Secure information transfer using dedicated public key pairs

1. A computer-implemented method for a server, comprising:

receiving, by a computer system executing an information packet generation server, a request for a digital certificate associated with an article of information;

obtaining the article of information;

generating a first public key pair for the article of information, the first public key pair having a first public key and a first private key;

digitally signing the article of information with the first private key to form a first signature layer, wherein the first public key pair is used for authenticating a holder of the article of information; and

generating the digital certificate for the article of information by the computer system, wherein generating the digital certificate comprises:

combining the first public key with the digitally signed article of information to form an information packet; and

digitally signing the information packet with a second private key of a second public key pair to form a second signature layer that binds together the information packet, wherein the second public key pair is used for authenticating the article of information and is associated with the information packet generation server.

2. The method of claim 1 , further comprising:

sending the digital certificate to a client from which the request was received; and

sending the first private key to the client.

3. The method of claim 1 , further comprising:

sending a second public key of the second public key pair to the client.

4. The method of claim 1 , wherein:

the information packet generation server is a trusted information source and a certificate authority.

5. A computer-implemented method, comprising:

sending, by a client computer system, a request to a first server for a digital certificate associated with an article of information;

receiving the digital certificate from the first server, wherein the digital certificate includes an information packet that comprises the article of information and a first public key of a first public key pair that was generated for the article of information, wherein the article of information has been digitally signed by a first private key of the first public key pair to form a first signature layer, and wherein the information packet has been digitally signed with a second private key of a second public key pair associated with the first server to form a second signature layer that binds together the information packet, wherein the second public key pair is used for authenticating the article of information and the first public key pair is used for authenticating a holder of the information packet; and

receiving from the first server the first private key of the first public key pair.

6. The method of claim 5 , wherein the method further comprises storing the digital certificate and the first private key in a local data store.

7. The method of claim 5 , further comprising:

sending a request to access data on a second server;

sending the digital certificate associated with the article of information to the second server upon demand from the second server; and

receiving an indication that the request for access has been granted in response to sending the digital certificate to the second server.

8. The method of claim 7 , further comprising:

receiving an encrypted challenge from the second server that has been encrypted with the first public key;

decrypting the challenge with the first private key; and

sending a challenge response to the second server based on the decrypted challenge.

9. The method of claim 5 , wherein:

the article of information comprises dynamic information; and

sending the request to the first server for the digital certificate comprises sending the request to the first server for the digital certificate on a periodic basis.

10. A computer-implemented method, comprising:

receiving, by a computer system executing an authentication verification server, a digital certificate that is associated with an article of information, wherein the digital certificate includes an information packet that comprises the article of information and a first public key of a first public key pair that was generated for the article of information, wherein the article of information has been digitally signed with a first private key of the first public key pair to form a first signature layer, and wherein the information packet has been has been digitally signed with a second private key of a second public key pair associated with a certificate authority to form a second signature layer that binds together the information packet;

verifying the digitally signed information packet with a second public key of the second public key pair, the second public key pair authenticating the article of information; and

authenticating a sender of the digital certificate using the first public key pair.

11. The method of claim 10 , wherein authenticating a sender of the information packet includes verifying the digitally signed article of information with the first public key.

12. The method of claim 10 , further comprising:

requesting the digital certificate from a client upon receiving a request for client access to data;

encrypting a challenge with the first public key;

sending the encrypted challenge to the client; and

granting the request for client access to the data after receiving a successful challenge response from the client, the successful challenge response including a decrypted challenge.

13. A machine-accessible medium including data that, when accessed by a machine, cause the machine to perform a method comprising:

receiving, by a computer system executing an information packet generation server, a request for a digital certificate associated with an article of information;

obtaining the article of information;

generating a first public key pair for the article of information, the first public key pair having a first public key and a first private key;

digitally signing the article of information with the first private key to form a first signature layer, wherein the first public key pair is used for authenticating a holder of the article of information; and

generating the digital certificate for the article of information by the computer system, wherein generating the digital certificate comprises:

combining the first public key with the digitally signed article of information to form an information packet; and

digitally signing the information packet with a second private key of a second public key pair to form a second signature layer that binds together the information packet, wherein the second public key pair is used for authenticating the article of information and is associated with the information packet generation server.

14. The machine-accessible medium of claim 13 , wherein the method further comprises:

sending the digital certificate to a client from which the request was received; and

sending the first private key to the client.

15. A machine-accessible medium including data that, when accessed by a machine, cause the machine to perform a method comprising:

sending, by a client computer system, a request to a first server for a digital certificate associated with an article of information;

receiving the digital certificate from the first server, wherein the digital certificate includes an information packet that comprises the article of information and a first public key of a first public key pair that was generated for the article of information, wherein the article of information has been digitally signed by a first private key of the first public key pair to form a first signature layer, and wherein the information packet has been digitally signed with a second private key of a second public key pair associated with the first server to form a second signature layer that binds together the information packet, wherein the second public key pair is used for authenticating the article of information and the first public key pair is used for authenticating a holder of the information packet; and

receiving from the first server the first private key of the first public key pair.

16. The machine-accessible medium of claim 15 , wherein the method further comprises storing the digital certificate and the first private key.

17. The machine-accessible medium of claim 15 , wherein the method further comprises:

sending the digital certificate to a second server;

receiving an encrypted challenge from the second server that has been encrypted with the first public key before gaining user access;

decrypting the challenge with the first private key;

sending a challenge response to the service provider based on the decrypted challenge; and

gaining client access to data provided by the second server.

18. A machine-accessible medium including data that, when accessed by a machine, cause the machine to perform a method comprising:

receiving, by a computer system executing an authentication verification server, a digital certificate that is associated with an article of information, wherein the digital certificate includes an information packet that comprises the article of information and a first public key of a first public key pair that was generated for the article of information, wherein the article of information has been digitally signed with a first private key of the first public key pair to form a first signature layer, and wherein the information packet has been has been digitally signed with a second private key of a second public key pair associated with a certificate authority to form a second signature layer that binds together the information packet;

verifying the digitally signed information packet with a second public key of the second public key pair, the second public key pair authenticating the article of information; and

authenticating a sender of the digital certificate using the first public key pair.

19. The machine-accessible medium of claim 18 , wherein the method further comprises:

requesting the digital certificate from a client upon receiving a request for client access to data;

encrypting a challenge with the first public key;

sending the encrypted challenge to the client; and

granting the request for client access to the data after receiving a successful challenge response from the client, the successful challenge response including a decrypted challenge.

20. A system, comprising:

a first server, coupled with a client via a network, to receive a request for a digital certificate associated with an article of information, to obtain the article of information, to generate a first public key pair for the article of information, the first public key pair having a first public key and a first private key, to digitally sign the article of information with the first private key to form a first signature layer, wherein the first public key pair is used for authenticating a recipient of the article of information, and to generate the digital certificate for the article of information, wherein generating the digital certificate comprises:

combining the first public key with the digitally signed article of information to form an information packet; and

digitally signing the information packet with a second private key of a second public key pair to form a second signature layer that binds together the information packet, wherein the second public key pair is used for authenticating the article of information and is associated with the first server;

the first server further to send the digital certificate to the client.

21. The system of claim 20 further comprising:

a second server, coupled with the client via the network, to receive the digital certificate from the client, to verify the information packet with a second public key of the second public key pair, and to authenticate the client using the first public key, the second public key pair authenticating the article of information and the first public key pair authenticating the client as a valid owner of the information packet.

22. The system of claim 20 , wherein:

the second server authenticates the client by verifying the digitally signed article of information with the first public key;

the digital certificate and the first private key are stored at the client; and

the first server generates the first public key pair for the article of information after receiving a request from the client for the digital certificate, sends the digital certificate to the client, and sends the first private key to the client.

23. The system of claim 20 , wherein:

the second server requests the digital certificate from the client, and grants the request for client access to the data only after successfully verifying the digitally signed information packet included in the digital certificate and authenticating the client, wherein authenticating the client includes encrypting a challenge with the first public key, sending the encrypted challenge to the client, and receiving a successful challenge response.