Method and device for confirming authenticity of a public key infrastructure (PKI) transaction event

1. A method for confirming authenticity of a public key infrastructure (PKI) transaction event between a relying node and a subject node in a communication network, the method comprising:

establishing at a PKI event logging (PEL) server a process to achieve secure communications with the relying node;

processing at the PEL server reported PKI transaction event data received from the relying node, wherein the reported PKI transaction event data describe the PKI transaction event between the relying node and the subject node; and

transmitting the reported PKI transaction event data from the PEL server to the subject node, wherein one or more of:

the reported PKI transaction event data are transmitted from the PEL server to the subject node in response to a query message received at the PEL server from the subject node;

the reported PKI transaction event data are automatically transmitted from the PEL server to the subject node in response to processing at the PEL server the reported PKI transaction event data; and

whereby the subject node can compare the reported PKI transaction event data with corresponding local PKI transaction event data to confirm the authenticity of the PKI transaction event.

2. The method of claim 1 , wherein confirming the authenticity of the PKI transaction event comprises determining that a private key of the subject node has not been compromised.

3. The method of claim 1 , wherein the relying node obtains a uniform resource locator (URL) address of the PEL server from a PKI certificate of the subject node.

4. The method of claim 1 , wherein the reported PKI transaction event data include data for a plurality of PKI transaction events.

5. The method of claim 1 , wherein processing at the PEL server the reported PKI transaction event data comprises analyzing the reported PKI transaction event data to determine invalid use of PKI certificates associated with the reported PKI transaction event data.

6. The method of claim 1 , wherein the PKI transaction event data comprise data selected from the following: a PKI certificate subject, a PKI certificate issuer distinguished name, a subject key identifier (SKI), an issuer key identifier (AKI), a PKI certificate serial number, a transaction identification, a transaction amount, a hash of transaction details, a digital signature of transaction details, a transaction date, a transaction time stamp, a requested transaction type, an originating internet protocol (IP) address of the relying node, and an identification of a triggering application of the relying node.

7. The method of claim 1 , wherein the PKI transaction event includes a node authentication event or a message digital signature event.

8. The method of claim 1 , wherein the subject node compares the reported PKI transaction event data with the corresponding local PKI transaction event data by comparing one or more of the following parameters included in both the reported PKI transaction event data and the corresponding local PKI transaction event data: a PKI certificate subject, a PKI certificate issuer distinguished name, a subject key identifier (SKI), an issuer key identifier (AKI), a PKI certificate serial number, a transaction identification, a transaction amount, a hash of transaction details, a digital signature of transaction details, a transaction date, a transaction time stamp, a requested transaction type, an originating internet protocol (IP) address of the relying node, and an identification of a triggering application of the relying node.

9. The method of claim 1 , wherein the reported PKI transaction event data is received at the PEL server after the relying node has authenticated the subject node.

10. The method of claim 1 , wherein the reported PKI transaction event data is received at the PEL server after the relying node has validated a certificate of the subject node.

11. A method for confirming authenticity of a public key infrastructure (PKI) transaction event between a relying node and a subject node in a communication network, the method comprising:

establishing at a PKI event logging (PEL) server a process to achieve secure communications with the relying node;

processing at the PEL server reported PKI transaction event data received from the relying node, wherein the reported PKI transaction event data describe the PKI transaction event between the relying node and the subject node;

establishing at the PKI event logging (PEL) server a process to achieve secure communications with the subject node; and

confirming that a private key of the subject node has not been compromised by confirming the authenticity of the PKI transaction event at the PEL server, wherein confirming the authenticity of the PKI transaction event comprises comparing the reported PKI transaction event data and corresponding local PKI transaction event data received from the subject node.

12. The method of claim 11 , wherein the reported PKI transaction event data is received at the PEL server after the relying node has authenticated the subject node.

13. The method of claim 11 , wherein the reported PKI transaction event data is received at the PEL server after the relying node has validated a certificate of the subject node.

14. The method of claim 11 , wherein confirming the authenticity of the PKI transaction event comprises determining that a private key of the subject node has not been compromised.

15. The method of claim 11 , wherein the relying node obtains a uniform resource locator (URL) address of the PEL server from a PKI certificate of the subject node.

16. The method of claim 11 , wherein the reported PKI transaction event data include data for a plurality of PKI transaction events.

17. The method of claim 11 , wherein processing at the PEL server the reported PKI transaction event data comprises analyzing the reported PKI transaction event data to determine invalid use of PKI certificates associated with the reported PKI transaction event data.

18. A public key infrastructure (PKI) event logging (PEL) server for confirming authenticity of a PKI transaction event between a relying node and a subject node in a communication network, the PEL server comprising:

a network interface to communicate with the relying node and the subject node;

a memory to store reported PKI transaction event data that describe the PKI transaction event between the relying node and the subject node; and

a processor coupled to the network interface and the memory, the processor configured to:

establish a process to achieve secure communications with the relying node;

process the reported PKI transaction event data received from the relying node; and

cause the network interface to transmit the reported PKI transaction event data to the subject node, wherein one or more of:

the reported PKI transaction event data are transmitted from the PEL server to the subject node in response to a query message received at the PEL server from the subject node;

the reported PKI transaction event data are automatically transmitted from the PEL server to the subject node in response to processing at the PEL server the reported PKI transaction event data; and

whereby the subject node can compare the reported PKI transaction event data with corresponding local PKI transaction event data to confirm the authenticity of the PKI transaction event.