Method and system for granting acces to information for electronic commerce

• US 20020019944A1
• Filed: 06/04/2001
• Published: 02/14/2002
• Est. Priority Date: 08/14/2000
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kou, Weidong
• Application Number:
  US09/873,967
• Publication Number:
  US 20020019944A1
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

To reduce the number of key pairs that must be managed in an asymmetric encryption/decryption system, each customer of a vendor is assigned to at least one defined customer group as a function of the information that is to be made available to the customer. A key pair consisting of a group source key and a group member key is assigned to each defined customer group. The vendor uses the group source key to encrypt information to be made available only to members of the associated group. Authenticated customers are given the group member key for each group to which they belong. The customers use the group member key to decrypt information previously encrypted by the vendor using the associated group source key.

Claims

1. A system for controlling access to information items comprising:

a) a storage subsystem containing definitions of customer groups, customer information including which customer group or groups to which each customer belongs, information item definitions including which customer group or groups with which each information item is associated, a set of group source keys, each group source key being associated with a different one of the customer groups, a set of group member keys, each group member key being associated with a different one of said group source keys;

b) an encryption subsystem for encrypting information items information items associated with a customer group using the group source key associated with the same group; and

c) an authentication subsystem for allowing a customer access to a group member key once the customer has been authenticated as a member of the customer group with which the group member key is associated, thereby enabling the customer to use the group member key to decrypt item information previously encrypted using the associated group source key.

2. A system as defined in claim 1 wherein the authentication subsystem further includes:

a) an authentication storage subsystem for storing customer identifiers and associated passwords; and

b) authentication logic for receiving customer identifier and password inputs, comparing the received inputs to stored customer identifiers and associated passwords, and authenticating the inputs provider when the inputs matched the stored corresponding information.

3. A system as defined in claim 1 wherein the information items include pricing information.

4. A system as defined in claim 2 wherein the information items including pricing information.

5. A method for controlling access to information items comprising the steps of:

a) storing definitions of customer groups;

b) storing customer information including which customer group or groups to which each customer belongs;

c) storing information items including which customer group or groups with which each information item is associated;

d) storing sets of key pairs, each key pair being associated with one of the defined customer groups and comprising a group source key and a group member key;

e) encrypting at least one information item using the group source key for the group with which the information item is associated; and

f) providing the group member keys to customer members of the groups with which the group member keys are associated, thereby enabling a customer to decrypt an encrypted information item associated with the customer'"'"'s group.

6. A method as defined in claim 5 wherein the stored customer information includes customer identifiers and passwords and wherein the providing step further includes the steps of:

a) receiving customer identifier and password inputs;

b) comparing the received inputs to stored customer identifiers and passwords;

c) responding to a match between the received inputs and a stored customer identifier and password by identifying the customer as having been authenticated; and

d) making available the group member key associated with a customer group to which the authenticated customer belongs.

7. A program product having a computer-readable medium storing computer-readable program code for controlling access to information items, said computer-reable program code comprising:

a) code for causing the storage of definitions of customer groups;

b) code for causing the storage of customer information including which customer group or groups to which each customer belongs;

c) code for causing the storage of information items including which customer group or groups with which each information item is associated;

d) code for causing the storage of sets of key pairs, each key pair being associated with one of the defined customer groups and comprising a group source key and a group member key;

e) code for encrypting at least one information item using the group source key for the group with which the information item is associated; and

f) code for providing the group member keys to customer members of the groups with which the group member keys are associated, thereby enabling a customer to decrypt an encrypted information item associated with the customer'"'"'s group.

8. A program product as defined in claim 7 wherein the stored customer information includes customer identifiers and passwords and the program product further includes:

a) code for receiving customer identifier and password inputs;

b) code for comparing the received inputs to stored customer identifiers and passwords;

c) code responsive to a match between the received inputs and a stored customer identifier and password to identify the customer as having been authenticated; and

d) code responsive to the authentication to make available the group member key associated with a customer group to which the authenticated customer belongs.