Granted Patent B1

US 10,547,457 · App. 15/331,019 · Granted Jan 28, 2020

Inventors: David V. Duccini (St. Paul, MN); Phillip H. Griffin (Raleigh, NC); Jeffrey J. Stapleton (Arlington, TX)

Assignee: Wells Fargo Bank N.A.

H04L9/3268H04L9/006H04L9/14H04L9/30H04L9/3247H04L63/06H04L9/0637

Abstract

Claims (70)

1. A method of managing digital certificates, the method comprising:

receiving, by a processor of a certificate authority (CA) computing system, a communication request comprising at least one of a digital certificate generation request and a digital certificate revocation from a user via a user computing device, the digital certificate generation request including a user public key and a user identity;

generating, by the processor, a digital certificate for the user;

signing, by the processor, the digital certificate with a CA private key, wherein the CA private key is associated with a known CA public key;

publishing, by the processor, the digital certificate signed with the CA private key to a digital certificate blockchain;

monitoring, by the processor, a certificate status of the published digital certificate in real-time, wherein monitoring the certificate status comprises monitoring a revocation of the published digital certificate in real-time;

publishing, by the processor, an update to the digital certificate blockchain to reflect a change in the certificate status of the digital certificate according to the monitored certificate status in real-time;

allowing, by the processor, the communication request in response to determining that the digital certificate is not revoked according to the published update of the certificate status;

denying, by the processor, the communication request from the user in response to determining that the digital certificate is revoked according to the published update of the certificate status; and

publishing, by the processor, a revocation block to a certificate revocation list (CRL) blockchain to reflect the revocation of the digital certificate;

wherein the digital certificate revocation is managed via the CRL blockchain;

wherein at least one of an updated policy, an updated relying party agreement, and an updated audit letter are managed via a management blockchain.

2. The method of claim 1 , further comprising:

publishing, by the processor, a revocation block to the digital certificate blockchain to reflect the revocation of the digital certificate.

3. The method of claim 1 , wherein the CA computing system is managed by a CA group;

wherein the CA group includes a plurality of CAs comprising:

one or more root CAs, wherein the one or more root CAs are trust anchors;

one or more intermediate CAs; and

one or more issuing CAs, wherein the one or more issuing CAs issue the digital certificate to the user.

4. The method of claim 1 , wherein the update is subsequent to a block containing the digital certificate.

5. The method of claim 1 , wherein the digital certificate is managed via the digital certificate blockchain, wherein the digital certificate blockchain is accessible to each of a relying party and the user.

6. The method of claim 1 , further comprising:

storing, by the processor, a uniform resource identifier (URI) comprising a uniform resource locator (URL) from which underlying data is retrieved.

7. A digital certificate management system comprising:

a network interface configured to facilitate data transmission over a network;

a request circuit configured to:

receive a communication request comprising a digital certificate request from a user;

generate a digital certificate associated with the user, wherein the digital certificate comprises:

an identity of the user; and

a public key of the user;

digitally sign the digital certificate with a certificate authority (CA) private key; and

publish the digital certificate to a digital certificate blockchain;

a policy information circuit configured to:

monitor an update to policy information for the digital certificate in real-time, the update information comprising revocation information of the digital certificate; and

publish the update to an update block on the digital certificate blockchain in real-time; and

a revocation information circuit configured to:

determine whether the digital certificate has been revoked based on the published update;

allow the communication request in response to determining that the digital certificate is not revoked according to the published update;

deny the communication request from the user in response to determining that the digital certificate is revoked according to the published update; and

publish revocation information to a revocation block on a certificate revocation list (CRL) blockchain;

wherein the digital certificate revocation is managed via the CRL blockchain;

wherein at least one of an updated policy, an updated relying party agreement, and an updated audit letter are managed via a management blockchain.

8. The system of claim 7 , wherein the update block is subsequent to a block containing the digital certificate.

9. The system of claim 7 , wherein the revocation information circuit is further configured publish revocation information to a revocation block on the digital certificate blockchain.

10. The system of claim 7 , wherein the revocation information circuit is further configured to confirm destruction of the CA private key upon determining that the digital certificate has been revoked.

11. The system of claim 7 , wherein the digital certificate management system is managed by a CA group;

wherein the CA group includes a plurality of CAs comprising:

one or more root CAs, wherein the one or more root CAs are trust anchors;

one or more intermediate CAs; and

one or more issuing CAs, wherein the issuing CA issues the digital certificate to the user.

12. The system of claim 7 , wherein the digital certificate management system is managed via the digital certificate blockchain, wherein the digital certificate blockchain is accessible to each of a relying party and the user.

13. The system of claim 7 , wherein underlying data is stored and accessible at a URL included in a URI on at least one of the digital certificate blockchain, a CRL blockchain, and a management blockchain.

14. A method of securing communication, the method comprising:

receiving, by a processor of a relying party computing system, a secure communication request from a user via a user computing device, the secure communication request including a digital certificate;

viewing, by the processor, the digital certificate of the user via a digital certificate blockchain, wherein the digital certificate is issued by a certificate authority (CA) via a CA computing system and is digitally signed by the CA using a CA private key associated with a known CA public key;

authenticating, by the processor, the user using the known CA public key;

establishing, by the processor, a secure communication with the user via the user computing device;

monitoring, by the processor, a certificate status of the digital certificate in real-time, wherein monitoring the certificate status comprises monitoring a revocation status of the digital certificate in real-time;

publishing, by the processor, an update to the digital certificate blockchain to reflect the monitored revocation status of the digital certificate;

allowing, by the processor, the secure communication request when the published update indicates the digital certificate is not revoked;

denying, by the processor, the secure communication request from the user when the published update indicates the digital certificate is revoked; and

publishing, by the processor, a revocation block to a certificate revocation list (CRL) blockchain to reflect the revocation of the digital certificate;

wherein the digital certificate revocation is managed via the CRL blockchain;

wherein at least one of an updated policy, an updated relying party agreement, and an updated audit letter are managed via a management blockchain.

15. The method of claim 14 , further comprising:

publishing, by the processor, a revocation block to the digital certificate blockchain to reflect the revocation of the digital certificate.

16. The method of claim 15 , further comprising confirming, by the processor, destruction of the CA private key upon determining that the digital certificate has been revoked.

17. The method of claim 14 , wherein the digital certificate management system is managed via the digital certificate blockchain, wherein the digital certificate blockchain is accessible to each of a relying party and the user.

18. The method of claim 14 , further comprising:

storing, by the processor, a URI comprising a URL from which underlying data is retrieved.

Assignments (1)

Cited By (12)

US 12,206,756 US 12,225,139 US 12,244,729 US 12,250,309 US 12,309,261 US 12,342,165 US 12,413,573 US 12,418,521 US 12,438,867 US 12,500,739 US 12,500,882 US 12,519,772