System and method to enable PKI- and PMI- based distributed locking of content and distributed unlocking of protected content and/or scoring of users and/or scoring of end-entity access means-added

• US 10,038,678 B2
• Filed: 07/05/2017
• Issued: 07/31/2018
• Est. Priority Date: 04/30/2010
• Status: Active Grant

• Current Assignee: T-Central, Inc.
• Original Assignee: T-Central, Inc.
• Inventors: Kravitz, David W., Graham, III, Donald Houston, Boudett, Josselyn L., Dietz, Russell S.
• Primary Examiner(s): Mehrmanesh, Amir
• Application Number:
  US15/642,304
• Publication Number:
  US 20170324717A1
• Time in Patent Office: 391 Days
• Field of Search: None
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/53 using third party service providers
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A central server configured with an Attribute Authority (“AA”) acting as a Trusted Third Party mediating service provider and using X.509-compatible PKI and PMI, VPN technology, device-side thin client applications, security hardware (HSM, Network), cloud hosting, authentication, Active Directory and other solutions. This ecosystem results in real time management of credentials, identity profiles, communication lines, and keys. It is not centrally managed, rather distributes rights to users. Using its Inviter-Invitee protocol suite, Inviters vouch for the identity of Invitees who successfully complete the protocol establishing communication lines. Users establish and respond to authorization requests and other real-time verifications pertaining to accessing each communication line (not end point) and sharing encrypted digital files. These are auditable, brokered, trusted-relationships where such relationships/digital agreements can each stand-alone (for privacy) or can leverage build-up of identity confidence levels across relationships. The service is agnostic to how encrypted user content is transported or stored.

Claims

1. A method for secure communication between a first electronic device and a second electronic device, each electronic device including a hardware processor and associated memory, the method comprising:

creating, by the first electronic device, a first set of encryption keys including a first public encryption key, and a first private encryption key and a first digital token;

creating, by the second electronic device, a second set of encryption keys including a second public encryption key, and a second private encryption key and a second digital token;

receiving, by the second electronic device, an invitation request to establish a secure communication line between the first electronic device and the second electronic device, the invitation request including a challenge question;

transmitting to a trusted third party, by the first electronic device, an answer to the challenge question;

transmitting to the trusted third party, by the second electronic device, a response to the challenge question;

authenticating, by the trusted third party, the second electronic device based on the response to the challenge question and the answer to the challenge question; and

establishing the secure communication line by uniquely associating the first public encryption key and the second public encryption key to the first and second electronic device, respectively.

2. The method of claim 1, wherein the secure communication line includes a digital agreement to enable the first electronic device to designate a specific endpoint recipient for information being sent by the first electronic device.

3. The method of claim 2, wherein only the specific endpoint recipient is able to receive and use said information being sent by the first electronic device.

4. The method of claim 1, wherein the secure communication line is revocable by the first electronic device.

5. The method of claim 1, wherein the secure communication line is revocable by a third party indicated in a digital agreement included with the secure communication line.

6. The method of claim 1, further comprising grouping a plurality of electronic devices into a group with an attribute certificate issued to said group.

7. A system for secure communication comprising:

a first electronic device electronic device including a first hardware processor and associated memory for creating a first set of encryption keys including a first public encryption key, and a first private encryption key and a first digital token;

a second electronic device electronic device including a second hardware processor and associated memory a second set of encryption keys including a second public encryption key, and a second private encryption key and a second digital token; and

a trusted third party server computer, wherein

the first electronic device transmits an invitation request to the second electronic device to establish a secure communication line with the second electronic device, the invitation request including a challenge question, wherein

the first electronic device transmits to the trusted third party server an answer to the challenge question, wherein

the second electronic device transmits to the trusted third party server a response to the challenge question, wherein

the trusted third party server authenticates the second electronic device based on the response to the challenge question and the answer to the challenge question, and establishes the secure communication line by uniquely associating the first public encryption key and the second public encryption key to the first and second electronic device, respectively.

8. The system of claim 7, wherein the secure communication line includes a digital agreement to enable the first electronic device to designate a specific recipient for information being sent by the first electronic device.

9. The system of claim 8, wherein only the specific recipient is capable of gaining access to said information sent by the first electronic device.

10. The system of claim 7, wherein the secure communication line is revocable by the first electronic device.

11. The system of claim 7, wherein the secure communication line is revocable by a third party indicated in a digital agreement included with the secure communication line.

12. A non-transitory computer storage medium for storing a plurality of instructions, the plurality of instructions when executed by one or more processors performing a method for secure communication between a first electronic device and a second electronic device, each electronic device including a hardware processor and associated memory, the method comprising:

creating, by the first electronic device, a first set of encryption keys including a first public encryption key, and a first private encryption key and a first cliental token;

creating, by the second electronic device, a second set of encryption keys including a second public encryption key, and a second private encryption key and a second digital token;

receiving, by the second electronic device, an invitation request to establish a secure communication line between the first electronic device and the second electronic device, the invitation request including a challenge question;

transmitting to a trusted third party, by the first electronic device, an answer to the challenge question;

transmitting to the trusted third party, by the second electronic device, a response to the challenge question;

authenticating, by the trusted third party, the second electronic device based on the response to the challenge question and the answer to the challenge question; and

establishing the secure communication line by uniquely associating the first public encryption key and the second public encryption key to the first and second electronic device, respectively.

13. The non-transitory computer storage medium of claim 12, wherein the secure communication line includes a digital agreement to enable the first electronic device to designate a specific recipient for information being sent by the first electronic device.

14. The non-transitory computer storage medium of claim 13, wherein only the specific recipient is able to gain access to said information being sent by the first electronic device.

15. The non-transitory computer storage medium of claim 12, wherein the secure communication line is revocable by the first electronic device.

16. The non-transitory computer storage medium of claim 12, wherein the secure communication line is revocable by a third party indicated in a digital agreement included with the secure communication line.

17. The non-transitory computer storage medium of claim 12, further comprising grouping a plurality of electronic devices into a group with an attribute certificate issued to said group.