Patent ID: 9602497
Date: 2017-03-21
CPC Classifications: G06F,G06Q,H04L

Claim:
1. A method for issuing a trustworthy digital certificate comprising the following steps: functionally coupling a security token to a computer system, said security token being in processing communications with at least a registration authority via said computer system, the security token generating a PKI key pair that includes a public key; sending from said computer system a digital certificate generation request to said registration authority, wherein the digital certificate generation request includes at least one of: an entity identifier or a security token identifier, and wherein, upon reception of said digital certificate generation request, said registration authority performs a security transaction with said security token using a critical security parameter securely stored in said security token, wherein information included in the digital certificate generation request is used to identify the critical security parameter and wherein the critical security parameter includes at least one of: authentication data, passwords, PINs, secrets, symmetric and private cryptographic keys which are to be entered into or output from a cryptographic module using a secure mechanism, after completion of said security transaction, said PKI key pair is operatively stored in said security token and the public key of said PKI key pair is sent to said registration authority along with a value based on a proof of token key, wherein the value provides assurances to the registration authority that the PKI key pair was generated within a secure domain of the security token and wherein said proof is a keyed hash message authentication code of said public key using said critical security parameter, and upon successfulness of said security transaction including confirmation of the value, said registration authority activates the generation of said digital certificate by a certificate authority using said public key.