Authority-Neutral Certification for Multiple-Authority PKI Environments
A method for facilitating electronic certification, and systems for use therewith, are presented in the context of public key encryption infrastructures. Some aspects of the invention provide methods for facilitating electronic certification using authority-neutral service requests sent by an application, which are then formatted by a server comprising a middleware that can convert the authority-neutral request into certification authority specific objects. The server and middleware then return a response from a selected certification authority back to the service requesting application. Thus, the server and/or middleware act as intermediaries that facilitate user transactions in an environment having multiple certification authorities without undue burden on the applications or the expense and reliability problems associated therewith.
1 - 20 . (canceled)
21 . A method for facilitating an electronic certification transaction in a public key infrastructure, comprising:
storing user profile data, corresponding to a user, in a database;
storing application data, corresponding to an application, in the database;
storing permission data, indicative of an application's permission to access user profile data, in the database;
determining whether an application requesting a portion of the user profile data has permission to access said portion of the user profile data, based on the permission data; and
if the application has permission to access the portion of the user profile data, selectively allowing the application to access the portion of the user profile data to conduct the electronic certification transaction.
22 . The method of claim 21 , wherein the user profile data is customizable based on user preference information.
23 . The method of claim 21 , further comprising registering the application using a registration process.
24 . The method of claim 23 , wherein the registration process comprises creating an application preference profile.
25 . The method of claim 21 , wherein the determining step further comprises:
receiving a service request, the service request containing public key encryption data;
based on the user profile data, selecting a certification authority, from a plurality of available certification authorities;
generating a data object including information associated with information in the service request;
transmitting the data object to the selected certification authority;
receiving a response from the selected certification authority;
generating a response object including information associated with information contained in the response; and
transmitting the response object to the application.
26 . The method of claim 25 , wherein the service request is certification authority-neutral.
27 . The method of claim 25 , wherein the transmitted data object comprises a subset of application-related information, the subset being chosen based on the selected certification authority.
28 . An apparatus for facilitating an electronic certification transaction in a public key infrastructure, comprising:
a database; and
a computing device configured to perform operations comprising:
storing user profile data, corresponding to a user, in the database;
storing application data, corresponding to an application, in the database;
storing permission data, indicative of an application's permission to access user profile data, in the database;
determining whether an application requesting a portion of the user profile data has permission to access said portion of the user profile data, based on the permission data; and
if the application has permission to access the portion of the user profile data, selectively allowing the application to access the portion of the user profile data to conduct the electronic certification transaction.
29 . The apparatus of claim 28 , wherein the user profile data is customizable based on user preference information.
30 . The apparatus of claim 28 , said computing device configured to perform operations further comprising registering the application using a registration process.
31 . The apparatus of claim 30 , wherein the registration process comprises creating an application preference profile.
32 . The apparatus of claim 28 , said computing device configured to perform operations further comprising:
receiving a service request, the service request containing public key encryption data;
based on the user profile data, selecting a certification authority, from a plurality of available certification authorities;
generating a data object including information associated with information in the service request;
transmitting the data object to the selected certification authority;
receiving a response from the selected certification authority;
generating a response object including information associated with information contained in the response; and
transmitting the response object to the application.
33 . The apparatus of claim 32 , wherein the service request is certification authority-neutral.
34 . The apparatus of claim 32 , wherein the transmitted data object comprises a subset of application-related information, the subset being chosen based on the selected certification authority.
35 . A computer-readable medium having instructions stored thereon, that in response to execution by a computing device causes the computing device to perform operations comprising:
storing user profile data, corresponding to a user, in a database;
storing application data, corresponding to an application, in the database;
storing permission data, indicative of an application's permission to access user profile data, in the database;
determining whether an application requesting a portion of the user profile data has permission to access said portion of the user profile data, based on the permission data; and
if the application has permission to access the portion of the user profile data, selectively allowing the application to access the portion of the user profile data to conduct the electronic certification transaction.
36 . The computer-readable medium of claim 35 , wherein the user profile data is customizable based on user preference information.
37 . The computer-readable medium of claim 35 , said instructions further causing the computing device to perform operations comprising registering the application using a registration process.
38 . The computer-readable medium of claim 37 , wherein the registration process comprises creating an application preference profile.
39 . The computer-readable medium of claim 35 , said instructions further causing the computing device to perform operations comprising:
receiving a service request, the service request containing public key encryption data;
based on the user profile data, selecting a certification authority, from a plurality of available certification authorities;
generating a data object including information associated with information in the service request;
transmitting the data object to the selected certification authority;
receiving a response from the selected certification authority;
generating a response object including information associated with information contained in the response; and
transmitting the response object to the application.
40 . The computer-readable medium of claim 39 , wherein the transmitted data object comprises a subset of application-related information, the subset being chosen based on the selected certification authority.