Patent ID: 8726012

Claim:
An external organization path length (EOPL) validation method, the method comprising: at a relying party node of an organization: receiving an authentication request from a subject node of an external organization; obtaining and evaluating certificates from a chain of certificates that link the subject node to a trust anchor of the relying party node wherein, at least one certificate from the chain of certificates comprises at least one of: an enabled External Organization Flag (EOF) that indicates whether the certificate was issued to a node affiliated with the external organization, and an External Organization Path Length Constraint (EOPLC) value that specifies a value equal to a maximum allowable number of certificates within the chain of certificates that are permitted to include an EOF that is enabled; determining whether a total number of enabled EOFs from certificates in the chain of certificates exceeds a lowest EOPLC value from certificates in the chain of certificates; and invalidating authentication of the subject node when the total number of enabled EOFs from certificates in the chain of certificates exceeds the lowest EOPLC value from certificates in the chain of certificates.