Patent ID: 7139911

Claim:
A method of authenticating a host-identification mapping extension included in a digital certificate, the digital certificate, issued and signed by a specific certification authority, the method comprising: assigning a trust value for each certification authority included in a set of certification authorities, said trust value being based on a corresponding organization responsible for operating said certification authority, and said trust value corresponding to one of the following values: “not trusted”, “trusted”, or “highly trusted”; receiving said digital certificate containing said host-identification mapping extension, said host-identification mapping extension containing a plurality of identification attributes, including a host name, a subject identification name and optionally a proof of identity possession entry; if the trust value assigned to the specific certification authority issuing said digital certificate is “highly trusted” and said host identification mapping extension contains a corresponding host name for a host system to be accessed, then honoring said host-identification mapping extension regardless of whether said proof of identity possession data entry appears in said host-identification mapping extension; and if the trust value assigned to said certification authority is “trusted”, then said host-identification mapping extension is certified only if said proof of identity possession data entry appears in said host-identification mapping extension, and contains valid information as verified by a host corresponding to said host name included in said plurality of identification attributes.