret key previously agreed upon by the portable security token and the second CA, and

communicating the ticket from the portable security token to the first CA, whereby the first CA can subsequently present the ticket to the second CA to prove that the first CA is authorized to receive a cross-certificate from the second CA.

7. The method of claim 1 ,

wherein using the portable security token to transfer certification information between the first CA and the second CA involves,

causing the portable security token to receive a digital certificate issued by the second CA, and

bringing the portable security token in close physical proximity to the first CA; and

wherein using the certification information to issue a cross-certificate to the first CA involves,

receiving an authenticator for the first CA at the portable security token through the location-limited communication channel,

forming a ticket by signing the authenticator with a private key of the PST, which is associated with the digital certificate, and

communicating the ticket from the portable security token to the first CA, whereby the first CA can subsequently present the ticket to the second CA to prove that the first CA is authorized to receive a cross-certificate from the second CA.

8. The method of claim 1 , wherein issuing the cross-certificate to the first CA also involves communicating a root certificate for the second CA to the first CA.

9. The method of claim 1 , wherein the first CA maintains a certificate revocation list (CRL), which is accessible by devices in the second PKI domain, thereby enabling the first CA to revoke credentials for devices in the first PKI domain, and wherein the revocations are visible to devices in the second PKI domain.

10. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for using a portable security token to facilitate cross-certification between a first certification authority (CA) and a second CA, the method comprising:

using the portable security token to transfer certification information between the first CA and the second CA, wherein the first CA and associated subscriber devices constitute a first public-key infrastructure (PKI) domain, wherein the second CA and associated subscriber devices constitute a second PKI domain, and wherein the portable security token communicates with the first CA and the second CA through a location-limited communication channel;

using the certification information to issue a cross-certificate to the first CA signed by the second CA; and

propagating the cross-certificate from the first CA to associated subscriber devices in the first PKI domain, thereby allowing the associated subscriber devices in the first PKI domain to authenticate themselves to devices in the second PKI domain.

11. The computer-readable storage medium of claim 10 , wherein the method further comprises:

using the certification information to issue a cross-certificate to the second CA signed by the first CA; and

propagating the cross-certificate from the second CA to associated subscriber devices in the second PKI domain, thereby allowing the associated subscriber devices in the second PKI domain to authenticate themselves to devices in the first PKI domain.

12. The computer-readable storage medium of claim 10 , wherein the cross-certificate issued to the first CA delegates limited access rights to devices in the first PKI domain during interactions with devices in the second PKI domain.

13. The computer-readable storage medium of claim 10 ,

wherein using the portable security token to transfer certification information between the first CA and the second CA involves,

installing the public key of the first CA on the portable security token,

moving the portable security token in close physical proximity to the second CA, and

communicating the public key of the first CA to the second CA through the location-limited communication channel; and

wherein using the certification information to issue a cross-certificate to the first CA involves,

creating the cross-certificate at the second CA by using the private key of the second CA to sign the public key of the first CA, and

communicating the cross-certificate from the second CA to the first CA.

14. The computer-readable storage medium of claim 10 ,

wherein using the portable security token to transfer certification information between the first CA and the second CA involves,

installing the private key of the second CA on the portable security token, and

moving the portable security token in close physical proximity to the first CA; and

wherein using the certification information to issue a cross-certificate to the first CA involves,

receiving the public key of the first CA at the portable security token through the location-limited communication channel,

creating the cross-certificate at the portable security token by signing the public key of the first CA with the private key of the second CA, and

communicating the cross-certificate from the portable security token to the first CA.

15. The computer-readable storage medium of claim 10 ,

wherein using the portable security token to transfer certification information between the first CA and the second CA involves,

causing the second CA and the portable security token to agree upon a secret key, and

bringing the portable security token in close physical proximity to the first CA; and

wherein using the certification information to issue a cross-certificate to the first CA involves,

receiving an authenticator for the first CA at the portable security token through the location-limited communication channel,

forming a ticket by signing the authenticator with the secret key previously agreed upon by the portable security token and the second CA, and

communicating the ticket from the portable security token to the first CA, whereby the first CA can subsequently present the ticket to the second CA to prove that the first CA is authorized to receive a cross-certificate from the second CA.

16. The computer-readable storage medium of claim 10 ,

wherein using the portable security token to transfer certification information between the first CA and the second CA involves,

causing the portable security token to receive a digital certificate issued by the second CA, and

bringing the portable security token in close physical proximity to the first CA; and

wherein using the certification information to issue a cross-certificate to the first CA involves,

receiving an authenticator for the first CA at the portable security token through the location-limited communication channel,

forming a ticket by signing the authenticator with a private key of the PST, which is associated with the digital certificate, and

communicating the ticket from the portable security token to the first CA, whereby the first CA can subsequently present the ticket to the second CA to prove that the first CA is authorized to receive a cross-certificate from the second CA.

17. The computer-readable storage medium of claim 10 , wherein issuing the cross-certificate to the first CA also involves communicating a root certificate for the second CA to the first CA.

18. The computer-readable storage medium of claim 10 , wherein the first CA maintains a certificate revocation list (CRL), which is accessible by devices in the second PKI domain, thereby enabling the first CA to revoke credentials for devices in the first PKI domain, and wherein the revocations are visible to devices in the second PKI domain.

19. An apparatus that uses a portable security token to facilitate cross-certification between a first certification authority (CA) and a second CA, comprising:

a portable security token configured to transfer certification information between the first CA and the second CA, wherein the first CA and associated subscriber devices constitute a first public-key infrastructure (PKI) domain, wherein the second CA and associated subscriber devices constitute a second PKI domain, and wherein the portable security token communicates with the first CA and the second CA through a location-limited communication channel;

a certificate issuing mechanism configured to use the certification information to issue a cross-certificate to the first CA signed by the second CA; and

a propagation mechanism within the first PKI domain configured to propagate the cross-certificate from the first CA to associated subscriber devices in the first PKI domain, thereby allowing the associated subscriber devices in the first PKI domain to authenticate themselves to devices in the second PKI domain.

20. The apparatus of claim 19 , further comprising:

a second certification mechanism is configured to use the certification information to issue a cross-certificate to the second CA signed by the first CA; and

a second propagation mechanism configured to propagate the cross-certificate from the second CA to associated subscriber devices in the second PKI domain, thereby allowing the associated subscriber devices in the second PKI domain to authenticate themselves to devices in the first PKI domain.

21. The apparatus of claim 19 , wherein the cross-certificate issued to the first CA delegates limited access rights to devices in the first PKI domain during interactions with devices in the second PKI domain.

22. The apparatus of claim 19 ,

wherein the portable security token is configured to,

receive the public key of the first CA, and to

communicate the public key of the first CA to the second CA through the location-limited communication channel; and

wherein the certificate issuing mechanism is configured to,

create the cross-certificate at the second CA by using the private key of the second CA to sign the public key of the first CA, and to

communicate the cross-certificate from the second CA to the first CA.

23. The apparatus of claim 19 ,

wherein the portable security is configured to,

receive the private key of the second CA on the portable security token, and to

receive the public key of the first CA through the location-limited communication channel; and

wherein the certificate issuing mechanism is configured to,

creating the cross-certificate at the portable security token by signing the public key of the first CA with the private key of the second CA, and

communicating the cross-certificate from the portable security token to the first CA.

24. The apparatus of claim 19 ,

wherein the portable security is configured to,

agree upon a secret key with the second CA, and to

receive an authenticator for the first CA through the location-limited communication channel; and

wherein the certificate issuing mechanism is configured to,

form a ticket by signing the authenticator with the secret key previously agreed upon by the portable security token and the second CA, and to

communicate the ticket from the portable security token to the first CA, whereby the first CA can subsequently present the ticket to the second CA to prove that the first CA is authorized to receive a cross-certificate from the second CA.

25. The apparatus of claim 19 ,

wherein the portable security is configured to,

receive a digital certificate issued by the second CA, and to

receive an authenticator for the first CA through the location-limited communication channel; and

wherein the certificate issuing mechanism is configured to,

form a ticket by signing the authenticator with a private key of the PST, which is associated with the digital certificate, and to

communicate the ticket from the portable security token to the first CA, whereby the first CA can subsequently present the ticket to the second CA to prove that the first CA is authorized to receive a cross-certificate from the second CA.

26. The apparatus of claim 19 , wherein the certificate issuing mechanism is also configured to communicate a root certificate for the second CA to the first CA.

27. The apparatus of claim 19 , wherein the first CA is configured to maintain a certificate revocation list (CRL), which is accessible by devices in the second PKI domain, thereby enabling the first CA to revoke credentials for devices in the first PKI domain, and wherein the revocations are visible to devices in the second PKI domain.