METHOD FOR INITIATING A STREAM-ORIENTED ENCRYPTED COMMUNICATION

• US 20010050990A1
• Filed: 12/27/1999
• Published: 12/13/2001
• Est. Priority Date: 02/19/1997
• Status: Abandoned Application

• Current Assignee: Frank Wells Sudia
• Original Assignee: Frank Wells Sudia
• Inventors: SUDIA, FRANK WELLS
• Application Number:
  US09/472,511
• Publication Number:
  US 20010050990A1
• Time in Patent Office: Days
• US Class Current: 380/286
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

The invention provides a cryptographic system and method with a key escrow feature that uses a method for verifiably splitting users'"'"' private encryption keys into components and for sending those components to trusted agents chosen by the particular users, and provides a system that uses modern public key certificate management, enforced by a chip device that also self-certifies. In a preferred embodiment of this invention, the chip encrypts or decrypts only if certain conditions are met, namely, (1) if a valid “sender certificate” and a valid “recipient certificate” are input, where “valid” means that the particular user'"'"'s private decryption key is provably escrowed with a specified number of escrow agents and that the master escrow center is registered and certified by the chip manufacturer, and (2) if a valid Message Control Header is generated by the sender and validated by the recipient, thereby giving authorized investigators sufficient information with which to request and obtain the escrowed keys. The methods for key escrow and receiving an escrow certificate are also applied herein to a more generalized case of registering a trusted device with a trusted third party and receiving authorization from that party enabling the device to communicate with other trusted devices. A further preferred embodiment of this invention provides a method for generating verifiably trusted communications among a plurality of users, comprising the steps of escrowing at a trusted escrow center a plurality of asymmetric cryptographic keys to be used by a plurality of users; verifying each of said plurality of keys at the escrow center; certifying the authorization of each of said plurality of keys upon verification; and initiating a communication from each of said plurality of users using a respective one of said plurality of keys contingent upon said certification. This invention also provides for decoding of communications by authorized law enforcement agents, based upon use of the Message Control Header included with each communication, using a special law enforcement decoder box and auditing of the law enforcement wiretaps to prevent abuse by law enforcement and other officials. Further preferred embodiments provide for rekeying and upgrading of device firmware using a certificate system, and encryption of stream-oriented data.

Claims

1. A method for generating verifiably trusted communications among a plurality of users, comprising the steps of:

escrowing at a trusted escrow center a plurality of asymmetric cryptographic keys to be used by a plurality of users;

verifying each of said plurality of keys at the escrow center;

certifying the authorization of each of said plurality of keys upon verification; and

initiating a communication from each of said plurality of users using a respective one of said plurality of keys contingent upon said certification.