IP Library › Granted Patent US 8,856,514

Granted Patent B2

US 8,856,514 · App. 13/417,888 · Granted Oct 7, 2014

Renewal processing of digital certificates in an asynchronous messaging environment

Inventors: Bret W. Dixon (South Perth, AU); Scot W. Dixon (South Perth, AU)

Assignee: International Business Machines Corporation

H04L9/3265 H04L63/0823 H04N21/835 G06F21/33

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 8,856,514
App. No.: 13/417,888
Granted: Oct 7, 2014
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

A renewed digital certificate is obtained within an asynchronous messaging environment from a certificate server of an issuer of an existing digital certificate to replace the existing digital certificate. The renewed digital certificate includes an extended attribute that stores a serial number value of the existing digital certificate. A message is received with a symmetric key that is encrypted using the existing digital certificate. The symmetric key is identified within the message by the serial number value of the existing digital certificate. The message is processed using the renewed digital certificate.

Claims (84)

1. A method, comprising:

obtaining, within an asynchronous messaging environment from a certificate server of an issuer of an existing digital certificate, a renewed digital certificate to replace the existing digital certificate, where the renewed digital certificate comprises a new certificate serial number, an extended attribute that stores a serial number value of the existing digital certificate, and an issuer identifier that matches an issuer identifier of the existing digital certificate;

receiving a message with a symmetric key encrypted using the existing digital certificate and identified within the message via the serial number value of the existing digital certificate; and

processing the message using the renewed digital certificate, comprising:

determining whether the symmetric key encrypted using the existing digital certificate in a message payload matches the issuer identifier and the new certificate serial number of the renewed digital certificate;

determining, in response to determining that the symmetric key encrypted using the existing digital certificate in the message payload does not match the issuer identifier and the new certificate serial number of the renewed digital certificate, whether the symmetric key encrypted using the existing digital certificate in the message payload matches the issuer identifier of the renewed digital certificate and the serial number value of the existing digital certificate stored within the extended attribute of the renewed digital certificate; and

in response to determining that the symmetric key encrypted using the existing digital certificate in the message payload matches the issuer identifier of the renewed digital certificate and the serial number value of the existing digital certificate stored within the extended attribute of the renewed digital certificate:

validating the renewed digital certificate; and

in response to successful validation of the renewed digital certificate:

decrypting the symmetric key using a private key of the renewed digital certificate;

decrypting the received message payload using the decrypted symmetric key; and

processing the decrypted message payload.

2. The method of claim 1 , where the existing digital certificate comprises one of an expired digital certificate and a certificate determined to expire within a configured time relative to an expiration date of the existing digital certificate.

3. The method of claim 1 , where obtaining, within the asynchronous messaging environment from the certificate server of the issuer of the existing digital certificate, the renewed digital certificate to replace the existing digital certificate comprises:

sending, in response to determining that the existing digital certificate is expired, the existing digital certificate to the certificate server of the issuer of the existing digital certificate;

receiving the renewed digital certificate from the certificate server of the issuer of the existing digital certificate, where the renewed digital certificate comprises the new certificate serial number, a subject distinguished name (DN), a public key, and the issuer identifier of the issuer of the existing digital certificate, and the extended attribute storing the serial number value of the existing digital certificate; and

designating the renewed digital certificate as valid for asynchronous message processing.

4. The method of claim 1 , where obtaining, within the asynchronous messaging environment from the certificate server of the issuer of the existing digital certificate, the renewed digital certificate to replace the existing digital certificate comprises:

extracting, in response to determining that the existing digital certificate is expired, the serial number value, a subject distinguished name (DN), and a public key from the existing digital certificate;

sending the extracted serial number value, subject distinguished name (DN), and public key, and the extended attribute to the certificate server of the issuer of the existing digital certificate;

receiving the renewed digital certificate from the certificate server of the issuer of the existing digital certificate, where the renewed digital certificate comprises the new certificate serial number, the subject distinguished name (DN), the public key, and the issuer identifier of the issuer of the existing digital certificate, and the extended attribute storing the serial number value of the existing digital certificate; and

designating the renewed digital certificate as valid for asynchronous message processing.

5. The method of claim 1 , where processing the message using the renewed digital certificate comprises:

identifying the symmetric key encrypted using the existing digital certificate within the message payload of the received message using the issuer identifier of the renewed digital certificate and the serial number value of the existing digital certificate stored within the extended attribute of the renewed digital certificate.

6. The method of claim 1 , further comprising:

in response to determining that the symmetric key encrypted using the existing digital certificate in the message payload does not match the issuer identifier of the renewed digital certificate and the serial number value of the existing digital certificate stored within the extended attribute of the renewed digital certificate:

generating an error indicating that the symmetric key encrypted using the existing digital certificate was not found in the message payload.

7. A system, comprising:

a memory that stores an existing digital certificate; and

a processor programmed to:

obtain, within an asynchronous messaging environment from a certificate server of an issuer of the existing digital certificate, a renewed digital certificate to replace the existing digital certificate, where the renewed digital certificate comprises a new certificate serial number, an extended attribute that stores a serial number value of the existing digital certificate, and an issuer identifier that matches an issuer identifier of the existing digital certificate;

store the renewed digital certificate to the memory;

receive a message with a symmetric key encrypted using the existing digital certificate and identified within the message via the serial number value of the existing digital certificate; and

process the message using the renewed digital certificate, the processor being programmed to:

determine whether the symmetric key encrypted using the existing digital certificate in a message payload matches the issuer identifier and the new certificate serial number of the renewed digital certificate;

determine, in response to determining that the symmetric key encrypted using the existing digital certificate in the message payload does not match the issuer identifier and the new certificate serial number of the renewed digital certificate, whether the symmetric key encrypted using the existing digital certificate in the message payload matches the issuer identifier of the renewed digital certificate and the serial number value of the existing digital certificate stored within the extended attribute of the renewed digital certificate; and

validate the renewed digital certificate; and

in response to successful validation of the renewed digital certificate:

decrypt the symmetric key using a private key of the renewed digital certificate;

decrypt the received message payload using the decrypted symmetric key; and

process the decrypted message payload.

8. The system of claim 7 , where the existing digital certificate comprises one of an expired digital certificate and a certificate determined to expire within a configured time relative to an expiration date of the existing digital certificate.

9. The system of claim 7 , where in being programmed to obtain, within the asynchronous messaging environment from the certificate server of the issuer of the existing digital certificate, the renewed digital certificate to replace the existing digital certificate, the processor is programmed to:

send, in response to determining that the existing digital certificate is expired, the existing digital certificate to the certificate server of the issuer of the existing digital certificate;

receive the renewed digital certificate from the certificate server of the issuer of the existing digital certificate, where the renewed digital certificate comprises the new certificate serial number, a subject distinguished name (DN), a public key, and the issuer identifier of the issuer of the existing digital certificate, and the extended attribute storing the serial number value of the existing digital certificate; and

designate the renewed digital certificate as valid for asynchronous message processing.

10. The system of claim 7 , where in being programmed to obtain, within the asynchronous messaging environment from the certificate server of the issuer of the existing digital certificate, the renewed digital certificate to replace the existing digital certificate, the processor is programmed to:

extract, in response to determining that the existing digital certificate is expired, the serial number value, a subject distinguished name (DN), and a public key from the existing digital certificate;

send the extracted serial number value, subject distinguished name (DN), and public key, and the extended attribute to the certificate server of the issuer of the existing digital certificate;

receive the renewed digital certificate from the certificate server of the issuer of the existing digital certificate, where the renewed digital certificate comprises the new certificate serial number, the subject distinguished name (DN), the public key, and the issuer identifier of the issuer of the existing digital certificate, and the extended attribute storing the serial number value of the existing digital certificate; and

designate the renewed digital certificate as valid for asynchronous message processing.

11. The system of claim 7 , where, in being programmed to process the message using the renewed digital certificate, the processor is programmed to:

identify the symmetric key encrypted using the existing digital certificate within the message payload of the received message using the issuer identifier of the renewed digital certificate and the serial number value of the existing digital certificate stored within the extended attribute of the renewed digital certificate.

12. The system of claim 7 , where the processor is further programmed to:

generate an error indicating that the symmetric key encrypted using the existing digital certificate was not found in the message payload.

13. A computer program product comprising a computer readable storage medium including computer readable program code, where the computer readable program code when executed on a computer causes the computer to:

obtain, within an asynchronous messaging environment from a certificate server of an issuer of an existing digital certificate, a renewed digital certificate to replace the existing digital certificate, where the renewed digital certificate comprises a new certificate serial number, an extended attribute that stores a serial number value of the existing digital certificate, and an issuer identifier that matches an issuer identifier of the existing digital certificate;

receive a message with a symmetric key encrypted using the existing digital certificate and identified within the message via the serial number value of the existing digital certificate; and

process the message using the renewed digital certificate, the computer readable program code when executed on the computer causing the computer to:

validate the renewed digital certificate; and

in response to successful validation of the renewed digital certificate:

decrypt the symmetric key using a private key of the renewed digital certificate;

decrypt the received message payload using the decrypted symmetric key; and

process the decrypted message payload.

14. The computer program product of claim 13 , where the existing digital certificate comprises one of an expired digital certificate and a certificate determined to expire within a configured time relative to an expiration date of the existing digital certificate.

15. The computer program product of claim 13 , where in causing the computer to obtain, within the asynchronous messaging environment from the certificate server of the issuer of the existing digital certificate, the renewed digital certificate to replace the existing digital certificate, the computer readable program code when executed on the computer causes the computer to:

send, in response to determining that the existing digital certificate is expired, the existing digital certificate to the certificate server of the issuer of the existing digital certificate;

designate the renewed digital certificate as valid for asynchronous message processing.

16. The computer program product of claim 13 , where in causing the computer to obtain, within the asynchronous messaging environment from the certificate server of the issuer of the existing digital certificate, the renewed digital certificate to replace the existing digital certificate, the computer readable program code when executed on the computer causes the computer to:

send the extracted serial number value, subject distinguished name (DN), and public key, and the extended attribute to the certificate server of the issuer of the existing digital certificate;

receive the renewed digital certificate from the certificate server of the issuer of the existing digital certificate, where the renewed digital certificate comprises the new certificate serial number, the subject distinguished name (DN), the public key, and the issuer identifier of the issuer of the existing digital certificate, and the extended attribute storing the serial number value of the existing digital certificate; and

designate the renewed digital certificate as valid for asynchronous message processing.

17. The computer program product of claim 13 , where, in causing the computer to process the message using the renewed digital certificate, the computer readable program code when executed on the computer causes the computer to:

18. The computer program product of claim 13 , where the computer readable program code when executed on the computer further causes the computer to:

generate an error indicating that the symmetric key encrypted using the existing digital certificate was not found in the message payload.

Assignments (1)

ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Mar 12, 2012

From: DIXON, BRET W.; DIXON, SCOT W.

To: INTERNATIONAL BUSINESS MACHINES CORPORATION

Reel/Frame 027847/0206 →

Continuity (1)

Related Publication 20130238895A1 · Sep 12, 2013