Revocation status using other credentials

• US 10,608,828 B2
• Filed: 11/13/2017
• Issued: 03/31/2020
• Est. Priority Date: 06/17/2011
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Le Saint, Eric F., Dulude, Robert F.
• Primary Examiner(s): Naghdali, Khalil
• Application Number:
  US15/810,408
• Publication Number:
  US 20180115429A1
• Time in Patent Office: 869 Days
• Field of Search: 713158
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/72 Signcrypting, i.e. digital signing and encrypting simultaneously
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3066 involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Providing revocation status of at least one associated credential includes providing a primary credential that is at least initially independent of the associated credential, binding the at least one associated credential to the primary credential, and deeming the at least one associated credential to be revoked if the primary credential is revoked. Providing revocation status of at least one associated credential may also include deeming the at least one associated credential to be not revoked if the primary credential is not revoked. Binding may be independent of the contents of the credentials and may be independent of whether any of the credentials authenticate any other ones of the credentials. The at least one associated credential may be provided on an integrated circuit card (ICC). The ICC may be part of a mobile phone or a smart card.

Claims

1. A method of providing revocation status of at least one associated credential stored on a first device, the method comprising:

providing information about a primary credential stored on a second device separate from the first device, the primary credential being cryptographically independent of the at least one associated credential, in that there is no secret associated with one of the primary credential and the at least one associated credential that is used to form a cryptogram that is necessary to establish trust in the other of the primary credential and the at least one associated credential;

binding the at least one associated credential to the primary credential; and

based on revocation of the primary credential, causing the at least one associated credential to also be deemed revoked.

2. A method, according to claim 1, wherein binding the at least one associated credential to the primary credential is independent of the contents of the credentials and is independent of whether any of the credentials authenticate any other ones of the credentials.

3. A method, according to claim 1, wherein the primary credential is bound to a plurality of associated credentials so that revocation status of all of the associated credentials varies according to revocation status of the primary credential.

4. A method, according to claim 1, wherein the second device is a personal identity verification card.

5. A method, according to claim 4, wherein the first device is a mobile phone.

6. A method, according to claim 4, wherein the at least one associated credential includes a card verifiable certificate.

7. A method, according to claim 4, wherein the method is performed to control a door providing access to an area.

8. A method, according to claim 1, further comprising:

authenticating the primary credential.

9. A method of providing revocation status of at least one associated credential of a plurality of associated credentials, the method comprising:

providing information about a primary credential that is cryptographically independent of the at least one associated credential, in that there is no secret associated with one of the primary credential and the at least one associated credential that is used to form a cryptogram that is necessary to establish trust in the other of the primary credential and the at least one associated credential;

binding the plurality of associated credentials to the primary credential; and

based on revocation of the primary credential, causing the at least one associated credential to also be deemed revoked;

wherein revocation statuses of the plurality of associated credentials collectively vary according to revocation status of the primary credential.

10. A method, according to claim 9, wherein the primary credential is provided on a personal identity verification card.

11. A method, according to claim 10, wherein the at least one associated credential is provided on a mobile phone.

12. A method, according to claim 10, wherein the at least one associated credential includes a card verifiable certificate.

13. A method, according to claim 10, wherein the method is performed to control a door providing access to an area.

14. A method, according to claim 9, further comprising:

authenticating the primary credential.

15. A method of providing revocation status of at least one associated credential, the method comprising:

providing information about a primary credential that is cryptographically independent of the associated credential, in that there is no secret associated with one of the primary credential and the at least one associated credential that is used to form a cryptogram that is necessary to establish trust in the other of the primary credential and the at least one associated credential;

binding the at least one associated credential to the primary credential;

authenticating the primary credential; and

based on revocation of the primary credential, causing the at least one associated credential to also be deemed revoked.

16. A method, according to claim 15, wherein the primary credential is provided on a personal identity verification card.

17. A method, according to claim 16, wherein the at least one associated credential is provided on a mobile phone.

18. A method, according to claim 16, wherein the at least one associated credential includes a card verifiable certificate.

19. A method, according to claim 15, wherein the method is performed to control a door providing access to an area.

20. A method, according to claim 16, further comprising:

determining if the primary credential is revoked, wherein the primary credential is authenticated prior to determining if the primary credential is revoked.