Patent ID: 8484461

Claim:
An external organization path length (EOPL) validation method, comprising: storing, in memory at a relying party node, a current external organization path length constraint (current EOPLC) value, and an external organization path length (EOPL) counter that maintains a count of an actual external organization path length; receiving, at the relying party node, an authentication request from a subject node affiliated with an external organization that is external to an organization of the relying party node and seeking to be authenticated by the relying party node; obtaining, at the relying party node, a chain of certificates that link the subject node to a trust anchor affiliated with the organization of the relying party node, wherein both the organization and the external organization comprise at least one node and at least one trust anchor; initially setting the current EOPLC value to infinity and the EOPL counter to zero before processing any certificates in the chain; and processing the certificates in the chain by: selecting a current certificate in the chain of certificates to be evaluated, wherein a certificate in the chain of certificates comprises an external organizational flag (EOF) and an external organization path length constraint (EOPLC) value, and further wherein an enabled EOF indicates that the certificate was issued to a node affiliated with an external organization and the EOPLC value specifies a maximum allowable number of certificates within the chain of certificates that are permitted to include EOFs that are enabled; replacing the current EOPLC value stored in memory with an EOPLC value from the current certificate when the current certificate has a lower EOPLC value than the current EOPLC value; and incrementing the EOPL counter by one each time the certificate currently being evaluated comprises an EOF that is enabled.