Patent Application
20110161662
1. Technical Field
Embodiments of the present disclosure relate to digital signature technology, and particularly to a system and method for updating a digital certificate automatically.
2. Description of Related Art
A digital signature uses a digital certificate to encrypt and decrypt electronic documents. The digital certificate includes various information, such as a public key, a private key, signer information, or a period of validity of the digital certificate, for example. The various information of the digital certificate are issued by an authoritative third-party organization, such as a certificate authority (CA) server. However, the digital certificate has to be updated manually if the period of validity of the digital certificate elapses or is about to elapse within a predefined time period.
What is needed, therefore, is a system and method to overcome the aforementioned problem.
All of the processes described below may be embodied in, and fully automated by, functional code modules executed by one or more general purpose computers or processors. The code modules may be stored in any type of readable medium or other storage device. Some or all of the methods may alternatively be embodied in specialized hardware. Depending on the embodiment, the readable medium may be a hard disk drive, a compact disc, a digital video disc, or a tape drive.
In some embodiments, the system 2 may include a plurality of client computers 10 and a certificate authority (CA) server 20. Each of the plurality of client computers 10 is electronically connected to the CA server 20 through a network 30. Depending on the embodiment, the network 30 may be an intranet, the Internet or other suitable communication networks.
In some embodiments, the modules 101-104 comprise one or more computerized instructions that are stored in the first storage system 105, and the modules 201-203 comprise one or more computerized instructions that are stored in the second storage system 204. A processor 106 of the client computer 10 executes the computerized instructions to implement one or more operations of the client computer 10, and a processor 205 of the CA server 20 executes the computerized instructions to implement one or more operations of the CA server 20. Detailed descriptions of the function of each of the plurality of modules 101-104 and 201-203 are given in
In block S1, the prompting module 101 prompts a user to update a current digital certificate stored in the first storage system 105 of the client computer 10 if a period of validity of the current digital certificate elapses or is about to elapse within a predefined time period (e.g., two days). In some embodiments, the prompting module 101 determines that the period of validity of the current digital certificate is about to elapse two days before the expiration time of the current digital certificate. In some embodiments, the prompting module 101 prompts the user to update the current digital certificate by outputting an alarm message on a display of the client computer 10.
In block S2, the prompting module 101 determines if the current digital certificate needs to be updated according to a selection of the user. If the current digital certificate does not need to be updated, the procedure goes to block S3. If the current digital certificate needs to be updated, the procedure goes to block S4.
In block S3, the client computer 10 allows the user to digitally sign electronic documents, or forbids the user to digitally sign electronic documents or files. For example, if the period of validity of the current digital certificate does not elapse, the client computer 10 allows the user to digitally sign electronic documents. If the period of validity of the current digital certificate elapses, the client computer 10 forbids the user to digitally sign electronic documents.
In block S4, the signing module 102 signs a thumbprint of the current digital certificate digitally to obtain signed data, and sends the signed data to the CA server 20 through the network 30. In some embodiments, the signed data may include signed keys and a thumbprint of the current digital certificate. The signed keys may include a public key of the current digital certificate. In some embodiments, the thumbprint of the current digital certificate may be a hash value to ensure that the certificate has not been tampered with by unauthorized users.
In block S5, the extraction module 201 extracts the signed keys and the thumbprint of the current digital certificate from the signed data. Then, the creation module 202 verifies an identity of the user according to the extracted signed keys and the thumbprint.
In block S6, the creation module 202 determines if the identity of the user is valid. In some embodiments, if the extracted signed keys and the thumbprint are the same as backup signed keys and thumbprint of a backup digital certificate stored in the second storage system 204 of the CA server 20, the creation module 202 determines that the identity of the user is valid, and then the procedure goes to block S7. If the extracted signed keys or the thumbprint are not the same as the backup signed keys or thumbprint of the backup digital certificate stored in the second storage system 204 of the CA server 20, the creation module 202 determines that the identity of the user is not valid, and then the procedure ends.
In block S7, the creation module 202 creates a new digital certificate. Then, the encrypting module 203 encrypts the new digital certificate according to a public key in the extracted signed keys, and sends the encrypted new digital certificate to the client computer 10 through the network 30. In some embodiments, the encrypting module 203 encrypts the new digital certificate according to the public key in the extracted signed keys by using a data encryption standard (DES) algorithm.
In block S8, the decrypting module 103 decrypts the encrypted new digital certificate according to a private key of the current digital certificate to obtain the new digital certificate.
In block S9, the updating module 104 deletes the current digital certificate, and loads the new digital certificate into the first storage system 105.
In other embodiment, the client computer 10 and the CA server 20 may be combined to form an application server or other suitable computing devices. Then, the application server accomplishes all of the tasks executed by the client computer 10 and the CA server 20.
It should be emphasized that the above-described embodiments of the present disclosure, particularly, any embodiments, are merely possible examples of implementations, merely set forth for a clear understanding of the principles of the disclosure. Many variations and modifications may be made to the above-described embodiment(s) of the disclosure without departing substantially from the spirit and principles of the disclosure. All such modifications and variations are intended to be included herein within the scope of this disclosure and the present disclosure and protected by the following claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 200910312805.9 | Dec 2009 | CN | national |
