Method and device for enabling a trust relationship using an unexpired public key infrastructure (PKI) certificate
A method and device are useful for enabling a trust relationship using an unexpired public key infrastructure (PKI) certificate, where a current status of the PKI certificate is unavailable. The method includes determining at a relying party that a certificate status update for the PKI certificate is unavailable (step 905 ). Next, in response to the certificate status update being unavailable, a tolerable certificate status age (TCSA) for the PKI certificate is determined at the relying party based on one or more attributes associated with a certificate holder of the PKI certificate (step 910 ). Using the PKI certificate, a trust relationship is enabled between the relying party and the certificate holder after determining the TCSA and before an expiration of the TCSA (step 915 ).
1. A method for enabling a trust relationship using an unexpired public key infrastructure (PKI) certificate where a current status of the PKI certificate is unavailable, the method comprising:
determining at a relying party device that a certificate status update for the PKI certificate is unavailable;
determining at the relying party device, in response to the certificate status update being unavailable, a tolerable certificate status age (TCSA) for the PKI certificate based on one or more attributes associated with a certificate holder of the PKI certificate, wherein the TCSA is an interval during which an unexpired certificate can be conditionally trusted despite a lack of a timely certificate status update and further wherein the TCSA conforms to the following equation:
TCSA =( T _Current− T _BeginUncertainty)+ T (attributes),
wherein T_Current denotes a current time when the certificate holder is attempting to authenticate with the relying party,
T_BeginUncertainty denotes a beginning of an interval in which the relying party is unable to detect a revocation of the PKI certificate, and
T(attributes) conforms to the following bounds:
0≦ T (attributes)≦Max TCSA −( T _Current− T _BeginUncertainty)
wherein MaxTCSA is greater than or equal to TCSA; and
enabling, using the PKI certificate, a trust relationship between the relying party and the certificate holder after calculating the TCSA and before an expiration of the TCSA.
2. The method of claim 1 , T(Attributes)=α(attributes)×ΔTCSA,
wherein
α(attributes) is a minimum of metrics assigned to individual applicable attributes or a product of the metrics, and
ΔTCSA is equal to (MaxTCSA−(T_Current−T_BeginUncertainty)).
3. The method of claim 1 , wherein the one or more attributes associated with the certificate holder are selected from the following: one or more personnel attributes, one or more system attributes, and one or more environmental attributes.
4. The method of claim 3 , wherein the personnel attributes are identified in the PKI certificate and are selected from the following: a security level, a security tenure, a total employment seniority, a rank, and a trustworthiness metric.
5. The method of claim 3 , wherein the system attributes include whether a device associated with the PKI certificate includes licensed hardware or software.
6. The method of claim 5 , wherein the licensed hardware comprises a secure storage facility for a private key associated with the PKI certificate.
7. The method of claim 5 , wherein the licensed software comprises encryption software.
8. The method of claim 3 , wherein the environmental attributes are selected from the following: a network status, one or more detected alarms, and one or more local policy variables.
9. The method of claim 1 , wherein the attributes associated with the certificate holder are defined in the PKI certificate.
10. The method of claim 1 , wherein the relying party device determines that a certificate status update for the PKI certificate is unavailable based on a failure to receive a response to a status request.
11. The method of claim 1 , wherein a maximum age of the TCSA is determined by a MaxOutdate variable.
12. A device for enabling a trust relationship using an unexpired public key infrastructure (PKI) certificate where a current status of the PKI certificate is unavailable, comprising:
a processor; and
a programmable memory coupled to the processor for storing:
computer readable program code components for determining at a relying party that a certificate status update for the PKI certificate is unavailable;
computer readable program code components for determining at the relying party, in response to the certificate status update being unavailable, a tolerable certificate status age (TCSA) for the PKI certificate based on one or more attributes associated with a certificate holder of the PKI certificate, wherein the TCSA is an interval during which an unexpired certificate can be conditionally trusted despite a lack of a timely certificate status update and further wherein the TCSA conforms to the following equation:
TCSA=( T _Current− T _BeginUncertainty)+T(attributes),
wherein T_Current denotes a current time when the certificate holder is attempting to authenticate with the relying party,
T_BeginUncertainty denotes a beginning of an interval in which the relying party is unable to detect a revocation of the PKI certificate, and
T(attributes) conforms to the following bounds:
0≦ T (attributes)≦Max TCSA −( T _Current− T _BeginUncertainty),
wherein MaxTCSA is greater than or equal to TSCA; and
computer readable program code components for enabling, using the PKI certificate, a trust relationship between the relying party and the certificate holder after calculating the TCSA and before an expiration of the TCSA.
13. The device of claim 12 , wherein T(Attributes)=α(attributes)×ΔTCSA,
wherein
α(attributes) is a minimum of metrics assigned to individual applicable attributes or a product of the metrics, and
ΔTCSA is equal to (MaxTCSA−(T_Current−T_BeginUncertainty)).
14. The device of claim 12 , wherein the one or more attributes associated with the certificate holder are selected from the following: one or more personnel attributes, one or more system attributes, and one or more environmental attributes.
15. The device of claim 14 , wherein the personnel attributes are identified in the PKI certificate and are selected from the following: a security level, a security tenure, a total employment seniority, a rank, and a trustworthiness metric.
16. The device of claim 14 , wherein the system attributes include whether a device associated with the PKI certificate includes licensed hardware or software.
17. The device of claim 16 , wherein the licensed hardware comprises a secure storage facility for a private key associated with the PKI certificate.
18. The device of claim 16 , wherein the licensed software comprises encryption software.
19. The device of claim 14 , wherein the environmental attributes are selected from the following: a network status, one or more detected alarms, and one or more local policy variables.
20. The device of claim 12 , wherein the attributes associated with the certificate holder are defined in the PKI certificate.