초록 ▼

A system for securely using digital signatures in a commercial cryptographic system that allows industry-wide security policy and authorization information to be encoded into the signatures and certificates by employing attribute certificates to enforce policy and authorization requirements. In addi

A system for securely using digital signatures in a commercial cryptographic system that allows industry-wide security policy and authorization information to be encoded into the signatures and certificates by employing attribute certificates to enforce policy and authorization requirements. In addition to value limits, cosignature requirements and document type restrictions that can be placed on transactions, an organization can enforce with respect to any transaction geographical and temporal controls, age-of-signature limitations, preapproved counterparty limitations and confirm-to requirements by using attribute certificates for the transacting user. Restrictions on distribution of certificates can be set using attribute certificates. Certificates can be used also to ensure key confinement and non-decryption requirements of smartcards in this system.

대표청구항 ▼

A method of enforcing a policy in a cryptographic communication system comprising the steps of: receiving a digital user transaction including a digital message and attribute data, and a digital user signature based on said digital message and on a private key of a user; receiving a digital identify

A method of enforcing a policy in a cryptographic communication system comprising the steps of: receiving a digital user transaction including a digital message and attribute data, and a digital user signature based on said digital message and on a private key of a user; receiving a digital identifying certificate issued by a certifying authority and having a plurality of digital fields, at least one of said fields identifying said user; receiving a digital authorizing certificate, separate from said identifying certificate and issued by a sponsor of said user, and authorizing transactions by said user, said authorizing certificate containing rules specifying conditions under which said digital transaction is valid, said rules to be applied to said attribute data; verifying said transaction based on information in said identifying certificate and in said authorizing certificate, said step of verifying including applying said rules to said attribute data in order to verify that said transaction is valid; and accepting said transaction based on said outcome of said verifying, wherein said attribute data includes a timestamp indicating when said transaction was formed and wherein said rules specify allowed times at which transactions can be formed and wherein said step of verifying includes a step of determining whether said timestamp indicates one of said specified allowed times, and wherein said allowed times are certain days of the week, and wherein said step of verifying includes a step of determining whether said timestamp indicates that said transaction was formed on one of said certain days of the week.