Hierarchical storage systems for holding evidentiary objects and methods of creating and operating upon hierarchical storage systems

[0002] This application claims priority from U.S. Provisional Application Serial No. 60/143,662, filed Jul. 13, 1999, the disclosure of which is incorporated by reference herein.

[0003] This invention relates generally to cryptography and, more particularly, to methods and systems for managing electronic information that can be used for verification and authentication such as digital certificates.

[0004] Cryptography provides a set of techniques for encoding data and messages such that the data and messages can be stored and transmitted securely. Cryptography can be used to achieve secure communications, even when the transmission media (for example, the Internet) is untrustworthy. Using cryptography, it becomes possible to verify the authenticity and origin of data and messages using evidentiary information such as digital signatures and digital certificates. Management of such evidentiary information can pose significant challenges particularly when the volume of such information becomes large, as will become apparent below. Before discussing problems associated with management of evidentiary information, however, some background information on cryptography in general will be useful in understanding how and where the inventive methods and systems fit.

[0005] One aspect of cryptography makes use of so-called public and private key pairs. The key pairs are mathematically related, e.g, derived from extremely large prime numbers, such that it is computationally infeasible to derive one key from the other. In public key cryptography, the public key is made public while the private key is kept private. The private key typically never leaves the machine on which it was generated. Accordingly, when using public key cryptography, the only component that must remain secret is the private key. In public key cryptography, information that is encrypted with one of the public or private keys can only be decrypted with the other of the public or private keys.

[0006] FIG. 1 illustrates a computer network that makes use of public and private keys. In the illustrated example, there are two users—Alice and Bob, that desire to send protected messages to one another. If Bob wishes to send Alice a secure email message, he can encrypt the email message with Alice's public key. When Alice receives the message, she can decrypt it using her private key. Bob should have access to Alice's public key because, after all, it is public. If, on the other hand, Alice wishes to send a secure email response to Bob, she can simply encrypt the email message with Bob's public key and send it to Bob. Since only Bob's private key can decrypt messages encrypted with Bob's public key, Alice can be assured that the message is private between her and Bob. In addition to providing privacy, public key cryptography can be used to provide integrity. The notion of a digital signature can be used to sign documents and software.

[0007] FIG. 2 illustrates a computer network in which a digital signature is utilized. A digital signature can be produced by passing a file, such as an email message, through a specific one-way hashing algorithm. The hashing algorithm produces a much smaller bit stream, e.g. 128-bits or 160-bits, often termed a message digest. The message digest is a unique value that acts as a fingerprint for the file. Because of the nature of the hashing algorithms, a one-bit change in the message can produce a change in roughly one half of the bits in the message digest. This helps to ensure that the recipient receives the actual file that was sent, and not a modified or altered version as will become apparent below. Once a message digest is created, it can be encrypted using the signer's private key and attached to the file when it is sent. Thus, in this example, Bob can produce a hash of his email message to Alice to provide a message digest, encrypt the message digest with his private key, and attach the encrypted message digest to the email message as his digital signature. To verify the integrity of the file, the application opening the file on Alice's end, e.g. Alice's email program, first uses the same hashing algorithm to produce her own message digest of the file. The application then decrypts the signature attached to the file by using Bob's public key to recover the original message digest produced when the file was originally signed. The two message digests are then compared by Alice's software. If any part of the message digests do not match identically, then the contents of the file have been modified or corrupted and cannot be trusted.

[0008] FIG. 3 illustrates a computer system in which a session key is used. A session key can be thought of as a secret that is “shared” between Alice and Bob.

[0009] Specifically, Bob can create a session key and use it to encrypt his email message to Alice. After Bob encrypts the email message with the session key, he can encrypt the session key with Alice's public key and transmit it to Alice. Alice can then decrypt the session key using her private key. With the decrypted session key, Alice can now decrypt the encrypted email message, run the hash to produce the message digest, and process it as described above.

[0010] One problem with the above scenario stems from the fact that someone, other than Bob, could conceivably masquerade as Bob by fraudulently holding out a public key that is represented to be “Bob's public key”. Any messages that are intended for Bob and encrypted with the fraudulent public key, could conceivably then be decrypted with the accompanying private key by a person other than Bob. This person would then have access to information that was intended by the sender only for Bob. To address this, as well as other situations, the notion of a digital certificate is used. Digital certificates can be used both to ensure that Bob's public key is, in fact, his public key, and to a lesser degree, to ensure that Bob's private key has not been compromised.

[0011] A digital certificate can be thought of as an electronic counterpart of an ID card, such as a driver's license or passport. The validity of a digital certificate is based on systems similar to those used to issue physical ID cards. Specifically, information, e.g. information from and about Bob, is provided to a trusted public body called a certification authority, such as VeriSign, Inc. The certification authority validates the information and then issues a digital certificate. The digital certificate contains information about who the certificate was issued to, as well as the certification authority that issued it. For example, the digital certificate can contain Bob's email address, and the company and division he works for, etc. The certificate also contains Bob's public key. In addition, the certificate contains a digest of the certificate's contents that is signed with the private key of the certification authority to ensure that the certificate has not been altered or forged. That is, the certification authority first creates a hash of the certificate contents, and then encrypts the hash with its private key. Any application having the public key of the certification authority can decrypt the digest and check it against their own hash. If the digests match up, then the certificate can be trusted. If the digests do not match up, then the certificate cannot be trusted. When it comes to certificates, trust is very important. In the above example, Alice and Bob must both trust the certification authority that issues the certificates.

[0012] Certification authorities can have their own certificates that can be used to validate that anything signed by the certification authority is, in fact, authentic. To do this, so-called self-signed certificates are used. Self-signed certificates, also referred to as “root certificates”, are issued and signed by certification authorities. Thus, the self-signed certificates must be trusted as being valid. Additionally, some certification authorities may themselves be certified by a hierarchy of one or more certification authorities. When a digital certificate is used to sign documents and software, this information is stored with the signed item in a verifiable form so that it can be displayed to a user to establish a trust relationship.

[0013] FIG. 4 illustrates one process for initially receiving a digital certificate. To begin with, an individual's software generates a public-private key pair. A certificate request containing the public key and signed with the user's private key is then sent to a certification authority or certificate server. The private key is maintained on the individual's machine. After a validation process in which the individual must prove that they are who they claim to be, the certification authority issues a digital certificate. The digital certificate has contents that include user information, public key, an encrypted certificate digest, and an identification of the certification authority that issued the certificate. The digital certificate is then stored by the individual's software and can then be made public.

[0014] When an individual such as Alice wishes to send Bob a message that is encrypted with Bob's public key, she can do so by using Bob's certificate (which contains his public key). Alice, or more accurately Alice's software, should first confirm that Bob's certificate, and hence public key, is valid. To do this, Alice must first get a copy of Bob's certificate. This can be done by having Bob send his certificate to Alice via email, through HTTP, or any suitable way. Alice can then store Bob's certificate in her personal store for future use. Once she has the certificate, as shown in FIG. 5, the first thing that Alice's software does is to look inside Bob's certificate to ascertain the certification authority that signed the certificate. Alice's software then decrypts the certificate digest using the certification authority's public key. So, for example, assume that VeriSign issues Bob's certificate. If Alice is using Microsoft's Internet Explorer (IE), IE can look inside Bob's certificate and ascertain that VeriSign issued it. IE can then check to see whether it has VeriSign's certificate loaded. If it does, then it can simply use VeriSign's public key to decrypt the certificate digest. Alice's software then makes its own digest of Bob's certificate using the same hash function that VeriSign used and compares the two digests. If the digests are the same, then Alice knows that (1) noone has tampered with the contents of the certificates, and (2) that the certifying authority (e.g. VeriSign) issued that certificate. Additionally, Alice's software can check to ensure that Bob's certificate has not expired by checking the expiration date of the certificate. Further, Alice's software can make an additional check of a so-called certificate revocation list (CRL). A CRL is simply a list of certificates that have been revoked. A certificate can be revoked, for example, if Bob's private key gets compromised on his machine. There are also so-called certificate trust lists (CTLs). CTLs are simply lists of trusted entities. As used in this document, the term “certificate”0 will be understood to include, without limitation, certificates, CRLs, and CTLs. Once Alice's software has ascertained that Bob's public key is valid, Alice can then use the public key to encrypt messages to Bob.

[0015] Many entities, other than individual users such as Alice and Bob can have certificates. For example, a web server can have a certificate. Web server certificates can be used by browsers for Secure Socket Layer (SSL) communication. That is, when a browser connects to a web server (e.g. to make an online purchase), it can use the web server's certificate to authenticate that the web server is, in fact, who it says it is. A browser or a browser user can have a client authentication certificate. These certificates can be used to verify that the clients are who they say they are. Certificate chains are also possible. For example, VeriSign can issue a certificate to Foo Corporation. Foo Corporation can, in turn, issue certificates to its various departments. The individual departments can then issue certificates to its various employees. An advantage of certificate chains is that all of the entities can verify with VeriSign that the certificates are valid.

[0016] As one can imagine, a user site can, over time, collect many certificates. Typically, a site has certificates for the user of the site, and other certificates describing those individuals and entities with whom the user communicates. For each entity, there can be more than one certificate. For each individual certificate, there should be a chain of verifying certificates that provides a trail back to a trusted root certificate. As the number of certificates, CRLs, and CTLs in a user's collection grows, the organization of those certificates becomes an issue. In the past, separate stores have typically been created to keep different kinds of certificates. For example, and as shown in FIG. 6, there might be separate stores for root certificates, certifying authority certificates, and user certificates. This solution creates a problem because an application might need to search several different stores to find a specific certificate. This can create processing complexities because of the number of places an application might have to look. For example, an application might go to a first store, open it and enumerate all of the certificates. If the certificate of interest is not found, the application might proceed to a second store and repeat the process. The application might have to repeat this process many times before finding the certificate of interest.

[0017] FIG. 7 illustrates this process for three different physical stores each of which contains a plurality of certificates. Assume that the rightmost certificate (shaded for clarity) is the certificate of interest for an application. In order to find that particular certificate, the application might first have to separately check each of the first two physical stores. Only when the application checks the last store will it find the certificate of interest. This problem is only compounded as the number of physical stores increases. Having an application separately access each physical store, enumerate the contents, check the contents for the certificate of interest, and proceed to the next physical store if the certificate of interest is not found is not an efficient use of an application's resources.

[0018] Another problem concerns duplicative stores and the inability to share information between stores. Specifically, each user will typically have their own stores to store certificates of interest. Each user's stores can include a root store for holding root certificates, a certification authority store for holding the certificates of the certification authorities, and an individual store for holding an individual's selected certificates. Each individual is typically responsible for maintaining their own store or stores. So, for example, each individual has to manage and physically oversee which certificates are placed into their particular stores. This can result in duplication of effort, particularly when different users might want to trust the same root certificates, i.e. maintain the same certificates in their stores. Moreover, memory resources can be undesirably consumed when the same certificates are held in a number of different stores.

[0019] Another problem that is associated with certificate stores is the inability of the stores to flexibly meet the needs of its users. Such needs might include the ability to create user-defined stores, manipulate the contents of the stores and the stores themselves, and establish relationships between the stores that improve the economics of store utilization. Specifically, certificate stores are typically isolated stores that might be located on a local machine. These stores do not have contact with, nor are they associated with other stores that might be present on the same local machine. This is not desirable particularly in view of trying to optimize computing resources.

[0020] Accordingly, this invention arose out of concerns associated with providing improved methods, systems, and architectures for creating and managing hierarchical storage systems for holding evidentiary objects such as digital certificates.

[0021] Hierarchical storage systems for holding objects such as digital certificates that are used for evidentiary purposes, and methods of manipulating such systems are described.

[0022] In the described embodiment, a logical store is provided or defined and one or more physical stores are associated with and accessible through the logical store. The physical stores can be located on the same machine or across machine boundaries. Access to the physical stores can take place through the logical store with a single application program call to an appropriate application programming interface. In addition, physical or logical stores can be grouped into collection stores in which an operation on one store of the collection is carried through to all of the physical or logical stores of the collection store.

[0023] In another aspect, logical and physical stores are configurable and thus, can be defined and manipulated by a user. For example, in one implementation application programming interfaces are provided that enable a user to operate upon both logical and physical stores. A user, through an application program, can register (add) and unregister (remove) both logical and physical stores, as well as build associations within and amongst the stores. These buildable associations can promote economies, such as sharing, between the stores.

[0024] One particular type of association is a context link. A context link enables one evidentiary object in one physical store to get its context from another evidentiary object in another physical store. This obviates the need to keep many different physical copies of the same evidentiary object in many different physical stores. Thus, memory resources are used more efficiently.

[0025] FIG. 1 is a diagram that gives some background information on the use of public and private key pairs.

[0026] FIG. 2 is a diagram that gives some background information on the use of public and private key pairs.

[0027] FIG. 3 is a diagram that gives some background information on the use of public and private key pairs.

[0028] FIG. 4 is a diagram that gives some background information on evidentiary objects in the form of digital certificates.

[0029] FIG. 5 is a diagram that gives some background information on the use of digital certificates and public and private key pairs.

[0030] FIG. 6 is a diagram that describes three exemplary certificate stores for different types of digital certificates.

[0031] FIG. 7 is a diagram that illustrates an application program accessing physical stores in accordance with the prior art.

[0032] FIG. 8 is a diagram of an exemplary computer system that can be used to implement various embodiments of the invention.

[0033] FIG. 9 is a diagram of an exemplary hierarchical storage system.

[0034] FIG. 10 is a diagram that illustrates exemplary ways in which a hierarchical 11 storage system can be manipulated by a user.

[0035] FIG. 11 is a diagram that illustrates exemplary ways in which a hierarchical storage system can be manipulated by a user.

[0036] FIG. 12 is a diagram that is useful in understanding one aspect of the invention.

[0037] FIG. 13 is a flow diagram that describes a method in accordance with one embodiment of the invention.

[0038] FIG. 14 is a diagram that illustrates architectural aspects of an embodiment of the invention.

[0039] FIG. 15 is a diagram that illustrates architectural aspects of an embodiment of the invention.

[0040] FIG. 16 is a diagram that illustrates architectural aspects of an embodiment of the invention.

[0041] FIG. 17 is a flow diagram that describes steps in a method in accordance with one embodiment of the invention.

[0042] Overview

[0043] Aspects of the invention provide hierarchical storage methods and systems for holding objects that can be used for evidentiary purposes. In the described embodiment, the evidentiary objects comprise digital certificates. It is to be understood, however, that the principles of invention could be utilized in connection with evidentiary objects other than digital certificates. Such other objects can include, without limitation, any form or format of data that is capable of being stored and used for evidentiary purposes such as authentication. One 11 specific type of object is a biometric object. Biometric objects can include fingerprint, facial, and voice templates that can be used for authentication purposes.

[0044] The described approach presents various organizations of digital certificate stores and techniques of operating upon and manipulating the stores that greatly facilitate their use in maintaining, organizing and overseeing the management of digital certificates. Rather than having separate certificate stores that each require separate operations to be invoked by an application program, the capability is provided to unite or associate one or more physical stores together. In this manner, operations that are performed on one store can automatically be performed on another store, e.g. an enumeration operation that enumerates all of the certificates in a store now can enumerate all of the certificates in all of the associated stores. In the described embodiment, the concept of a “logical store” is utilized to unite or associate a number of different physical stores together. Access to all of the underlying physical stores now occurs through the logical store, rather than separately through each independent physical store. Thus, applications can now operate only on the logical store and thereby operate on all of the associated physical stores underlying the logical store.

[0045] Flexibility is also provided in that a user can create their own hierarchies of logical and physical stores, or modify stores that are already in existence. In the described embodiment, such flexibility is embodied in a set of application programming interfaces that allow a user to register, unregister, and perform many other operations on physical and/or logical stores. Thus, a user can adapt a logical or physical store to meet their own unique needs. Logical stores can also have associated predefined physical stores that assist a user in organizing digital certificates.

[0046] Economies can be achieved through the promotion of sharing amongst various certificate stores. For example, physical stores can belong to more than one logical store. In this manner, certificate resources can be shared among logical stores. In addition, the concept of a “collection store” is used to group two or more physical or logical stores together. Collection stores can be separate from or incorporated into one or more logical stores. Economies can also be achieved through the use of so-called “context links”. A context link enables individual certificates to be included in more than one physical store without the need to physically copy the certificate into the other stores. This can save memory resources particularly when the size and/or numbers of affected certificates is large.

[0047] Accordingly, aspects of the inventive methods and systems provide a robust, flexible, and configurable approach to solving many of the problems previously associated with certificate stores.

[0048] Exemplary Computer System

[0049] Preliminarily, FIG. 8 shows a general example of a computer 130 that can be used in accordance with the invention. Various numbers of computers such as that shown can be used in the context of a distributed computing environment. In this document, computers are also referred to as “machines”.

[0050] Computer 130 includes one or more processors or processing units 132, a system memory 134, and a bus 136 that couples various system components including the system memory 134 to processors 132. The bus 136 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. The system memory 134 includes read only memory (ROM) 138 and random access memory (RAM) 140. A basic input/output system (BIOS) 142, containing the basic routines that help to transfer information between elements within computer 130, such as during start-up, is stored in ROM 138.

[0051] Computer 130 further includes a hard disk drive 144 for reading from and writing to a hard disk (not shown), a magnetic disk drive 146 for reading from and writing to a removable magnetic disk 148, and an optical disk drive 150 for reading from or writing to a removable optical disk 152 such as a CD ROM or other optical media. The hard disk drive 144, magnetic disk drive 146, and optical disk drive 150 are connected to the bus 136 by an SCSI interface 154 or some other appropriate interface. The drives and their associated computer-readable media provide nonvolatile storage of computer-readable instructions, data structures, program modules and other data for computer 130. Although the exemplary environment described herein employs a hard disk, a removable magnetic disk 148 and a removable optical disk 152, it should be appreciated by those skilled in the art that other types of computer-readable media which can store data that is accessible by a computer, such as magnetic cassettes, flash memory cards, digital video disks, random access memories (RAMs), read only memories (ROMs), and the like, may also be used in the exemplary operating environment.

[0052] A number of program modules may be stored on the hard disk 144, magnetic disk 148, optical disk 152, ROM 138, or RAM 140, including an operating system 158, one or more application programs 160, other program modules 162, and program data 164. A user may enter commands and information into computer 130 through input devices such as a keyboard 166 and a pointing device 168. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner, or the like. These and other input devices are connected to the processing unit 132 through an interface 170 that is coupled to the bus 136. A monitor 172 or other type of display device is also connected to the bus 136 via an interface, such as a video adapter 174. In addition to the monitor, personal computers typically include other peripheral output devices (not shown) such as speakers and printers.

[0053] Computer 130 commonly operates in a networked environment using logical connections to one or more remote computers, such as a remote computer 176. The remote computer 176 may be another personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to computer 130, although only a memory storage device 178 has been illustrated in FIG. 8. The logical connections depicted in FIG. 8 include a local area network (LAN) 180 and a wide area network (WAN) 182. Such networking environments are commonplace in offices, enterprise-wide computer networks, intranets, and the Internet.

[0054] When used in a LAN networking environment, computer 130 is connected to the local network 180 through a network interface or adapter 184. When used in a WAN networking environment, computer 130 typically includes a modem 186 or other means for establishing communications over the wide area network 182, such as the Internet. The modem 186, which may be internal or external, is connected to the bus 136 via a serial port interface 156. In a networked environment, program modules depicted relative to the personal computer 130, or portions thereof, may be stored in the remote memory storage device. It will be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers may be used.

[0055] Generally, the data processors of computer 130 are programmed by means of instructions stored at different times in the various computer-readable storage media of the computer. Programs and operating systems are typically distributed, for example, on floppy disks or CD-ROMs. From there, they are installed or loaded into the secondary memory of a computer. At execution, they are loaded at least partially into the computer's primary electronic memory. The invention described herein includes these and other various types of computer-readable storage media when such media contain instructions or programs for implementing the steps described below in conjunction with a microprocessor or other data processor. The invention also includes the computer itself when programmed according to the methods and techniques described below.

[0056] For purposes of illustration, programs and other executable program components such as the operating system are illustrated herein as discrete blocks, although it is recognized that such programs and components reside at various times in different storage components of the computer, and are executed by the data processor(s) of the computer.

[0057] Exemplary Certificate Store Organization

[0058] FIG. 9 shows one possible organization of certificate stores in accordance with principles of the described embodiment generally at 10. It is to be appreciated that several different concepts have been combined in the illustrated example to underscore the flexibility that can be afforded by the described embodiment. The organization defines a hierarchical storage system. One aspect of the system that is particularly advantageous is that a user, through an application program, can build and configure their own hierarchies through one or more calls to a set of application programming interfaces that are described in more detail below.

[0059] In practice, any organization of certificate stores can have one or more logical stores. A logical or “virtual” store can be thought of as a central starting point for operating upon other stores that comprise constituent members of the logical store. A logical store can contain physical stores as well as other logical stores. In the described example, there are three logical stores 12(1), 12(2), and 14(3). Each logical store, in turn, can have one or more physical or logical stores associated with and accessible through the logical store. The physical stores are used to store evidentiary objects which, in this example, comprise digital certificates or context links. As will be discussed below in more detail, each logical store has a logical store provider that is associated with it. Logical store providers are software components that are programmed to receive calls from an application program and then take the steps that are necessary to operate upon the physical stores that are associated with the logical store. There can be different types of physical stores, e.g. registry stores, file system stores, and database stores.

[0060] In the described embodiment, each physical store has a physical store provider that is programmed to open or otherwise operate upon the physical store with which it is associated. The physical store providers are called by the logical store provider and, in turn, take appropriate steps to operate upon their associated physical store. As there can be different types of physical stores, each of the providers that are associated with these different types of stores is separately programmed to interface and interact with their type of store. This enhances the flexibility of the system.

[0061] Here, logical store 12(1) includes physical stores 14(1), 14(2), and 14(4). Logical store 12(1) also includes logical store 14(3) which, in turn, includes physical stores 14(5) and 14(6). Logical store 12(2) includes physical stores 14(6)-14(8). The physical stores can be located in many different physical locations. For example, physical stores can be located in the registry on a local or remote computer, a disk file, a database, directory service, a smart card, or any other suitable location. Each of the physical stores has one or more digital certificates that they hold. In the described example, the certificates are designated at 16(n), where “n” can be any number. In the described organization, physical stores can be members of more than one logical store. So, for example, physical store 14(6) is a member of logical stores 12(1), 14(3), and 12(2). When a logical store is opened by an application, all of the member physical stores can be opened as well. Thus, rather than having to go and individually open a plurality of different physical stores in order to operate on them, an application need only open one logical store to access all of its underlying physical stores.

[0062] Adding and Removing Logical and Physical Stores

[0063] One aspect of the invention allows a user to create their own hierarchical store system. This is achieved by allowing a user to add their own defined logical and physical stores. In one specific implementation, a set of application programming interfaces are provided that allow a user, through an application program, to add and remove logical and physical stores to either create their own hierarchy or modify an existing one.

[0064] FIG. 10 shows one example of how this might occur. There, logical store 12(3) has been defined to have certain predefined physical stores 14(9) and 14(10). The predefined physical stores can be located in any location as indicated above. Assume that a user wishes to add an additional physical or logical store to logical store 12(3). To do so, the user invokes an application programming interface that enables the user to specify a logical store, e.g. logical store 12(3) in which the new physical store is to be added, and to specify a physical or logical store—here physical or logical store 14(11). The specified physical or logical store 14(11) is then added to and becomes part of the specified logical store. Similarly, a user can remove physical or logical stores from various logical stores. To do so, the user invokes an application programming interface that enables the user to specify the logical store, e.g. logical store 12(3) in which the physical or logical store is to be removed and to specify the physical store—here physical store 14(9). The specified physical store 14(9) is then removed from the specified logical store. In this manner, a user has the flexibility to determine which physical stores and/or logical stores are members of their hierarchy.

[0065] Remote Stores

[0066] In the past, all of the certificate stores had to be created, opened and maintained on a local machine. Accordingly, all of the store operations had to take place on that local machine. There was no provision for opening and operating upon certificate stores located on remote machines. In accordance with the described embodiment, physical stores and logical stores can be created and operated upon on different machines, i.e. across machine boundaries. FIG. 9 shows physical store 14(1) as being located across a machine boundary from its companion physical stores. Additionally, logical store 12(2) is located across a machine boundary from logical store 12(1). In addition to being able to be opened locally, these stores can be opened remotely. All that is necessary to open a remote store is a specification of the computer on which the store is located and the store name. For example, “\<computer name>\<store name>”. This format enables the operating software to ascertain a location (i.e. from the “computer name” field) of the particular store of interest, go to that location and open the certificate store. The ability to open stores across machine boundaries enhances flexibility and provides for a more robust source of certificate stores.

[0067] One particular application of this aspect is in the area of computer clusters. Specifically, many computers can be organized together as a cluster. Each of the different computers can, in turn, have one or more physical stores. These physical stores can be organized under one logical store. As access to the physical stores occurs through the logical store, the distributed nature of the physical stores is transparent to the program application. In one specific example, an application program can call a particular specified logical store provider which, in turn, can call the individual physical store providers that are associated with it. Through the use of remote protocols, these calls can be made across machine boundaries. Access to the remotely located physical stores is thus transparent to the application program.

[0068] Collection Stores

[0069] FIG. 9 illustrates another aspect of the invention—the concept of a collection store. A collection store is, as the name implies, a collection of physical or logical stores. As organized, an operation on a collection store can be carried across to all of the member physical stores. In one implementation, this is done by defining a collection store provider that is a specifically programmed software module that knows how to operate upon its member physical stores. Operation upon the physical stores by the collection store provider can include calling separate individual physical store providers that are each associated with a physical store of the collection.

[0070] Here, logical store 14(3) and physical stores 14(5) and 14(6) constitute an exemplary collection store. All of the certificates that are associated with each of the individual physical stores are now associated with the collection store. One of the advantages of collection stores is that they can be created by a user and modified to suit the user's needs. For example, FIG. 11 shows a collection store that contains three stores. These stores can be either physical stores or logical stores. If a user wishes to add a store to their collection store, they can simply invoke an application programming interface that enables a user to specify the collection store and the store to be added. Similarly, if a user wishes to remove a store from their collection store, they simply invoke an application programming interface that enables a user to specify the collection store and the store that is to be removed. A set of exemplary application programming interfaces is shown in the table below:

[0071] To create a collection store, an application program makes a call to an application programming interface called CertOpenStore (described below) and specifies the collection store provider type. The collection store provider type is programmed and knows the steps to take to create collection stores.

[0072] A collection store need not necessarily be a member of a logical store—although FIG. 9 certainly indicates that such can be the case. The application programming interfaces described above give the user added flexibility in that they are free to incorporate stores as they choose into their own definable collection store. One advantage of collection stores comes from an application's standpoint. Specifically, in the past, if an application was looking for a particular certificate, it would have to physically go through each store and enumerate the certificates in each store. Now, an application need only invoke an enumeration method on one collection store in order to have all of the certificates in that collection enumerated. Other advantages are, of course, achieved as will be apparent to those of skill in the art.

[0073] Context Links

[0074] In the past, physical stores have stored physical copies of certificates. If a certificate that was stored in one physical store was desired to be located in another physical store, a copy of the certificate was made and stored in the other physical store. When large numbers of copies of the same certificate or even small numbers of copies of many different certificates are saved in different physical stores, undesirably large amounts of memory can be consumed. To address this and other problems, the concept of a context link is utilized. A context link is a link between physical stores that enables one certificate to populate both stores. This way, additional copies of certificates need not be made when they are desired to be present in other stores.

[0075] As an example, consider again FIG. 9. There, several context links have been established between different physical stores. Specifically, physical store s 14(1) has three context links associated with it. A first context link is to certificate 16(1) from certificate 16(17) of physical store 14(7). This means that certificate 16(17) gets its context from certificate 16(1). A second context link is from certificate 16(2) to certificate 16(11) in physical store 14(5). This means that certificate 16(2) gets its context from certificate 16(11). Similarly, a third context link is from certificate 16(3) to certificate 16(4) of physical store 14(2). Other context links are shown for certificates 16(9), 16(10), and 16(18).

[0076] In the described embodiment, the context links are implemented as pointers to the other certificates. Thus, when a certificate is added to a physical store, instead of creating a physical copy of the certificate, a pointer is added to the physical store that points to another certificate. This can greatly save on memory usage. In the described embodiment, a set of application programming interfaces is provided that can be called to add context links to physical stores. An exemplary set of application programming interfaces is shown in the table below:

[0077] Notification, Resynchronization, and Commit

[0078] Certificates in a certificate store are typically kept or persisted in some kind of permanent storage such as a disk file or the system registry. Certificate stores can also be created and opened strictly in memory. A memory store provides temporary certificate storage for working with certificates. Sometimes during the course of operating on a certificate store, certain changes will be made to the certificate store. For example, a particular root certificate might be removed from the certificate store because it can no longer be trusted. As an example, consider FIG. 12. There, a physical store is shown in its persisted state in a permanent storage. In this example, the physical store has been modified or changed in some way. In accordance with the described embodiment, another thread or process can open a physical store and register for a notification event in the event that the physical store is modified. The notification event indicates to the thread or process that the physical store of interest has been modified. In this case, when the physical store was opened by the thread or process, it was read into cache memory, as indicated in FIG. 12. To get the physical store in the cache memory to be synchronized with the changed or modified physical store, an application can execute a “resynchronization” method which synchronizes the cached physical store with the changed or modified physical store in permanent storage. This method is more desirable than having to close and reopen the physical store.

[0079] Another aspect provides a “commit” method that enables changes that are made to a physical store to be committed as a single transaction rather than a number of independent transactions. In the described embodiment, the “commit” method finds particular utility in the context of a file physical store is opened and its contents are read into cache memory, certificates can be added or deleted. Once all of the changes have been made, a call to the “commit” method can be made at which time the changes are committed back to the file physical store in the permanent storage.

[0080] FIG. 13 shows a flow diagram that describes steps in a method in accordance with this implementation. Step 200 monitors one or more physical stores for any changes that might take place. An exemplary change might be the removal or addition of a particular certificate. Step 202 determines whether a particular store has been changed. For example, this step can ascertain whether the contents of a cached store are different from the contents of the store that is persisted to storage. If a store has been changed, then step 204 generates a notification for an application. For example, when the persisted physical store is changed, for whatever reason, a notification is generated for whatever thread or process that has registered for such notification. Accordingly, step 206 resynchronizes the cached store with the changed physical store that is persisted in permanent storage.

[0081] Exemplary Application Programming Interfaces

[0082] FIG. 14 shows an exemplary software component 18 that represents a set of application programming interfaces (APIs) that are implemented in connection with the described embodiment. The APIs discussed below provide a great deal of flexibility insofar as giving the user the ability to create their own user-definable hierarchy of certificate stores—both logical and physical stores. In an exemplary implementation, the APIs were implemented as a set of APIs exported from a DLL for Microsoft's WIN32® operating system. In the described embodiment, a set of application programming interfaces are provided for registering, unregistering, and enumerating both system (e.g. logical) and physical stores. The set of application programming interfaces also includes interfaces for manipulating the contents of the stores as well as the stores themselves. Some of these interfaces were discussed above. An exemplary set of additional application programming interfaces is described in the table just below.

[0083] As FIG. 14 implies, using the set of application programming interfaces, a user, through a suitable application, can make calls on the software component 18 to register/unregister system (logical) stores, register/unregister physical stores, enumerate system and physical stores, as well as manipulate the contents of such stores, e.g. adding a store to a collection store. Through the described software component, user-definable, configurable hierarchies of logical and/or physical stores can be created and used.

[0084] When a user utilizes the software component 18 to define logical and physical stores, information is provided to the software component which then takes the appropriate steps to set up the logical or physical stores for the user. For example, if a user application calls software component 18 to register a new physical store, information about that new store can be persisted into the registry, as shown in FIG. 15, for use when the store is opened and further manipulated by an application. Information that is persisted in the registry can include the store's name, priority, and information on how to open the store, i.e. which physical store provider to use.

[0085] One of the aspects of the described embodiment that gives a desired degree of flexibility is that certificate stores can be created in a number of different locations, e.g. a file system, the registry, and a database to name just a few. One aspect of the described embodiment defines so-called store providers that are programmed to interface with these different types of locations in which certificate stores might occur. Information about each of the providers that is associated with a physical store is kept in the registry (FIG. 15) when a physical store is created.

[0086] FIG. 16 shows one exemplary implementation that utilizes four such providers, i.e. a logical store provider 19, a file system provider 20, a registry provider 22, and a database provider 24. In the described embodiment, when an application wants to open a particular store, it calls an application programming interface “CertOpenStore”, which then opens one or more stores, e.g. physical or logical, that are specified by a user. For example, a user might specify a certain logical store that in turn, has three physical stores underneath it. Each of the physical stores has its own defined protocol for access which is specifically programmed into the physical store provider that is associated with it. In the illustrated example, logical store provider 19 is called to open the user-specified logical store. The logical store provider 19 knows which physical store providers it needs to open the physical stores that are associated with it. Such information can be gleaned by the logical store provider from the registry (FIG. 15). The logical store provider 19 then makes calls to each of the store providers 20, 22, and 24. Each of the store providers 20-24, in turn, take the appropriate steps to open the stores with which they are associated. The application can then make additional calls to the application programming interface set 18 to access and manipulate the contents of the particular physical stores. The provider that is associated with each of the particular physical stores takes all of the appropriate steps to operate on the physical stores and return results to the client in a manner that is transparent to the application and the user. FIG. 17 shows a flow diagram that describes steps in a method for building and operating upon a hierarchical storage system in accordance with the described embodiment. Step 200 receives information from an application program and step 202 uses the information to define a logical store. The information can be any suitable information that can be utilized to assist in defining the logical store, e.g. store name, opening parameters (i.e. associated logical store provider) and the like. In the described embodiment, such information is received through one or more calls that can be made by an application program to a software module 18 (FIG. 16) that defines a set of application programming interfaces. Step 204 receives additional information from the application program and step 206 uses the information to define one or more physical stores that are associated with the logical store. Examples of such additional information are given above. As with the information that is collected for the logical store, the information for the physical stores is received, in the described embodiment, through one or more calls that can be made by an application program to software module 18. Steps 200-206 accordingly enable a user, through a suitable application program, to define their own unique hierarchical storage system for digital certificates.

[0087] With the hierarchical storage system having been defined, steps 208 and 210 enable the user to operate upon the physical stores that comprise the logical store. Specifically, step 208 receives a call from an application program that references a logical store. As an example, a user can call an application programming interface called “CertOpenStore” to open a logical store. Step 210 then opens one or more physical stores that are associated with the logical store. An example of an architecture that can achieve this function was described above in connection with FIG. 16.

[0088] Predefined System and Physical Stores

[0089] One aspect of the invention provides predefined system (logical) stores and physical stores for various locations. One advantage of providing such predefined stores is that each of the individual predefined stores can have a “role” or a function that is associated with it at its particular location. The table below describes some exemplary locations and the predefined logical and physical stores that are associated with each location:

[0090] In the above example, the predefined logical stores can have associated predefined roles. For example, the logical store “My” might be associated with physical stores that hold personal certificates for entities that any of the locations corresponds with. The “Root” logical store might be associated with physical stores that hold only trusted root certificates. Further, the “CA” logical store might be associated with physical stores that hold certificates for intermediate certification authorities.

[0091] External Stores

[0092] One aspect of the invention provides so-called external stores. External stores are functional to prevent all of a store's certificates from being copied into the store's cache when the store is opened. This is an improvement of past practices which were to read all of the store's certificates into cache memory when the store was opened. Now when a store is opened, its associated store provider can maintain the certificates outside of the store's cache. This way, one or more operations that are performed relative to a store need not necessarily be performed on all of the cached certificates. For example, a store provider can maintain an external database of store certificates, such as one provided by Microsoft's Certificate Server Database.

[0093] Protected Root Stores

[0094] One aspect of the invention provides for protected root stores. Recall that root stores are stores that can store the certificates of trusted entities. It is desirable to provide protection on these and other stores to prevent any application from modifying the root store. In the described embodiment, root stores are protected through the use of access control lists or ACLs. This prevents unauthorized entities from modifying a particular root store. For example, through the use of ACLs, only a service or a local machine can be defined as having the ability to modify a root store. The described embodiment presents various organizations of digital certificate stores and techniques of operating upon and manipulating the stores that greatly facilitate their use in maintaining, organizing and overseeing the management of digital certificates. Although the invention has been described in language specific to structural features and/or methodological steps, it is to be understood that the invention defined in the appended claims is not necessarily limited to the specific features or steps described. Rather, the specific features and steps are disclosed as preferred forms of implementing the claimed invention.