Source: https://patents.google.com/patent/US7716139B2/en
Timestamp: 2019-04-24 20:56:34+00:00

Document:
2005-01-18 Assigned to RESEARCH IN MOTION LIMITED reassignment RESEARCH IN MOTION LIMITED ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: BROWN, MICHAEL K., BROWN, MICHAEL S.
A system and method for verifying a digital signature on a certificate, which may be used in the processing of encoded messages. In one embodiment, when a digital signature is successfully verified in a signature verification operation, the public key used to verify that digital signature is cached. When a subsequent attempt to verify the digital signature is made, the public key to be used to verify the digital signature is compared to the cached key. If the keys match, the digital signature can be successfully verified without requiring that a signature verification operation in which some data is decoded using the public key be performed.
The invention relates generally to the processing of messages, such as e-mail messages, and more specifically to a system and method for validating certificates used in the processing of encoded messages.
Electronic mail (“e-mail”) messages may be encoded using one of a number of known protocols. Some of these protocols, such as Secure Multiple Internet Mail Extensions (“S/MIME”) for example, rely on public and private encryption keys to provide confidentiality and integrity, and on a Public Key Infrastructure (PKI) to communicate information that provides authentication and authorization. Data encrypted using a private key of a private key/public key pair can only be decrypted using the corresponding public key of the pair, and vice-versa. The authenticity of public keys used in the encoding of messages is validated using certificates. In particular, if a user of a computing device wishes to encrypt a message before the message is sent to a particular individual, the user will require a certificate for that individual. That certificate will typically comprise the public key of the individual, as well as other identification-related information.
Certificates are digital documents that are typically issued by certification authorities. In order to trust a particular public key, the public key typically needs to be issued by a certification authority that is also trusted, or by an entity associated with the trusted certification authority. The relationship between a trusted certification authority and an issued public key can be represented by a series of related certificates, also referred to as a certificate chain. The certificate chain can be followed to determine the validity of a certificate.
Typically, a certification authority will digitally sign each certificate that it issues, to certify that a specific public key belongs to the purported owner as indicated on the respective certificate. In building certificate chains, the digital signatures on the certificates of the chain often need to be verified. Verification of a digital signature on a certificate is a process that requires the public key of the certification authority that issued the certificate.
The verification process can be time-consuming and costly (e.g. in terms of computing resource usage), particularly where the verifications are performed on smaller devices, such as mobile devices for example. Where multiple certificates are processed on a user's computing device, the same digital signature may be subject to verification more than once. Embodiments of the invention are generally directed to a system and method that facilitates more efficient verification of digital signatures on certificates by storing certain information employed in signature verification operations for reuse.
In a broad aspect of the invention, there is provided a method of verifying a digital signature on a certificate on a computing device, the method comprising the steps of: performing a first signature verification operation on the digital signature using a first public key associated with an issuer of the certificate; determining if the digital signature is successfully verified in the first signature verification operation; storing the first public key in a memory store; receiving a request to perform a second signature verification operation on the digital signature using a second public key associated with an issuer of the certificate; comparing the second public key with the first public key stored in the memory store to determine if the first and second public keys match; and indicating successful verification of the digital signature in response to the request if the digital signature was successfully verified in the first signature verification operation and if a match is determined at the comparing step, whereby the second signature verification operation need not be performed.
FIG. 8B is a flowchart illustrating steps in a method of verifying a digital signature on a certificate in another embodiment of the invention.
Some embodiments of the invention make use of a mobile station. A mobile station is a two-way communication device with advanced data communication capabilities having the capability to communicate with other computer systems, and is also referred to herein generally as a mobile device. A mobile device may also include the capability for voice communications. Depending on the functionality provided by a mobile device, it may be referred to as a data messaging device, a two-way pager, a cellular telephone with data messaging capabilities, a wireless Internet appliance, or a data communication device (with or without telephony capabilities). A mobile device communicates with other devices through a network of transceiver stations.
Referring first to FIG. 1, a block diagram of a mobile device in one example implementation is shown generally as 100. Mobile device 100 comprises a number of components, the controlling component being microprocessor 102. Microprocessor 102 controls the overall operation of mobile device 100. Communication functions, including data and voice communications, are performed through communication subsystem 104. Communication subsystem 104 receives messages from and sends messages to a wireless network 200. In this example implementation of mobile device 100, communication subsystem 104 is configured in accordance with the Global System for Mobile Communication (GSM) and General Packet Radio Services (GPRS) standards. The GSM/GPRS wireless network is used worldwide and it is expected that these standards will be superseded eventually by Enhanced Data GSM Environment (EDGE) and Universal Mobile Telecommunications Service (UMTS). New standards are still being defined, but it is believed that they will have similarities to the network behavior described herein, and it will also be understood by persons skilled in the art that the invention is intended to use any other suitable standards that are developed in the future. The wireless link connecting communication subsystem 104 with network 200 represents one or more different Radio Frequency (RF) channels, operating according to defined protocols specified for GSM/GPRS communications. With newer network protocols, these channels are capable of supporting both circuit switched voice communications and packet switched data communications.
LAN 250 comprises a number of network components connected to each other by LAN connections 260. For instance, a user's desktop computer 262 a with an accompanying cradle 264 for the user's mobile device 100 is situated on LAN 250. Cradle 264 for mobile device 100 may be coupled to computer 262 a by a serial or a Universal Serial Bus (USB) connection, for example. Other user computers 262 b are also situated on LAN 250, and each may or may not be equipped with an accompanying cradle 264 for a mobile device. Cradle 264 facilitates the loading of information (e.g. PIM data, private symmetric encryption keys to facilitate secure communications between mobile device 100 and LAN 250) from user computer 262 a to mobile device 100, and may be particularly useful for bulk information updates often performed in initializing mobile device 100 for use. The information downloaded to mobile device 100 may include certificates used in the exchange of messages. It will be understood by persons skilled in the art that user computers 262 a, 262 b will typically be also connected to other peripheral devices not explicitly shown in FIG. 4.
Furthermore, only a subset of network components of LAN 250 are shown in FIG. 4 for ease of exposition, and it will be understood by persons skilled in the art that LAN 250 will comprise additional components not explicitly shown in FIG. 4, for this example configuration. More generally, LAN 250 may represent a smaller part of a larger network [not shown] of the organization, and may comprise different components and/or be arranged in different topologies than that shown in the example of FIG. 4.
Messages intended for a user of mobile device 100 are initially received by a message server 268 of LAN 250. Such messages may originate from any of a number of sources. For instance, a message may have been sent by a sender from a computer 262 b within LAN 250, from a different mobile device [not shown] connected to wireless network 200 or to a different wireless network, or from a different computing device or other device capable of sending messages, via the shared network infrastructure 224, and possibly through an application service provider (ASP) or Internet service provider (ISP), for example.
It will be understood by persons skilled in the art that message management server 272 need not be implemented on a separate physical server in LAN 250 or other network. For example, some or all of the functions associated with message management server 272 may be integrated with message server 268, or some other server in LAN 250. Furthermore, LAN 250 may comprise multiple message management servers 272, particularly in variant implementations where a large number of mobile devices needs to be supported.
Embodiments of the invention relate generally to certificates used in the processing of encoded messages, such as e-mail messages that are encrypted and/or signed. While Simple Mail Transfer Protocol (SMTP), RFC822 headers, and Multipurpose Internet Mail Extensions (MIME) body parts may be used to define the format of a typical e-mail message not requiring encoding, Secure/MIME (S/MIME), a version of the MIME protocol, may be used in the communication of encoded messages (i.e. in secure messaging applications). S/MIME enables end-to-end authentication and confidentiality, and protects data integrity and privacy from the time an originator of a message sends a message until it is decoded and read by the message recipient. Other known standards and protocols may be employed to facilitate secure message communication, such as Pretty Good Privacy™ (PGP), OpenPGP, and others known in the art.
Secure messaging protocols such as S/MIME rely on public and private encryption keys to provide confidentiality and integrity, and on a Public Key Infrastructure (PKI) to communicate information that provides authentication and authorization. Data encrypted using a private key of a private key/public key pair can only be decrypted using the corresponding public key of the pair, and vice-versa. Private key information is never made public, whereas public key information is shared.
For example, if a sender wishes to send a message to a recipient in encrypted form, the recipient's public key is used to encrypt a message, which can then be decrypted only using the recipient's private key. Alternatively, in some encoding techniques, a one-time session key is generated and used to encrypt the body of a message, typically with a symmetric encryption technique (e.g. Triple DES). The session key is then encrypted using the recipient's public key (e.g. with a public key encryption algorithm such as RSA), which can then be decrypted only using the recipient's private key. The decrypted session key can then be used to decrypt the message body. The message header may be used to specify the particular encryption scheme that must be used to decrypt the message. Other encryption techniques based on public key cryptography may be used in variant implementations. However, in each of these cases, only the recipient's private key may be used to facilitate decryption of the message, and in this way, the confidentiality of messages can be maintained.
An encoded message may be encrypted, signed, or both encrypted and signed. The authenticity of public keys used in these operations is validated using certificates. A certificate is a digital document issued by a certificate authority (CA). Certificates are used to authenticate the association between users and their public keys, and essentially, provides a level of trust in the authenticity of the users' public keys. Certificates contain information about the certificate holder, with certificate contents typically formatted in accordance with an accepted standard (e.g. X.509).
Consider FIG. 5, in which an example certificate chain 300 is shown. Certificate 310 issued to “John Smith” is an example of a certificate issued to an individual, which may be referred to as an end entity certificate. End entity certificate 310 typically identifies the certificate holder 312 (i.e. John Smith in this example) and the issuer of the certificate 314, and includes a digital signature of the issuer 316 and the certificate holder's public key 318. Certificate 310 will also typically include other information and attributes that identify the certificate holder (e.g. e-mail address, organization name, organizational unit name, location, etc.). When the individual composes a message to be sent to a recipient, it is customary to include that individual's certificate 310 with the message.
For a public key to be trusted, its issuing organization must be trusted. The relationship between a trusted CA and a user's public key can be represented by a series of related certificates, also referred to as a certificate chain. The certificate chain can be followed to determine the validity of a certificate.
For instance, in the example certificate chain 300 shown in FIG. 5, the recipient of a message purported to be sent by John Smith may wish to verify the trust status of certificate 310 attached to the received message. To verify the trust status of certificate 310 on a recipient's computing device (e.g. computer 262 a of FIG. 4) for example, the certificate 320 of issuer ABC is obtained, and used to verify that certificate 310 was indeed signed by issuer ABC. Certificate 320 may already be stored in a certificate store on the computing device, or it may need to be retrieved from a certificate source (e.g. LDAP server 284 of FIG. 4 or some other public or private LDAP server). If certificate 320 is already stored in the recipient's computing device and the certificate has been designated as trusted by the recipient, then certificate 310 is considered to be trusted since it chains to a stored, trusted certificate.
However, in the example shown in FIG. 5, certificate 330 is also required to verify the trust status of certificate 310. Certificate 330 is self-signed, and is referred to as a “root certificate”. Accordingly, certificate 320 may be referred to as an “intermediate certificate” in certificate chain 300; any given certificate chain to a root certificate, assuming a chain to the root certificate can be determined for a particular end entity certificate, may contain zero, one, or multiple intermediate certificates. If certificate 330 is a root certificate issued by a trusted source (from a large certificate authority such as Verisign or Entrust, for example), then certificate 310 may be considered to be trusted since it chains to a trusted certificate. The implication is that both the sender and the recipient of the message trust the source of the root certificate 330. If a certificate cannot be chained to a trusted certificate, the certificate may be considered to be “not trusted”.
Certificate servers store information about certificates and lists identifying certificates that have been revoked. These certificate servers can be accessed to obtain certificates and to verify certificate authenticity and revocation status. For example, a Lightweight Directory Access Protocol (LDAP) server may be used to obtain certificates, and an Online Certificate Status Protocol (OCSP) server may be used to verify certificate revocation status.
Standard e-mail security protocols typically facilitate secure message transmission between non-mobile computing devices (e.g. computers 262 a, 262 b of FIG. 4; remote desktop devices). Referring again to FIG. 4, in order that signed messages received from senders may be read from mobile device 100 and encrypted messages be sent to those senders, mobile device 100 is adapted to store certificates and associated public keys of other individuals. Certificates stored on a user's computer 262 a will typically be downloaded from computer 262 a to mobile device 100 through cradle 264, for example.
Certificates stored on computer 262 a and downloaded to mobile device 100 are not limited to certificates associated with individuals but may also include certificates issued to CAs, for example. Certain certificates stored in computer 262 a and/or mobile device 100 can also be explicitly designated as “trusted” by the user. Accordingly, when a certificate is received by a user on mobile device 100, it can be verified on mobile device 100 by matching the certificate with one stored on mobile device 100 and designated as trusted, or otherwise determined to be chained to a trusted certificate.
User computers 262 a, 262 b can obtain certificates from a number of sources, for storage on computers 262 a, 262 b and/or mobile devices (e.g. mobile device 100). These certificate sources may be private (e.g. dedicated for use within an organization) or public, may reside locally or remotely, and may be accessible from within an organization's private network or through the Internet, for example. In the example shown in FIG. 4, multiple PKI servers 280 associated with the organization reside on LAN 250. PKI servers 280 include a CA server 282 for issuing certificates, an LDAP server 284 used to search for and download certificates (e.g. for individuals within the organization), and an OCSP server 286 used to verify the revocation status of certificates.
Certificates may be retrieved from LDAP server 284 by a user computer 262 a, for example, to be downloaded to mobile device 100 via cradle 264. However, in a variant implementation, LDAP server 284 may be accessed directly (i.e. “over the air” in this context) by mobile device 100, and mobile device 100 may search for and retrieve individual certificates through a mobile data server 288. Similarly, mobile data server 288 may be adapted to allow mobile device 100 to directly query OCSP server 286 to verify the revocation status of certificates.
Other sources of certificates [not shown] may include a Windows certificate store, another secure certificate store on or outside LAN 250, and smart cards, for example.
Referring now to FIG. 6, a block diagram illustrating components of an example of an encoded message, as may be received by a message server (e.g. message server 268 of FIG. 4), is shown generally as 350. Encoded message 350 typically includes one or more of the following: a header portion 352, an encoded body portion 354, optionally one or more encoded attachments 356, one or more encrypted session keys 358, and signature and signature-related information 360. For example, header portion 352 typically includes addressing information such as “To”, “From”, and “CC” addresses, and may also include message length indicators, and sender encryption and signature scheme identifiers, for example. Actual message content normally includes a message body or data portion 354 and possibly one or more attachments 356, which may be encrypted by the sender using a session key. If a session key was used, it is typically encrypted for each intended recipient using the respective public key for each recipient, and included in the message at 358. If the message was signed, a signature and signature-related information 360 are also included. This may include the sender's certificate, for example.
The format for an encoded message as shown in FIG. 6 is provided by way of example only, and persons skilled in the art will understand that encoded messages may exist in other formats. For example, depending on the specific messaging scheme used, components of an encoded message may appear in a different order than shown in FIG. 6, and an encoded message may include fewer, additional, or different components, which may depend on whether the encoded message is encrypted, signed or both.
Embodiments of the invention are generally directed to a system and method that facilitates more efficient verification of digital signatures on certificates by storing certain information employed in signature verification operations for reuse. In building certificate chains (as discussed in the example of FIG. 5), the digital signatures on the certificates often need to be verified. Where multiple certificates are processed on a user's computing device, the same digital signature is often subject to verification more than once. This may be particularly prevalent where certificate chains containing cross-certificates are formed. Cross-certificates are discussed in further detail below with reference to FIG. 7B.
Referring first to FIG. 7A, a block diagram showing two example certificate chains is shown. The two example certificate chains are illustrated generally as 400 a and 400 b. It will be understood by persons skilled in the art that certificate chains 400 a and 400 b are provided as examples. In particular, a certificate chain may comprise a fewer or a greater number of certificates than depicted in the examples shown.
Many organizations establish their own CAs, which issue certificates specifically to individuals within their own organizations. End entity certificates issued to individuals within a particular organization need not be issued by a single CA associated with the organization. An end entity certificate is often issued by one of a number of subordinate or intermediate CAs within a CA hierarchy headed by a root CA for the organization. This root CA may provide a self-signed root certificate to be used as a “trust anchor”—a starting point for the validation of certificates issued within the organization.
Certificate chain 400 a depicts an example chain of certificates formed to validate a certificate 402 a issued to “user1”, an individual within organization “ABC”. Certificate 402 a chains to a self-signed root certificate 404 a, issued by a root CA of the organization and trusted by user1, via an intermediate certificate 406 a issued by the root CA to an intermediate CA of the organization. The certificates issued within organization ABC may be searched and retrieved from an LDAP server maintained by the organization (e.g. LDAP server 284 of FIG. 4), for example.
Similarly, certificate chain 400 b depicts an example chain of certificates formed to validate a certificate 402 b issued to “user2”, an individual within a different organization “XYZ”. Certificate 402 b chains to a self-signed root certificate 404 b issued by a root CA of organization XYZ and trusted by user2, via an intermediate certificate 406 b. The certificates issued within organization XYZ may be searched and retrieved from an LDAP server maintained by organization XYZ, for example.
Consider an example situation where user1 of organization ABC receives an encoded message from user2 of organization XYZ. Even if user2 has attached his certificate 402 b to the message, user1 will be unable to verify the trust status of user2's certificate 402 b with that certificate alone (assuming that user1 has not already stored user2's certificate 402 b and marked it as trusted). If user1 does not trust certificates from organization XYZ, then user2's certificate 402 b cannot be validated since it does not chain to a trusted certificate.
In order to facilitate secure communications between users of different organizations, it may be desirable to allow certificates to be used and trusted between the organizations. An authentication method known as cross-certification may be performed between two organizations, where a CA of one organization certifies a CA of the other organization.
The term cross-certification may be used to refer generally to two operations. The first operation, which is typically executed relatively infrequently, relates to the establishment of a trust relationship between two CAs (e.g. across organizations or within the same organization), through the signing of one CA's public key by another CA, in a certificate referred to as a cross-certificate. The second operation, which is typically executed relatively frequently, involves verifying a user's certificate through the formation of a certificate chain that includes at least one such cross-certificate.
Referring now to FIG. 7B, a block diagram showing examples of cross-certificates linking two example certificate chains is shown. A cross-certificate 410 issued to the root CA of organization ABC by the root CA of organization XYZ is shown in this example. Similarly, a cross-certificate 412 issued to the root CA of organization XYZ by the root CA of organization ABC is shown.
The example of FIG. 7B illustrates mutual cross-certification between two root CAs. However, other cross-certification methods are possible in variant implementations. For example, cross-certificates may be issued by a subordinate CA in one organization to the root CA of another organization. As a further example, a CA of a first organization may issue a cross-certificate to a CA of a second organization, even if a cross-certificate is not issued back to the first organization by the second organization.
Furthermore, certificate usage across organizations may be restricted, as dictated by an organization's IT policy, for example. For instance, the IT policy of one organization may dictate that certificates from other organizations will be trusted only for the purpose of processing encoded e-mail messages. Also, cross-certificates may be revoked by an issuing CA of one organization to terminate trust relationships with other organizations. This can facilitate more efficient control of secure e-mail communications between individuals across different organizations.
Cross-certificates facilitate secure communications between individuals of organizations that have established a trust relationship. Consider again the situation where user1 of organization ABC receives an encoded message from user2 of organization XYZ. User1 will be able to verify the trust status of user2's certificate 402 b, by retrieving certificates in a chain from user2's certificate 402 b, to root certificate 404 a issued by a root CA of user1's organization and trusted by user1. Specifically, as shown in the example of FIG. 7B, the chain includes ABC's root certificate 404 a, cross-certificate 412, XYZ's root certificate 404 b, intermediate certificate 406 b, and user2's certificate 402 b.
For user1 to verify the trust status of user2's certificate 402 b, user1 must obtain certificate 402 b. This will customarily accompany the message from user2 to user1; however, in the event that certificate 402 b is not provided and is not otherwise stored on user1's computing device, it must be retrieved, from an LDAP server maintained by organization XYZ, or other certificate server, for example. Furthermore, each of the remaining certificates in the chain must also be retrieved to verify the trust status of certificate 402 b. The other certificates in the chain, which in this example include a root certificate and a cross-certificate, would need to be retrieved from ABC's LDAP server, XYZ's LDAP server, or some other LDAP server accessible to user1.
As discussed with reference to FIG. 5, and FIGS. 7A and 7B, the digital signatures of issuing CAs on certificates often need to be verified when building certificate chains. Other tasks may also be performed when validating certificates, such as checking the validity of a certificate's date, or checking other validation criteria that might be established by an organization in accordance with an IT policy, for example.
Verification of a digital signature on a certificate is a process that requires the public key of the issuing CA. When a CA digitally signs a certificate, certificate information including the name and public key of the certificate holder for example, or a hash of that information obtained through application of a hashing algorithm, is typically encoded using the CA's private key. The algorithm used by the issuing CA to sign a certificate is typically identified in the certificate. Subsequently, in a manner similar to that employed in verifying the digital signature of a message signed by a user, the CA's digital signature on a certificate can be verified by decoding the encoded information or hash using the CA's public key, and comparing the result to the expected certificate information or hash thereof respectively. A successful match indicates that the CA has verified that the certificate holder's public key may be validly bound to the certificate holder, and suggests that the certificate holder's public key can be trusted if the CA is trusted.
Verifying certificate signatures can be a process that is both time-consuming and costly (e.g. in terms of computing resource usage), particularly where the verifications are performed on small devices, such as mobile devices for example. Embodiments of the invention are generally directed to a system and method that facilitates more efficient verification of digital signatures on certificates by storing certain information employed in signature verification operations for reuse.
In at least one embodiment, one or more public keys of a CA that has issued a particular certificate are associated with that certificate, and cached or stored. As indicated above, when attempting to verify a digital signature on a certificate signed by a CA, the CA's public key is required. However, there may exist multiple certificates (each with a public key attached) that appear to belong to the same CA. This situation might arise if several certificates have the same or similar subject data (i.e. the certificate data which identifies the certificate holder) or if the CA has been issued multiple public keys (some of which may no longer be valid), for example. Accordingly, it can be beneficial to track which particular public key has been used to successfully verify a particular certificate.
Referring to FIG. 8, a flowchart illustrating steps in a method of verifying digital signatures on certificates in an embodiment of the invention is shown generally as 420.
In one embodiment of the invention, at least some of the steps of the method are performed by a certificate validation application that executes and resides on a mobile device. In variant embodiments, the certificate validation application may be residing and executing on a computing device other than a mobile device. Furthermore, the certificate validation application need not be a stand-alone application, and the functionality of the certificate validation application may be implemented in one or more applications executing and residing on the mobile or other computing device.
Generally, in method 420, when a given public key is used in successfully verifying the digital signature on a certificate, a copy of that public key is cached, or otherwise stored in a memory store. For example, the public key may be stored with the certificate data associated with the certificate, or in a separate memory store (e.g. a lookup table) adapted to store public keys employed in successful signature verifications. When a subsequent attempt to verify the digital signature on the same certificate is made, rather than immediately performing an expensive signature verification operation requiring at least the decoding of some data using a public key, the public key that would have been used to verify the digital signature again is instead initially compared to the stored public key. If these public keys match, then the verification will be deemed successful, since the public key to be used matches a key that has been previously used successfully in a signature verification operation. It is considered unnecessary to perform an actual signature verification operation again for the same digital signature. Accordingly, at least some subsequent signature verification operations may be replaced by more efficient (e.g. byte array) comparison operations. The steps of method 420 are described in further detail below.
At step 430, a verification of a digital signature on a certificate is initiated (e.g. by the certificate validation application). Verifications of digital signatures on certificates may be performed, for instance, when building certificate chains in order to validate specific certificates received by a user (e.g. to verify the trust status of a certificate attached to a received message as discussed with reference to FIG. 5). In this embodiment, the digital signatures on the certificates being verified are those of the certification authorities that issued the respective certificates. As noted earlier, in a signature verification operation, a public key of the certification authority that issued the certificate is required. Certificate(s) and public key(s) of the certification authority may need to be retrieved at this step (e.g. from an LDAP server) if they are not already stored in a certificate store on the mobile or other computing device.
For a given public key, at step 440, prior to performing the signature verification operation using this public key, a determination is made as to whether the digital signature on the subject certificate has previously been successfully verified using this public key. As indicated above, this may be done by comparing a stored public key for the certificate issuer previously used to successfully verify the digital signature on the subject certificate (if one exists, as stored at step 470 in the cache or other memory store) with the public key that is about to be used to verify the digital signature, and then determining if there is a match. Since only public keys employed in successful verification attempts are stored in the cache or other memory store in this embodiment, if a match were determined, this would suggest that the digital signature on the subject certificate has previously been successfully verified.
If the digital signature on the subject certificate has not been previously successfully verified using the given public key, then at step 450, the digital signature is verified using this public key in known manner. If the signature is successfully verified as determined at step 460 using this public key, then the public key used in this successful verification is stored in the cache or other memory store for future use at step 470, in accordance with this embodiment. For example, the public key stored at step 470 may be stored with the data associated with the subject certificate, or in a central memory store for public keys (e.g. in a lookup table) indexed by certificate (e.g. by storing the issuer name and serial number of the certificate with the public key).
On the other hand, if the digital signature on the subject certificate had previously been successfully verified using the given public key as determined at step 440, then at step 480, an indication that the verification is successful is provided. This is done in lieu of performing an actual signature verification operation requiring at least the decoding of some data using a public key, thereby making the signature verification process more efficient. This may help conserve battery power and enhance the user experience, for example, particularly for small devices such as mobile devices.
The steps of method 420 may be repeated for additional public keys.
Referring now to FIG. 8B, a flowchart illustrating steps in a method of verifying digital signatures on certificates in another embodiment of the invention is shown generally as 420 b.
Method 420 b is similar to method 420, except that in contrast to method 420 where only the public keys employed in successful signature verifications are stored in the cache or other memory store, in method 420 b, the public keys used in any signature verification attempt (whether successful or unsuccessful) are stored in the cache or other memory store along with the result of the verification attempt.
Generally, in method 420 b, when a given public key is used in verifying the digital signature on a certificate, a copy of that public key is cached or otherwise stored in a memory store, along with the result of the operation. For example, the public key and associated result may be stored with the certificate data associated with the certificate, or in a separate memory store (e.g. a lookup table). When a subsequent attempt to verify the digital signature on the same certificate is made using the given public key, rather than performing an expensive signature verification operation requiring at least the decoding of some data using that public key, the public key that would have been used to verify the digital signature again is instead initially compared to the stored public key(s). If the given public key matches a stored public key, then the current verification attempt will be deemed successful or not successful, depending on the stored result associated with that stored public key. If the stored result indicates that the previous verification attempt with that stored public key was successful, then the current verification attempt will be deemed to succeed. If the stored result indicates that the previous verification attempt with that stored public key was not successful, then the current verification attempt will be deemed to fail. Accordingly, subsequent signature verification operations that would otherwise require decoding of some data using public keys may be replaced by more efficient (e.g. byte array) comparison operations.
At step 430, a verification of a digital signature on a certificate is initiated (e.g. by the certificate validation application), as described with reference to method 420.
For a given public key, at step 440 b, prior to performing the signature verification operation using this public key, a determination is made as to whether the digital signature on the subject certificate has previously been verified using this public key. As indicated above, this may be done by comparing a public key for the certificate issuer previously used to verify the digital signature on the subject certificate (if one exists, as stored at step 470 in the cache or other memory store) with the public key that is about to be used to verify the digital signature, and determining if there is a match. If a match were determined, this would suggest that an attempt to verify the digital signature on the subject certificate was previously made.
If an attempt to verify the digital signature on the subject certificate was not previously made, then a signature verification operation is performed in known manner at step 450, as similarly described with reference to method 420. Both the public key used in the verification and the result of the verification attempt (i.e. an indicator of whether the digital signature was successfully or unsuccessfully verified) are stored in the cache or other memory store for future use at step 470 b, in accordance with this embodiment. For example, the public key and result stored at step 470 b may be stored with the data associated with the subject certificate, or in a central memory store for public keys (e.g. in a lookup table) indexed by certificate (e.g. by storing the serial number of the certificate with the public key).
If the digital signature on the subject certificate has previously been verified with the given public key as determined at step 440 b, then at step 472, the result of the previous verification attempt with this key is retrieved from the cache or other memory store and a determination is made as to whether or not the stored result indicates that the previous verification attempt with this key was successful. If so, then at step 480, an indication that the current verification is to succeed is provided; if not, then at step 490, an indication that the current verification is not to succeed is provided.
The steps of method 420 b may be repeated for additional public keys.
In lieu of performing a signature verification operation requiring at least the decoding of some data using a given public key, the results of previous verification attempts are used to determine if a verification using this public key should fail, thereby making the signature verification process more efficient. In particular, if a user requests verification of the digital signature of a certificate multiple times using the same invalid public key, then an actual expensive signature verification operation requiring at least the decoding of some data using the public key need be performed only once, and the subsequent attempts will fail immediately after performing a relatively efficient (e.g. byte array) comparison operation. This may further help conserve battery power and enhance the user experience, for example, particularly for small devices such as mobile devices.
It will be understood by persons skilled in the art that other information in addition to the public keys and verification attempt results described above may also be stored in the cache or other memory store, if desired, in variant embodiments.
In a variant embodiment of the invention, public keys and other information (e.g. verification attempt results) stored in the cache or other memory store may only be permitted for use in public key comparisons for a limited duration, after which they may be considered stale and subject to deletion from the cache or other memory store. This may be done for security purposes so that an actual signature verification operation requiring at least the decoding of some data using a public key must be re-performed from time-to-time. This duration may be set in accordance with IT Policy, for example. Similarly, in another variant embodiment of the invention, some or all of the public keys and other information stored in the cache or other memory store may be marked as stale or deleted as may be directed manually by a user or administrator, for example, so that the signature verification operation must be re-performed. For more enhanced security, validation operations may also be performed to ensure that public keys (e.g. public keys which previously successfully verified a certificate signature) have not become invalid after storage, for example.
The steps of a method of verifying digital signatures on certificates in embodiments of the invention may be provided as executable software instructions stored on computer-readable media, which may include transmission-type media.
said processor indicating, as a response to the request to perform the second signature verification operation, successful verification of the digital signature in lieu of performing the second signature verification operation.
wherein said indicating is performed after the result indicating that the digital signature is successfully verified in the first signature verification operation is stored.
3. The method of claim 2, wherein said result is used by said processor to successfully verify the digital signature in the first signature verification operation within a limited duration.
5. The method of claim 1, wherein the first public key stored in the memory store is used by said processor in subsequent comparisons with the second public key within a limited duration.
6. The method of claim 1, further comprising said processor deleting the first public key from the memory store.
7. The method of claim 1, further comprising said processor marking the first public key stored as stale.
8. The method of claim 1, further comprising said processor performing validation operations comprising verifying that the first public key stored in the memory store is not stale.
indicating, as a response to the request to perform the second signature verification operation, successful verification of the digital signature in lieu of performing the second signature verification operation.
11. The system of claim 10, wherein said result is used by said processor to successfully verify the digital signature in the first signature verification operation within a limited duration.
12. The computer-readable medium of claim 9, wherein the computing device comprises a mobile device.
indicate, as a response to the request to perform the second signature verification operation, successful verification of the digital signature in lieu of performing the second signature verification operation.
wherein successful verification is indicated after the result indicating that the digital signature is successfully verified in the first signature verification operation is stored.
15. The system of claim 13, wherein said at least one computing device comprises a mobile device.
16. The system of claim 13, wherein the first public key stored in the memory store is used by said processor in subsequent comparisons with the second public key within a limited duration.
17. The system of claim 13, said processor further configured to delete the first public key from the memory store.
18. The system of claim 13, said processor further configured to mark the first public key stored as stale.
19. The system of claim 13, said processor further configured to perform validation operations comprising verifying that the first public key stored in the memory store is not stale.
Australian Exam Report. Application No. 2005225093. Dated: Dec. 13, 2006.
Australian Examination Report. Application No. 2005225093. Dated: Mar. 31, 2008.
Canadian First Office Action. Application No. 2,526,863. Dated: Nov. 3, 2009.
Chinese Notification of Grant of Rights for Invention Patent (with English Translation). Application No. 200510118777.9. Dated: Apr. 14, 2009.
Co-pending U.S. Appl. No. 11/418,176, "Method and System for Sending Secure Messages", Filed May 5, 2006. (Retrievable from PAIR).
European Communication under Rule 51 (4)EPC. Application No. 04105424.8-2413. Date: Aug. 11, 2006.
Japanese First Office Action (English translation). Application No. 2005-313157. Mailing Date: May 7, 2009.
Korean Examination Report. Application No. 10-2005-0101996. Dated: Nov. 3, 2006.
Korean Notice of Decision for Patent (with English translation) Application No. 10-2005-0101996 Date: Apr. 16, 2007.
Pugh, William et al., "Incremental Computation via Function Caching", Conference Record of the Sixteenth Annual ACM Symposium on Principles of Programming Languages ACM New York, NY, U.S.A., January 11, 1989, pp. 315-328.
Singapore Examination Report. Application No. 200506820-0, Dated: January 12, 2007.
Singapore Written Opinion. Application No. 200506820-0 Date: Feb. 23, 2006.
Stallings, W., "Cryptography & Network Security: Principles & Practice-2nd" 1998, pp. 163-205.
Stallings, W., "Cryptography & Network Security: Principles & Practice—2nd" 1998, pp. 163-205.
Taiwanese First Office Action (English translation). Application No. 094137999. Dated: May 14, 2009.
United States Office Action. Co-pending U.S. Appl. No. 11/418,176. Dated: Jul. 29, 2009.
Walsh, Kevin et al., "Staged Simulation: A General Technique for Improving Simulation Scale and Performance", ACM Transactions on Modeling and Computer Simulation vol. 14, No. 2, Apr. 2004, pp. 170-195.

References: Application No. 2005225093
 Application No. 2005225093
 Application No. 2
 Application No. 200510118777
 Application No. 04105424
 Application No. 2005
 Application No. 10
 Application No. 10
 Application No. 200506820
 Application No. 200506820
 Application No. 094137999