Granted Patent B2

US 12,603,789 · App. 18/367,885 · Granted Apr 14, 2026

Inventors: Boy-Anthony Kühne (London, GB); Christopher Paul Kendall (Leighton Buzzard, GB); David Andrew Bray (Richmansworth, GB)

Assignee: VOCALINK INTERNATIONAL LIMITED

H04L9/3268H04L9/0825H04L9/3247

Abstract

Claims (46)

1 . A computer-implemented method comprising:

distributing, by a service core computing device, a root certificate signed by a certificate authority and an intermediate certificate, which is signed by a root private key associated with the root certificate, the root certificate having a longer life to expiration than the intermediate certificate;

receiving, from a participant, a signing request for a participant certificate, the participant certificate including a participant public key, the participant certificate having a shorter life to expiration than the intermediate certificate;

assessing, by the service core computing device, the signing request for the participant certificate, based on ordering of content in the signing request;

signing, by the service core computing device, the participant certificate with an intermediate public key included in the intermediate certificate;

disseminating the signed participant certificate to the participant and at least one other participant, whereby the at least one other participant trusts a request from the participant, which is signed by a private key of the participant, based on the participant certificate including the public key validating the signed request and the participant certificate being signed by the intermediate public key, which is dependent on the root certificate;

receiving, by the service core computing device, a message from the participant; and

encrypting data, by the service core computing device, based on the participant certificate of the participant, prior to providing the encrypted data to the participant in response to the message.

2 . The computer-implemented method of claim 1 , wherein the certificate authority is a third party relative to the service core and the participant; and

wherein the root certificate includes an indication of the certificate authority.

3 . The computer-implemented method of claim 1 , wherein assessing the signing request is further based on a channel through which the signing request is received.

4 . The computer-implemented method of claim 1 , wherein assessing the signing request includes assessing a life to expiration of the participant certificate.

5 . The computer-implemented method of claim 1 , wherein the service core computing device includes an authentication service and a core vault;

wherein receiving the signing request includes receiving, by the authentication service, the signing request; and

wherein assessing the signing request and signing the participant certificate includes assessing, by the core vault, the signing request and signing, by the core vault, the participant certificate.

6 . The computer-implemented method of claim 1 , further comprising signing the intermediate certificate with the root private key, which forms a key pair with a root public key.

7 . The computer-implemented method of claim 1 , further comprising authenticating a message sender of the message based on the disseminated participant certificate prior to providing the encrypted data to the participant in response to the message.

8 . The computer-implemented method of claim 1 , further comprising distributing, by the service core computing device, a central certificate signed by an intermediate private key associated with the root certificate.

9 . A non-transitory computer-readable storage medium comprising executable instructions, which when executed by at least one processor in deploying keys in connection with proxy resolution, cause the at least one processor to:

distribute a root certificate signed by a certificate authority and an intermediate certificate, which is signed by a root private key associated with the root certificate, the root certificate having a longer life to expiration than the intermediate certificate;

receive, from a participant, a signing request for a participant certificate, the participant certificate including a participant public key, the participant certificate having a shorter life to expiration than the intermediate certificate;

assess the signing request for the participant certificate, based on ordering of content in the signing request;

sign the participant certificate with an intermediate public key included in the intermediate certificate; and

disseminate the signed participant certificate to the participant and at least one other participant, whereby the at least one other participant trusts a request from the participant, which is signed by a private key of the participant, based on the participant certificate including the public key validating the signed request and the participant certificate being signed by the intermediate public key, which is dependent on the root certificate;

receive a message from the participant; and

encrypt data, based on the participant certificate of the participant, prior to providing the encrypted data to the participant in response to the message.

10 . The non-transitory computer-readable storage medium of claim 9 , wherein the executable instructions, when executed by the at least one processor to assess the signing request, further cause the at least one processor to:

assess a channel through which the signing request is received; and

assess a life to expiration of the participant certificate.

11 . The non-transitory computer-readable storage medium of claim 9 , wherein the executable instructions, when executed by the at least one processor, further cause the at least one processor to sign the intermediate certificate with the root private key, which forms a key pair with a root public key.

12 . The non-transitory computer-readable storage medium of claim 9 , wherein the executable instructions, when executed by the at least one processor, further cause the at least one processor to authenticate a message sender of the message based on the disseminated participant certificate prior to providing the encrypted data in response to the message.

13 . The non-transitory computer-readable storage medium of claim 9 , wherein the executable instructions, when executed by the at least one processor, further cause the at least one processor to distribute a central certificate signed by an intermediate private key associated with the root certificate.

14 . A computer-implemented method comprising:

distributing, by a service core computing device, a root certificate signed by a certificate authority and an intermediate certificate, which is signed by a root private key associated with the root certificate, the root certificate having a longer life to expiration than the intermediate certificate;

receiving, from a participant, a signing request for a participant certificate, the participant certificate including a participant public key, the participant certificate having a shorter life to expiration than the intermediate certificate;

assessing, by the service core computing device, the signing request for the participant certificate, based on ordering of content in the signing request;

signing, by the service core computing device, the participant certificate with an intermediate public key included in the intermediate certificate;

disseminating the signed participant certificate to the participant and at least one other participant, whereby the at least one other participant trusts a request from the participant, which is signed by a private key of the participant, based on the participant certificate including the public key validating the signed request and the participant certificate being signed by the intermediate public key, which is dependent on the root certificate;

receiving, by a computing device of a second participant, a message from the participant; and

encrypting data, by the computing device of the second participant, based on the participant certificate of the participant, prior to providing the encrypted data to the participant in response to the message.

15 . The computer-implemented method of claim 14 , wherein the certificate authority is a third party relative to the service core and the participant; and

wherein the root certificate includes an indication of the certificate authority.

16 . The computer-implemented method of claim 14 , wherein assessing the signing request is further based on a channel through which the signing request is received.

17 . The computer-implemented method of claim 14 , wherein assessing the signing request includes assessing a life to expiration of the participant certificate.

18 . The computer-implemented method of claim 14 , further comprising authenticating a message sender of the message based on the disseminated participant certificate prior to providing the encrypted data in response to the message.

19 . The computer-implemented method of claim 14 , wherein the participant and the second participant are included in different geographic regions.

Assignments (1)

Continuity (4)

References Cited (29)