Public Key Infrastructure based on the Public Certificates Ledger

Abstract

Systems and methods for managing public key certificates and supporting the users thereof. The certificates are cryptographically encapsulated objects that bind the identities of their owners to public keys and provide digital signature mechanisms for other users to verify the binding and correctness of other attributes of the certificate. Certificates include double links that reflect their validation and position in a public certificates ledger, thereby preventing insertion or removal of certificates in the ledger. Certificate protocols of the system include requesting issuance of certificates, issuing and returning certificates to their requesting users, storing certificates in the certificates ledger, requesting and distributing certificates to transaction partners, verification of certificates by transaction partners, and revoking certificates by their owners. These protocols are performed as direct peer-to-peer transactions between the members of the system.

We claim: 
     
         1 . A cryptographically signed object containing the set of attributes, called a BIX certificate, whose purposes are to bind the public key of a public/private cryptographic keys pair to the identity of its owner and to provide the mechanism for verifying that binding based on use of peer-to-peer protocols and public ledger. An instance of a BIX certificate contains values of attributes identifying the owner of the certificate, its issuer, public key belonging to the owner ,and cryptographic parameters for verification of the certificate. 
     
     
         2 . The set of attributes of the BIX certificate from  claim 1 , called Header, that identifies the certificate, containing attributes: the sequence number of the BIX certificate, its version, and issuing date/time. The value of the sequence number attribute is the sequence number of the BIX certificate in the BIX Certificates Ledger. This segment may also contain other attributes identifying the certificate or its type. 
     
     
         3 . The cryptographically signed set of attributes of the BIX certificate from  claim 1 , called Subject, that identifies the owner of the certificate, containing attributes: the identification number of the certificate owner in the BIX system, the date and time when the certificate was issued, the identifier of the cryptographic algorithm that was used to sign it, and the public key belonging to the owner of the certificate. All attributes of the Subject segment are signed with the private key that corresponds to the public key included in that segment. 
     
     
         4 . The cryptographically signed set of attributes of the BIX certificate from  claim 1 , called Issuer, that identifies the entity that issued the certificate, containing the attributes: the identification number of the BIX system member who issued the BIX certificate, the date and time when the certificate was issued, the identifier of the cryptographic algorithm that was used to sign it, and the public key of the issuer of the certificate. All attributes of the Issuer segment are digitally signed with the private key that corresponds to the public key included in that segment. 
     
     
         5 . The cryptographically signed set of attributes of the BIX certificate from  claim 1 , called Next Subject, that identify the entity whose certificate has been issued by the owner of the certificate, containing attributes: the identification number of the BIX system member whose certificate was issued by the owner of the BIX certificate, the date and time when the certificate of the next BIX member was issued, the identifier of the cryptographic algorithm that was used to sign the Next Subject segment, and the public key of the owner of the next certificate in the BIX Certificates Ledger. All attributes of the Next Subject segment are digitally signed with the private key that corresponds to the public key included in the Next Subject segment. 
     
     
         6 . Two cross signature attributes of the BIX certificate from  claim 1 : 1) the Backward Cross Signature, contains digital signatures over concatenated hashes of the Header, Subject, and Issuer segments, created by the issuer and the owner of the BIX certificate, and 2) the Forward Cross Signature, contains signatures over concatenated hashes of the Header, Subject, and Next Subject segments, created by the owner of the BIX certificate and the owner of the next BIX certificate in the certificates ledger. 
     
     
         7 . The Extensions segment of the BIX certificate from  claim 1 , which is extendible collection of attributes, each designating some special aspect, type, or purpose of the BIX certificate. 
     
     
         8 . The private key object that corresponds to the public key included in the BIX certificate from  claim 1 , which does not exist in the system, but it is generated when needed, by a deterministic procedure using fixed seed value, representing user login or any other parameter supplied by the user. 
     
     
         9 . BIX Certificates Ledger, a linear, double-linked list of BIX certificates without branches. The ledger is global, distributed, synchronized, append-only public storage of certificates. 
     
     
         10 . The special BIX certificate included in the BIX Certificates Ledger of  claim 9 , called the Root Certificate, whose Subject segment is the same as its Issuer segment, i.e., the certificate is self-signed. The Backward Cross Signature attribute of this certificate is not populated. The Root Certificate represents the head of the BIX Certificates Ledger. 
     
     
         11 . The BIX certificates included in the BIX Certificates Ledger of  claim 9  belonging to BIX members who have already issued certificates to their next BIX member. These certificates have all their segments and attributes populated and they are located in the middle section of the BIX Certificates Ledger, between the Root Certificate and the “tail” BIX certificate. 
     
     
         12 . The BIX certificate included in the BIX Certificates Ledger of  claim 9  belonging to the BIX member who last joined the BIX system and has not yet issued a certificate to the next BIX member. The Next Subject segment of this certificate is not populated. This certificate is located at the end of the BIX Certificates Ledger, representing the “tail” BIX certificate. 
     
     
         13 . The BIX Certificates Infrastructure, which is collection of software components and protocols, each with a special function and special purpose that, when combined, perform the BIX certification protocols. 
     
     
         14 . The BIX Certificates Ledger, which is the component of the BIX Certificates Infrastructure of  claim 13  that stores and distributes the objects of the BIX Certificates Infrastructure, that is, BIX certificates in the form of a double-linked list. 
     
     
         15 . The BIX Identities System, which is the component of the BIX Certificates Infrastructure of  claim 13  that registers entities, validates, protects, and distributes identities of BIX members and provides cryptographic mechanisms for their verification by other members of the BIX system. 
     
     
         16 . The BIX Synchronization System, which is the component of the BIX Certificates Infrastructure of  claim 13  which performs (a) global synchronization of random numbers used as personal identification numbers for their global uniqueness within the entire BIX Certificates Infrastructure, (b) synchronization of the global Coordinated Universal Time (UTC), and (c) synchronization of newly issued certificates providing globally synchronized unique state of the entire BIX Certificates Ledger. 
     
     
         17 . The BIX Certificates Infrastructure Agent, which is the component of the BIX Certificates Infrastructure of  claim 13  used by BIX members, implemented as a PC, Web, smart card, smart chip or mobile phone application to use the services of the BIX Certificates Infrastructure. 
     
     
         18 . The BIX Certificates Protocols, which are used by BIX members to manage BIX certificates using the BIX Certificates Ledger. 
     
     
         19 . The Certification Request/Response protocol of  claim 18 , which is used by new BIX members who want to join the BIX system by sending their Certification Requests to the certificate-issuing BIX member and receiving their BIX certificates. 
     
     
         20 . The Certificate Verification protocol of  claim 18 , used by new BIX members upon receiving their newly issued certificates to verify the correctness of their new certificates. 
     
     
         21 . The Certificate Request/Response protocol of  claim 18 , which is used by members of the BIX system to request and receive the BIX certificate of their transaction partners directly from the transaction partners. 
     
     
         22 . The Certificate Ledger Request/Response protocol of  claim 18 , which is used by members of the BIX system to request and receive the BIX certificate of their transaction partners from the BIX Certificates Ledger. BIX Certificates Ledger is indexed database, so the read is direct fetch operation without search.