Method and device for distributing public key infrastructure (PKI) certificate path data
View Patent ↗A method and device for distributing public key infrastructure (PKI) certificate path data enables relying nodes to efficiently authenticate other nodes in an autonomous ad-hoc network. The method includes compiling, at a certificate path management unit (CPMU), the PKI certificate path data (step 405 ). One or more available certificate paths are then determined at the CPMU for at least one relying node (step 410 ). Next, the PKI certificate path data are distributed by transmitting a certificate path data message from the CPMU to the at least one relying node (step 415 ). The certificate path data message includes information identifying one or more trusted certification authorities associated with the one or more available certificate paths.
1. A method for distributing certificate path data, the method comprising:
operating a certificate path management unit(CPMU) to:
obtain one or more node specified policy constraint rules for at least one relying node;
compile a set of certificate path data comprised of a set of trusted certification authorities;
apply the one or more node specified policy constraint rules to the set of certificate path data to generate a certificate path tree for a relying node of the at least one relying node, wherein the certificate path tree comprises paths from a trust node for the relying node of the at least one relying node to each of a plurality of hierarchically parallel target nodes; and
transmit a certificate path data message to the relying node of the at least one relying node, wherein the certificate path data message includes the certificate path tree.
2. The method according to claim 1 , wherein the certificate path data message includes a signed object that includes a list that identities the one or more trusted certification authorities and validated public keys for the one or more trusted certification authorities.
3. The method according to claim 1 , wherein the certificate path data message includes policies, constraints, or certificate revocation lists (CRLs) for the one or more trusted certification authorities.
4. The method according to claim 1 , further comprising:
operating the at least one relying node to:
process a signature of the certificate path data message; and
determine a trustworthiness of the one or more trusted certification authorities based on information contained in the certificate path data message.
5. The method according to claim 2 , wherein the list that identifies the one or more trusted certification authorities comprises a validated public key for each trusted certification authority in the list.
6. The method according to claim 1 , wherein the certificate path tree comprises a list of certification authorities that are both trusted by a trust anchor of the at least one relying node and allowed by the one or more node specified policy constraint rules imposed by the at least one relying node.
7. The method according to claim 1 , further comprising operating the certificate path management unit to:
process a certificate path query message received from the at least one relying node prior to operating to compile the set of certificate path data.
8. The method according to claim 1 , wherein the one or more node specified policy constraint rules associated with the at least one relying node include a corporate sector.
9. The method according to claim 7 , further comprising:
mutually authenticating the CPMU and the at least one relying node after the CPMU receives the certificate path query message.
10. The method according to claim 7 , wherein the certificate path query message is one of a plurality of periodic certificate path query messages used by the relying node to update the certificate path tree.
11. The method according to claim 7 , wherein the certificate path query message identifies the at least one relying node.
12. The method according to claim 7 , wherein the certificate path query message identifies one or more trust anchors of the at least one relying node.
13. The method according to claim 7 , wherein the certificate path query message identifies the one or more node specified policy constraint rules of the at least one relying node.
14. A certificate path management unit (CPMU) for distributing certificate path data, the CPMU comprising:
a wireless network interface for obtaining one or more node specified policy constraint rules for at least one relying node; and
a programmable memory for storing:
computer readable program code components for compiling, at the CPMU, a set of certificate path data comprised of a set of trusted certification authorities;
computer readable program code components for applying the one or more node specified policy constraint rules to the set of certificate path data to venerate a certificate path tree for a relying node of the at least one relying node, wherein the certificate path tree comprises paths from a trust node for the relying node of the at least one relying node to each of a plurality of hierarchically parallel target nodes; and
the wireless network interface further for transmitting a certificate path data message to the relying node of the at least one relying node, wherein the certificate path data message includes the certificate path tree.
15. The certificate path management unit (CPMU) according to claim 14 , wherein the certificate path data message includes a signed object that includes a list that identifies the one or more trusted certification authorities and validated public keys for the one or more trusted certification authorities.
16. The certificate path management unit ((CPMU) according to claim 14 , wherein the certificate path data message includes policies, constraints, or certificate revocation lists (CRLs) for the one or more trusted certification authorities.
17. The certificate path management unit (CPMU) according to claim 14 , wherein the one or more node specified policy constraint rules include a corporate sector.
18. The certificate path management unit (CPMU) according to claim 15 , wherein the list that identifies the one or more trusted certification authorities comprises a validated public key for each trusted certification authority in the list.
19. A method for processing received certificate path data distributed by a certificate path management unit (CPMU) the method comprising:
operating a relying node to:
receive a certificate path data message from the CPMU, wherein the certificate path data message includes a certificate path tree generated by the CPMU by applying one or more node specified policy constraint rules to a set of certificate path data, wherein the certificate path tree comprises paths from a trust node for the relying node to each of a plurality of hierarchically parallel target nodes; and
determine a trustworthiness one or re trusted certificate authorities based on information in the certificate path data message.
20. A method according to claim 19 , wherein the certificate path data message further includes a validated public key, and wherein the relying node uses the validated public key to determine the trustworthiness of the one or more trusted certificate authorities.