Patent Application
20060129804
The subject invention relates generally to server certificates and establishing Internet presence, and more particularly to systems and methods that facilitate purchase, remote configuration and maintenance of a certificate, via a structured messaging format and protocol.
The rapid growth of the Internet and Internet based applications has created a multitude of benefits for businesses, such as ease of marketing and sales to clients. As such, web based interaction is currently in demand by all types of businesses, e.g., various corporations, medical facilities, businesses, the government, industry, and educational facilities to simplify and enhance everyday tasks such as correspondence (e.g., via email, instant messaging), documentation, problem solving, mathematical computation, scheduling, planning, and information gathering, for example.
In such environments, the Domain Name Service (DNS) allows potential clients to key a URL (Uniform Resource Locator) or domain name into the address line of their browser and access a corresponding server/computer of the business. In general, a Domain Name Service (DNS) includes a distributed set of servers primarily used by internet applications to lookup the network address of a given internet server. For example, an internet application that requires looking up a server name initially can send a DNS query to a local Domain Name server (LDNS), which may be located at the same site. The LDNS can also maintain a cache of resource records, for example, mappings between server names and IP addresses. To facilitate mnemonic identification of destination computer systems, a Domain Name Service (DNS) can typically translate a unique textual name for a destination computer system into the IP address for that computer. The textual name is called a “fully qualified domain name.”
An example of a domain name is “www.Microsoft.com”, wherein, “www” indicates the name of a specific computer on the Internet, “Microsoft” indicates an example of a company name and “.com” indicates commercial (as opposed to .gov for government entities, .edu for education entities, .org for non-profit organizations, and the like). Likewise, progressing from right to left, the host name can be structured from general to very specific. For example, “corn” can typically be referred to as a top-level domain name, “Microsoft” is sometimes referred to as a second-level domain name, and “w ww” can designate the server that handles Internet requests, and is sometimes referred to as the host name. This structure allows reuse of names within different hierarchies.
An example of a URL is “http://www.Microsoft.com/1.gif”, where the “http://” indicates the type of protocol and the last field, “.gif”, indicates a file name, but may also be a Web page, executable application, or other computer readable or executable file located at the URL that the user wishes to access.
When the user enters the URL into a browser, the browser can make a determination as to whether it knows the corresponding IP (Internet Protocol) address. For example, a corresponding IP address for “Microsoft.com” may be 207.46.130.108. The browser knows the corresponding IP address if that host name has been visited recently and the address is still in a short-term host name address table in the browser.
At the same time, initiating presence on the Internet can require installation and configuration of both standards based and specialized proprietary software/procedures (e.g., from DNS providers, Certificate Authorities, and the like) that can further complicate matters. A user who wishes to obtain a domain name needs to work through one of several domain name registrars to purchase a domain name. Typically, this involves the right to use a second level name under one or more top level domains for a given duration. The duration can be extended prior to its expiration. In addition to purchasing a name, the user needs to up date the DNS with the information required to access all the Internet facing hosts associated with that domain name. Such information typically maps the IP addresses of each of these computers to their respective fully qualified domain name. This association can be hosted by the user on a computer/server at his/her location or hosted by one of many service providers. Currently there is a disparate collection of configuration tools that thwart users from employing opportunities provided by the Internet to their full potentials. For example, the DNS hosting provider can require the user to be an expert in configuring DNS and to manually provide instructions to configure the domain name. A certificate authority may require software (e.g., certification software) that need to be installed on a computer system prior to publishing an Internet presence.
For businesses to enjoy benefits of a domain name and thereby presence on the Internet, the domain name not only needs to be configured, but also the communication between the cluster of computers providing Internet facing services and the client machines on the Internet need to be secure. For example, information conveyed over a network is susceptible to interception (e.g., eavesdropping) and tampering if the information is transmitted in an unsecured (e.g., unencrypted) manner. As such, confidential information such as credit card numbers, bank account numbers and social security numbers transmitted over an unsecured channel can be viewed and/or copied by malicious parties intending to commit criminal activity and fraud. For example, a malicious party can intercept a credit card number, and then employ the credit card number to unlawfully purchase goods. The credit card holder then incurs the burden of canceling the credit card, securing credit with another credit card company, protecting their credit history, and seeking relief for the illegal purchases. Additionally without a secure infrastructure a malicious user can impersonate a well known entity, such as a business, to collect sensitive data from the users on the Internet. A consumer experiencing the foregoing can be inclined to avoid employing web-based means when engaging in subsequent purchases. Even the potential for the foregoing can prejudice a user from purchasing and communicating via the web or have a domain name.
In response to security concerns and the increased reliance on web technology in the exchange of information, research, development and implementation efforts have ensued to provide web security mechanisms. For example, authenticating technologies such as Transport Layer Security (TLS) encryption have been developed, and are typically employed and associated with web site to determine whether a website is valid (i.e., trusted). Such technologies can verify a web site via ensuring the website is associated with a valid (e.g., signed) web site certificate. Generally, the web site certificate can provide web site identification such as the web site's publisher, and can be employed to match a web site publisher with the certificate. When a match is successful, the web client is typically provided access to the web site. Similarly, when a match is unsuccessful, the web client is commonly provided with a notification indicating that the web site is not trusted.
A software certificate is used to authoritatively identify an entity such as a cluster of computers or business on the Internet. This is similar to how a photo ID is used to identify a person. A photo ID contains information such as the photograph of the person, name, address, date of birth that help identify an individual. In addition, PhotoIDs have an expiration date. PhotoID are also issued for specific uses such as traveling (Passport document) and driving (drivers license). Similarly a certificate contains information that helps to identify the entity it represents, is issued for specific uses and has a specific expiration date. In order to be trusted by everyone a photo ID needs to be issued by an authority recognized in the intended domain of use. Like wise a certificate needs to be issued by a globally trusted Certificate Authority. This authority has the power to revoke the certificate at any time. As soon as a certificate is revoked it looses its validity.
Currently, publishing a web site on the Internet and employing a certificate can comprise several manual steps that can be time consuming and expensive. For example, configuring a web site to employ TLS encryption typically includes purchasing a certificate from a third party or generating a self-signed certificate, manually installing and manually configuring the certificate on the web server, manually installing and manually configuring the certificate on the web client, and manually trusting the certificate on the web clients local to the server domain. The configuration of the web clients becomes extremely challenging when a self-signed certificate is used. A self-signed certificate is one that is created by a specific entity and is not a globally trusted Certificate Authority. In this case some other mechanism is used to validate the certificate. Currently there are a number of globally trusted certificate providers each of whom has a unique way of delivering a trusted certificate. Both the domain name and certificate purchase and configuration require manual steps today and as a result involve large delays.
Thus and as explained above, users wishing to enjoy presence of their domain names on the Internet are typically subjected to: non-uniform presentations in a multi-vendor environment, cumbersome contacting and installation requirements, waiting periods for appropriate access software and/or hardware to be delivered or installed.
Therefore, there is a need to overcome the aforementioned exemplary deficiencies associated with conventional devices.
The following presents a simplified summary of the invention in order to provide a basic understanding of one or more aspects of the invention. This summary is not an extensive overview of the invention. It is intended to neither identify key or critical elements of the invention nor to delineate the scope of the subject invention. Rather, the sole purpose of this summary is to present some concepts of the invention in a simplified form as a prelude to the more detailed description that is presented hereinafter.
The subject invention provides for systems and methods that facilitate server certificate purchase and configuration for presence of services/sites on the Internet, by using a schema that operates between an end user machine and a Certificate Authority (CA), wherein the schema employs; a purchasing component and an update component. The purchasing component can further include various sub components that characterize the Certificate Authority offered term of sale for issuing digital certificates used to create digital signatures such as; requesting platform type, billing, plan selection, renewal, promotional calls, and the like. Similarly, the update component can supply updates for the initial certificate, and to reflect revised data associated with the user, for example, changing the contact information for the owner of the certificate, address/name of the hosting server, type of service (e.g., so that the certificate is not only valid for web presence, but also for secure e-mail), revoke an existing certificate and the like. As such, the role of the Certificate Authority is typically to guarantee that the end user machine granted the unique certificate is, in fact, what it claims to be to its clients.
In accordance with an aspect of the subject invention, a plurality of third party Certificate Authorities can register and receive a standardized set of messages for issuing a digital certificate(s) to a user. Such standard messages can provide a user with a uniform presentation of various plans offered by the plurality of Certificate Authorities, wherein the user can then select a desired plan therefrom for obtaining a digital certificate. The standardized messages can be for example in a form of XML (Extensible Markup Language).
The invention thus facilitates initial server configurations (e.g., presence of small businesses on the Internet), and on-going maintenance, wherein employing multi vendor components are simplified by using a unified and common message structure. Such unified and common message structure can be used by a plurality of end user networked devices such as stand alone routers, window servers, and the like, when interacting with third party Certificate Authorities.
According to a methodology of the subject invention, once a user has selected a domain name and a Domain Name Service (DNS) provider, the purchasing component can automatically query Certificate Authorities for terms of the service to issue digital certificates, which for example can attest that the public key contained in the certificate belongs to the ‘owner’ noted in the certificate. The terms can include; duration for attesting to the digital signature, price, terms of payments and the like. Subsequently, a response to such query can be received by the end user machine. A billing query can then be automatically prepared and submitted to the Certificate Authority. Next, the Certificate Authority can provide a billing response that outlines the service agreement terms for issuing a digital signature for the domain name. The received response can then be displayed to a user, via a uniform presentation such that a user enjoys a similar experience, regardless of which Certificate Authority the user interacts with. The user can then elect a desired plan to initiate internet presence.
To the accomplishment of the foregoing and related ends, the invention, then, comprises the features hereinafter fully described. The following description and the annexed drawings set forth in detail certain illustrative aspects of the invention. However, these aspects are indicative of but a few of the various ways in which the principles of the invention may be employed. Other aspects, advantages and novel features of the invention will become apparent from the following detailed description of the invention when considered in conjunction with the drawings.
Appendix A presented infra provides one particular exemplary set of schema in accordance with an aspect of the subject invention—this appendix is to be considered part of this specification describing the invention.
The subject invention is now described with reference to the drawings, wherein like reference numerals are used to refer to like elements throughout. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the subject invention. It may be evident, however, that the subject invention may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to facilitate describing the subject invention.
As used in this application, the terms “component,” “handler,” “model,” “system,” and the like are intended to refer to a computer-related entity, either hardware, a combination of hardware and software, software, or software in execution. For example, a component can be, but is not limited to being, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer. By way of illustration, both an application running on a server and the server can be a component. One or more components may reside within a process and/or thread of execution and a component may be localized on one computer and/or distributed between two or more computers. Also, these components can execute from various computer readable media having various data structures stored thereon. The components can communicate via local and/or remote processes such as in accordance with a signal having one or more data packets (e.g., data from one component interacting with another component in a local system, distributed system, and/or across a network such as the Internet with other systems via the signal).
The subject invention provides for a standardized messaging schema that facilitates purchase, remote configuration, maintenance and revocation of a certificate, by using a unified message protocol, which is exchanged between a user and a Certificate Authority(ies). The standardized schema employs; a purchasing component, and an update component. Such a messaging schema can further provide for a uniform presentation of various hosting plans offered by the plurality of Certificate Authorities, and thus a user can enjoy a similar experience, regardless of which Certificate Authority the user interacts with.
Referring initially to
The end user machine 110 can be a cluster of computers, servers, personal computers, work stations, personal digital assistant, and the like. In addition, the end user machine 110 can also be an Internet Connection Sharing Device (ICSD) that facilitates sharing a connection 112 from a network 114 to the Internet 116. As such, the end user machine 110 can be a computer executing a process that facilitates time-sharing of the Internet connection 112, for example. The connection 112 can be, for example, a modem connection, a DSL connection and/or a wireless connection. The network 114 can be, for example, an Ethernet LAN, a token ring LAN, or other LAN. Although the invention is primarily described within the context of an end user machine 110 that communicates with a Certificate Authority 120, it is to be appreciated that the network 114 can also include a Wide Area Network (WAN). Moreover, the network 114 can include hardwired and/or optical and/or wireless connection paths. The connection 112 can be shared among a plurality of devices connected to the network 114. Such devices can include, personal computers, workstations, televisions and telephones, for example. Sharing of the connection 112 facilitates reducing the cost of one or more of the LAN devices, and can reduce the complexity of managing the network 114 and optimizes the throughput of the connection 112.
Likewise, the Certificate Authority 120 can issue and manage security credentials and public/private key pairs for identification and message encryption. In a related aspect, as part of a public key infrastructure, the Certificate Authority can check with a registration authority (not shown) to verify information provided by the requestor of a digital certificate. If the registration authority verifies the requestor's information, the Certificate Authority can then issue a certificate. The certificate can include the owner's public key, the expiration date of the certificate, the owner's name, and other information about the public key owner.
Once the Certificate Authority registers to receive the standardized messages of the subject invention, a user can select such authority to offer plans for issuing a digital signature for the domain name selected earlier by the user. Each plan can have a plurality of terms and conditions such as, duration, price and the like associated therewith. Upon selection of a plan by the user, the digital certificate can be issued.
Similarly, vendor 240 can manage certificate authority and authenticating technologies, such as Transport Layer Security(TLS) encryption with the domain name web site to verify validity (i.e., the website is trusted), as illustrated by the interaction at 250. Such technologies can verify a web site via ensuring the website is associated with a valid (e.g., signed) web site certificate. Generally, the web site certificate can provide web site identification, such as the web site's publisher, and can be employed to match a web site publisher with the certificate. When a match is successful, a secure communication is created between the web client and the web site/service and the web client displays/confirms the authenticity of the site/service to the end user/application. The Certificate Authority 240 can include an input component 242 and a signature component 244.
The input component 242 of the Certificate Authority 240 can be employed to communicate with the end user machine to service requests such as queries and requests including the certificate signing request (CSR). The Certificate Authorities portion of the purchasing and update components can be part of the input component. The input component can then provide the CSR to the signature component 244 of the Certificate Authority 240. Subsequently, the signature component of the Certificate Authority can validate and provide a signed certificate to the input component to be transmitted to the end user machine. The end user machine can then automatically install the signed certificate to a cluster of computers on at the end user location.
As illustrated in
Referring now to
An exemplary schema that can define an expression of shared vocabulary between the end user machine 301 and Certificate Authority 308 is presented at the end of this document, as part of appendix A. Such exemplary schema can for example be in form of an Extensible Markup Language (XML) that can define and describe a class of XML documents using schema constructs of an XML schema language. These schema constructs can be used to constrain and document the meaning, usage, and relationships of data types, elements and their content, attributes and their values, entities, contents and notations, as used in XML documents. Thus, in general any computer system that can access an XML schema can process XML documents in accordance with the XML schema. Furthermore, typically any computer system that can access an XML schema can compose or modify XML documents for use by other computer systems that can also access the XML schema. A schema can be utilized to define virtually any data type including logical, binary, octal, decimal, hexadecimal, integer, floating-point, character, character string, user-defined data types, and combinations of these data types used to defined data structures. XML elements and attributes can be defined to represent data types that are defined by a schema.
The Certificate Authority 404 can register and receive the standardized set of messages for issuing a digital certificate to an entity. For example, at 414 the purchasing component of the standardized schema of the subject invention can query the Certificate Authority 404 that is registered for receiving the standardized messages for a purchase query of the various plan offerings. Next, and at 416 a purchase query response identifying the various plans and terms of the service is communicated via the standardized set of messages of the subject invention back to the Certificate Authority 404. Subsequently and at 418, a billing query is transferred to the Certificate Authority 404. A response can then be prepared and sent back to the end user machine at 420 regarding various billing requirements for issuing a digital certificate.
The received response can then be displayed to a user, via a uniform presentation such that a user enjoys a similar experience, regardless of which Certificate Authority the user interacts with. Next, the user can select a desired plan for purchase, with a purchase request/response pair 422(a) & 422 (b) exchanged between the Certificate Authority 404 and the end user machine(s) 402. Likewise, a set of queries and responses (not shown) can be exchanged between the Certificate Authority 404 and the end user machine(s) 402 to request updates of the initial certificate and to reflect revised data associated with the user, for example, changing the contact information for the owner of the certificate, address/name of the hosting server, type of service (e.g., so that the certificate is not only valid for web presence but also for secure e-mail) and the like. Additionally, the certificate itself can be revoked from being used via the update mechanism. The purchase and update components can also include a mechanism for the end user machines to authenticate themselves with the Certificate Authority. An exemplary XML schema for such procedure via the update component, (as well as for the purchasing component described supra) is presented as part of appendix A—infra.
The DBMS 580 and the database (not shown) can be located in the Certificate Authority itself, or can be located remotely on a remote database server (not shown). Running on the Web server 560 can be a Certificate Authority (CA) interface Applications Programming Interface (API) 570, which provides access to the DBMS 580. The end user device 520 and the Certificate Authority 550 can communicate with each other through a network 590, (e.g., the Internet). When the client process, e.g., the Web browser 510, requests a query of service plans from the Certificate Authority, the script or application 530 can issue a query, which is sent across the network (e.g., Internet) 590 to Certificate Authority side 550, where it is interpreted, by the Web server 560. The end user's 520 request to the Certificate Authority side 550 can contain multiple commands, and a response from the Certificate Authority 550 can return a plurality of service plan options. The received response can then be displayed to a user, via a uniform presentation such that a user enjoys a similar experience, regardless of which Certificate Authority the user interacts with. The invention thus facilitates initial server configurations (e.g., presence of small businesses on the Internet), and on-going maintenance, wherein employing multi vendor components are simplified by using a unified and common message structure.
While the exemplary method is illustrated and described herein as a series of blocks representative of various events and/or acts, the present invention is not limited by the illustrated ordering of such blocks. For instance, some acts or events may occur in different order and/or concurrently with other acts or events, apart from the ordering illustrated herein, in accordance with the invention. In addition, not all illustrated blocks, events or acts, may be required to implement a methodology in accordance with the present invention. Moreover, it will be appreciated that the exemplary method and other methods according to the invention may be implemented in association with the method illustrated and described herein, as well as in association with other systems and apparatus not illustrated or described.
Referring now to
The system bus can be any of several types of bus structure including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of commercially available bus architectures. The system memory may include read only memory (ROM) 924 and random access memory (RAM) 925. A basic input/output system (BIOS), containing the basic routines that help to transfer information between elements within the computer 920, such as during start-up, is stored in ROM 924.
The computer 920 further includes a hard disk drive 927, a magnetic disk drive 928, e.g., to read from or write to a removable disk 929, and an optical disk drive 930, e.g., for reading from or writing to a CD-ROM disk 931 or to read from or write to other optical media. The hard disk drive 927, magnetic disk drive 928, and optical disk drive 930 are connected to the system bus 923 by a hard disk drive interface 932, a magnetic disk drive interface 933, and an optical drive interface 934, respectively. The drives and their associated computer-readable media provide nonvolatile storage of data, data structures, computer-executable instructions, etc. for the computer 920. Although the description of computer-readable media above refers to a hard disk, a removable magnetic disk and a CD, it should be appreciated by those skilled in the art that other types of media which are readable by a computer, such as magnetic cassettes, flash memory cards, digital video disks, Bernoulli cartridges, and the like, can also be used in the exemplary operating environment, and further that any such media may contain computer-executable instructions for performing the methods of the subject invention.
A number of program modules can be stored in the drives and RAM 925, including an operating system 935, one or more application programs 936, other program modules 937, and program data 938. The operating system 935 in the illustrated computer can be substantially any commercially available operating system.
A user can enter commands and information into the computer 920 through a keyboard 940 and a pointing device, such as a mouse 942. Other input devices (not shown) can include a microphone, a joystick, a game pad, a satellite dish, a scanner, or the like. These and other input devices are often connected to the processing unit 921 through a serial port interface 946 that is coupled to the system bus, but may be connected by other interfaces, such as a parallel port, a game port, a universal serial bus (USB) or a 1394 firewire. A monitor 947 or other type of display device is also connected to the system bus 923 via an interface, such as a video adapter 948. In addition to the monitor, computers typically include other peripheral output devices (not shown), such as speakers and printers.
The computer 920 can operate in a networked environment using logical connections to one or more remote computers, such as a remote computer 949. The remote computer 949 may be a workstation, a server computer, a router, a peer device or other common network node, and typically includes many or all of the elements described relative to the computer 920, although only a memory storage device 950 is illustrated in
When employed in a LAN networking environment, the computer 920 can be connected to the local network 951 through a network interface or adapter 953. When utilized in a WAN networking environment, the computer 920 generally can include a modem 954, and/or is connected to a communications server on the LAN, and/or has other means for establishing communications over the wide area network 952, such as the Internet. The modem 954, which can be internal or external, can be connected to the system bus 923 via the serial port interface 946. In a networked environment, program modules depicted relative to the computer 920, or portions thereof, can be stored in the remote memory storage device. It will be appreciated that the network connections shown are exemplary, and other means of establishing a communications link between the computers can be employed.
In accordance with the practices of persons skilled in the art of computer programming, the subject invention has been described with reference to acts and symbolic representations of operations that are performed by a computer, such as the computer 920, unless otherwise indicated. Such acts and operations are sometimes referred to as being computer-executed. It will be appreciated that the acts and symbolically represented operations include the manipulation by the processing unit 921 of electrical signals representing data bits which causes a resulting transformation or reduction of the electrical signal representation, and the maintenance of data bits at memory locations in the memory system (including the system memory 922, hard drive 927, floppy disks 928, and CD-ROM 931) to thereby reconfigure or otherwise alter the computer system's operation, as well as other processing of signals. The memory locations wherein such data bits are maintained are physical locations that have particular electrical, magnetic, or optical properties corresponding to the data bits.
Referring now to
A sample XML schema that provides an example for the various components according to the subject invention is provided infra, as part of appendix A, and this appendix is to be considered part of this specification describing the invention.
Moreover, although the invention has been shown and described with respect to certain illustrated aspects, it will be appreciated that equivalent alterations and modifications will occur to others skilled in the art upon the reading and understanding of this specification and the annexed drawings. In particular regard to the various functions performed by the above described components (assemblies, devices, circuits, systems, etc.), the terms (including a reference to a “means”) used to describe such components are intended to correspond, unless otherwise indicated, to any component which performs the specified function of the described component (e.g., that is functionally equivalent), even though not structurally equivalent to the disclosed structure, which performs the function in the herein illustrated exemplary aspects of the invention. In this regard, it will also be recognized that the invention includes a system as well as a computer-readable medium having computer-executable instructions for performing the acts and/or events of the various methods of the invention. Furthermore, to the extent that the terms “includes”, “including”, “has”, “having”, and variants thereof are used in either the detailed description or the claims, these terms are intended to be inclusive in a manner similar to the term “comprising.”
