Method and apparatus for external organization path length validation within a public key infrastructure (PKI)

1. An external organization path length (EOPL) validation method, comprising:

storing, in memory at a relying party node, a current external organization path length constraint (current EOPLC) value, and an external organization path length (EOPL) counter that maintains a count of an actual external organization path length;

receiving, at the relying party node, an authentication request from a subject node affiliated with an external organization that is external to an organization of the relying party node and seeking to be authenticated by the relying party node;

obtaining, at the relying party node, a chain of certificates that link the subject node to a trust anchor affiliated with the organization of the relying party node, wherein both the organization and the external organization comprise at least one node and at least one trust anchor;

initially setting the current EOPLC value to infinity and the EOPL counter to zero before processing any certificates in the chain; and

processing the certificates in the chain by:

selecting a current certificate in the chain of certificates to be evaluated, wherein a certificate in the chain of certificates comprises an external organizational flag (EOF) and an external organization path length constraint (EOPLC) value, and further wherein an enabled EOF indicates that the certificate was issued to a node affiliated with an external organization and the EOPLC value specifies a maximum allowable number of certificates within the chain of certificates that are permitted to include EOFs that are enabled;

replacing the current EOPLC value stored in memory with an EOPLC value from the current certificate when the current certificate has a lower EOPLC value than the current EOPLC value; and

incrementing the EOPL counter by one each time the certificate currently being evaluated comprises an EOF that is enabled.

2. An EOPL validation method according to claim 1 , wherein the step of processing the certificates in the chain further comprises:

determining whether the EOPL counter is less than or equal to the current EOPLC value stored in memory; and

determining that the external organization path validation has failed when the EOPL counter is greater than the current EOPLC value stored in memory.

3. An EOPL validation method according to claim 2 , wherein the step of processing the certificates in the chain further comprises:

determining whether the current certificate being evaluated is the last remaining certificate in the chain of certificates when the EOPL counter is less than or equal to the current EOPLC value stored in memory; and

determining that the external organization path validation is successful when the current certificate being evaluated is the last remaining certificate in the chain of certificates.

4. An EOPL validation method according to claim 1 , wherein processing the certificates in the chain further comprises selecting a next certificate in the chain when the relying party node determines that the current certificate being evaluated is not the last remaining certificate in the chain of certificates.

5. An EOPL validation method according to claim 1 , wherein the chain of certificates comprise at least:

one certificate that is issued to the subject node and that identifies the subject node as a subject, and

another certificate that is issued and signed by the trust anchor of the relying party node.

6. An EOPL validation method according to claim 1 , wherein the chain of certificates comprise first through Nth certificates that link the subject node to the trust anchor of the relying party node.

7. An EOPL validation method according to claim 1 , wherein the first certificate is the certificate that is issued to the subject node and that identifies the subject node as a subject.

8. A method for validating an external organization path length (EOPL) at a relying party node during certification path validation, comprising:

maintaining, in memory at the relying party node, a current external organization path length constraint (current EOPLC) value and an external organization path length (EOPL) counter that maintains a count of an actual external organization path length as the relying party node is validating external organization path length, wherein the current EOPLC value is initially set to infinity, and wherein a current value of the EOPL counter is initially set to zero before evaluating any certificates in the chain;

receiving, at the relying party node, an authentication request from a subject node seeking to be authenticated by the relying party node;

obtaining, at the relying party node, a chain of certificates that link the subject node to a trust anchor of the relying party node, wherein the trust anchor is affiliated with an organization, and wherein the subject node is affiliated with an external organization that is external to the organization and wherein both the organization and the external organization comprise at least one node and at least one trust anchor;

selecting, at the relying party node, a first certificate in the chain of certificates, wherein a certificate in the chain of certificates comprises an external organizational flag (EOF) and an external organization path length constraint (EOPLC) value, and further wherein an enabled EOF indicates that the certificate was issued to a node affiliated with an external organization and the EOPLC value specifies a maximum allowable number of certificates within the chain of certificates that are permitted to include EOFs that are enabled;

determining, at the relying party node, whether an external organization path length constraint (EOPLC) from the first certificate is less than the current EOPLC value stored in memory;

updating the current EOPLC value stored in memory of the relying party node with the EOPLC from the first certificate when the relying party node determines that the EOPLC from the first certificate is less than the current EOPLC value stored in memory;

incrementing by one, at the relying party node, a current value of an external organization path length (EOPL) counter when the first certificate comprises an external organization flag (EOF) that is enabled;

determining, at the relying party node, whether a current value of the EOPL counter is less than or equal to the current EOPLC value stored in memory, and determining that external organization path validation has failed when the relying party node determines that the current value of the EOPL counter is greater than the current value of the EOPLC stored in memory;

determining, at the relying party node, whether the first certificate is the last remaining certificate in the chain of certificates when the relying party node determines that the current value of the EOPL counter is less than or equal to the current value of the EOPLC stored in memory, and determining that external organization path validation was is successful when the first certificate is the last remaining certificate in the chain of certificates; and

selecting, at the relying party node, a next certificate in the chain when the relying party node determines that the first certificate is not the last remaining certificate in the chain of certificates.

9. A method according to claim 8 , wherein further comprising:

repeating steps of updating through selecting with respect to the each certificate in the chain until the relying party determines that external organization path validation has failed or is successful,

wherein external organization path validation fails when the relying party node determines that the current value of the EOPL counter is greater than the current EOPLC value stored in memory, and

wherein external organization path validation is successful when the relying party node determines that the current certificate being evaluated is the last remaining certificate in the chain of certificates.

10. A method according to claim 8 , wherein each of the certificates is a public key certificate issued by a certification authority and further comprises:

an issuer field that identifies a name of the certification authority that issued the digital public key certificate; and

a subject field that identifies a node trusted by the certification authority specified in the issuer field; and

a public key of the node specified in the subject field;

a basic constraints field comprising a path length constraint; and

a digital signature of the certification authority comprising: a private key of the certification authority that issued the digital public key certificate.

11. A method according to claim 10 , wherein the public key certificates comprise:

X.509 compliant public key certificates.

12. A method according to claim 8 , wherein the chain of certificates comprises first through Nth certificates that link the subject node to the trust anchor of the relying party node.

13. A method according to claim 12 , wherein the first certificate is the certificate that is issued to the subject node and that identifies the subject node as a subject.

14. A method according to claim 8 , wherein the trust anchor comprises:

a root certification authority for the organization.

15. A method for issuing a digital public key certificate to a node trusted by a certification authority, the method comprising:

generating, at the certification authority, a digital public key certificate comprising:

an issuer field that identifies a name of the certification authority that issued the digital public key certificate;

a subject field that identifies a node trusted by the certification authority specified in the issuer field;

a public key of the node specified in the subject field;

a basic constraints field comprising:

a path length constraint;

an external organization flag (EOF) that indicates whether the certificate was issued to a node affiliated with an external organization that is external to an organization of the certification authority, wherein both the organization and the external organization comprise at least one node and at least one certification authority; and

an external organization path length constraint (EOPLC) that specifies a value equal to a maximum allowable number of certificates within the chain of certificates that are permitted to include an EOF that is enabled;

and a digital signature of the certification authority comprising: a private key of the certification authority that issued the digital public key certificate; and

communicating the digital public key certificate from the certification authority to the node.