Management of public key certificates within a distributed architecture

1. A system comprising:

a public key certificate issuance system to generate public key certificates, the public key certificate issuance system comprising:

first data files associated with first public key certificate policies; and

first processor-executable process steps stored on a non-transitory computer-readable medium and comprising a first copy of processor-executable process steps of an analyzer engine, a first copy of processor-executable process steps of a policy engine, and a first wrapper, the first processor-executable process steps executable by a processing unit of the public key certificate issuance system to:

determine the first public key certificate policies based on the first data files; and

generate a first public key certificate conforming to the first public key certificate policies; and

a secret store system to store public key certificates, the secret store system comprising:

second data files associated with second public key certificate policies; and

second processor-executable process steps stored on a non-transitory computer-readable medium and comprising a second copy of the processor-executable process steps of the analyzer engine, a second copy of the processor-executable process steps of the policy engine, and a second wrapper, the second processor-executable process steps executable by a processing unit of the secret store system to:

receive the first public key certificate;

determine the second public key certificate policies based on the second data files; and

determine whether the received first public key certificate conforms to the public key certificate policies.

2. A system according to claim 1 , wherein the first data files comprise a policy configuration file comprising one or more policy definitions and a global configuration file comprising cryptographic standards associated with each of the one or more policy definitions, and

wherein determination of the first public key certificate policies comprises generation of the first public key certificate policies based on the one or more policy definitions and the associated cryptographic standards.

3. A system according to claim 2 , wherein the first copy of processor-executable process steps of the policy engine are executable by the processing unit of the public key certificate issuance system to determine the first public key certificate policies based on the first data files, and wherein the second copy of processor-executable process steps of the policy engine are executable by the processing unit of the secret store system to determine the second public key certificate policies based on the second data files.

4. A system according to claim 1 , further comprising:

a monitoring system comprising:

third data files associated with third public key certificate policies; and

third processor-executable process steps stored on a non-transitory computer-readable medium and comprising a third copy of processor-executable process steps of the analyzer engine, a third copy of processor-executable process steps of the policy engine, and a third wrapper, the first executable by a processing unit of the monitoring system to:

receive the first public key certificate from the secret store system;

determine the third public key certificate policies based on the third data files; and

determine whether the first public key certificate conforms to the third public key certificate policies.

5. A system according to claim 4 , wherein the first copy of processor-executable process steps of the policy engine are executable by the processing unit of the public key certificate issuance system to determine the first public key certificate policies based on the first data files, the second copy of processor-executable process steps of the policy engine are executable by the processing unit of the secret store system to determine the second public key certificate policies based on the second data files, and the third copy of processor-executable process steps of the policy engine are executable by the processing unit of the monitoring system to determine the third public key certificate policies based on the third data files, and

wherein the second copy of processor-executable process steps of the analyzer engine are executable by the processing unit of the secret store system to determine whether the first public key certificate conforms to the second public key certificate policies, and the third copy of processor-executable process steps of the first analyzer engine are executable by the processing unit of the monitoring system to determine whether the first public key certificate conforms to the third public key certificate policies.

6. A system according to claim 1 , further comprising:

a service node comprising:

a storage system to store service node public key certificates;

fourth data files associated with fourth public key certificate policies; and

third processor-executable process steps stored on a non-transitory computer-readable medium and comprising a third copy of processor-executable process steps of the analyzer engine, a third copy of processor-executable process steps of the policy engine, and a third wrapper, the third processor-executable process steps executable by a processing unit of the service node to:

retrieve a service node public key certificate from the storage system;

determine the fourth public key certificate policies based on the fourth data files; and

determine whether the service node public key certificate conforms to the fourth public key certificate policies.

7. A system according to claim 6 , further comprising:

a second service node comprising:

a second storage system to store second service node public key certificates;

fifth data files associated with fifth public key certificate policies; and

fourth processor-executable process steps stored on a non-transitory computer-readable medium and comprising a fourth copy of processor-executable process steps of the analyzer engine, a fourth copy of processor-executable process steps of the policy engine, and a fourth wrapper, the fourth processor-executable process steps executable by a processing unit of the second service node to:

retrieve a second service node public key certificate from the second storage system;

determine the fifth public key certificate policies based on the fifth data files; and

determine whether the second service node public key certificate conforms to the fifth public key certificate policies.

8. A system according to claim 7 , further comprising:

a third service node comprising:

a third storage system to store third service node public key certificates;

sixth data files associated with sixth public key certificate policies; and

fifth processor-executable process steps stored on a non-transitory computer-readable medium and comprising a fifth copy of processor-executable process steps of the analyzer engine, a fifth copy of processor-executable process steps of the policy engine, and a fifth wrapper, the fifth processor-executable process steps executable by a processing unit of the third service node to:

retrieve a third service node public key certificate from the third storage system;

determine the sixth public key certificate policies based on the sixth data files; and

determine whether the third service node public key certificate conforms to the sixth public key certificate policies,

wherein the fourth public key certificate policies are different from the fifth public key certificate policies, and wherein the fourth public key certificate policies are identical to the sixth public key certificate policies.

9. A system according to claim 6 , further comprising:

a monitoring system comprising:

third data files associated with third public key certificate policies; and

fourth processor-executable process steps stored on a non-transitory computer-readable medium and comprising a fourth copy of processor-executable process steps of the analyzer engine, a fourth copy of processor-executable process steps of the policy engine, and a fourth wrapper, the fourth processor-executable process steps executable by a processing unit of the monitoring system to:

receive the first public key certificate from the secret store system;

determine the third public key certificate policies based on the second data files; and

determine whether the first public key certificate conforms to the third public key certificate policies.

10. A computer-implemented method comprising:

executing a first copy of processor-executable process steps of an analyzer engine, a first copy of processor-executable process steps of a policy engine, and a first wrapper at a public key certificate issuance system to:

determine first public key certificate policies based on first data files;

generate a first public key certificate conforming to the first public key certificate policies; and

store the first public key certificate in a secret store system; and

executing a second copy of processor-executable process steps of the analyzer engine, a second copy of processor-executable process steps of the policy engine, and a second wrapper at a secret store system to:

receive the first public key certificate;

determine second public key certificate policies based on second data files stored in the secret store system;

determine whether the received second public key certificate conforms to the public key certificate policies; and

store the second public key certificate in the secret store system if it is determined that the received first public key certificate conforms to the second public key certificate policies.

11. A method according to claim 10 , wherein the first data files comprise a policy configuration file comprising one or more policy definitions and a global configuration file comprising cryptographic standards associated with each of the one or more policy definitions, and

wherein determining the first public key certificate policies comprises generating the first public key certificate policies based on the one or more policy definitions and the associated cryptographic standards.

12. A method according to claim 10 , further comprising:

executing a third copy of processor-executable process steps of the analyzer engine, a third copy of processor-executable process steps of the policy engine, and a third wrapper at a monitoring system to:

receive the first public key certificate from the secret store system;

determine third public key certificate policies based on third data files; and

determine whether the first public key certificate conforms to the third public key certificate policies.

13. A method according to claim 10 , further comprising:

executing a third copy of processor-executable process steps of the analyzer engine, a third copy of processor-executable process steps of the policy engine, and a third wrapper at a service node to:

retrieve a service node public key certificate from a service node storage system;

determine fourth public key certificate policies based on fourth data files; and

determine whether the service node public key certificate conforms to the fourth public key certificate policies.

14. A method according to claim 13 , further comprising:

executing a fourth copy of processor-executable process steps of the analyzer engine, a fourth copy of processor-executable process steps of the policy engine, and a fourth wrapper at a second service node to:

retrieve a second service node public key certificate from a second service node storage system;

determine fifth public key certificate policies based on fifth data files; and

determine whether the second service node public key certificate conforms to the fifth public key certificate policies,

wherein the fourth public key certificate policies are different from the fifth public key certificate policies.

15. A method according to claim 13 , further comprising:

executing a fourth copy of processor-executable process steps of the analyzer engine, a fourth copy of processor-executable process steps of the policy engine, and a fourth wrapper at a monitoring system to:

receive the second public key certificate from the secret store system;

determine third public key certificate policies based on third data files; and

determine whether the second public key certificate conforms to the third public key certificate policies.