Cryptographic key construct

• US 20060218400A1
• Filed: 07/29/2005
• Published: 09/28/2006
• Est. Priority Date: 07/29/2004
• Status: Active Grant

• Current Assignee: James G. Lightburn
• Original Assignee: Infoassure.Com., Inc.
• Inventors: Kimmel, Gerald D., Domangue, Ersin L.
• Granted Patent: US 7,739,501 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A computer program product, for producing a cryptographic key label for use in exchanging information between first and second organizations of members, resides on a computer-readable medium includes computer-readable instructions configured to cause a computer to: produce a read-write cryptographic key using at least one base value; produce a write-only cryptographic key using the read-write cryptographic key; combine a first identifier, uniquely associated with the first organization, and a second identifier, uniquely associated with the key label to be produced, using a one-way function to produce a pedigree; and associate the pedigree with the read-write key and the write-only key to form the cryptographic key label.

Claims

1. A computer program product for producing a cryptographic key label for use in exchanging information between first and second organizations of members, the computer program product residing on a computer-readable medium and comprising computer-readable instructions configured to cause a computer to:

produce a read-write cryptographic key using at least one base value;

produce a write-only cryptographic key using the read-write cryptographic key;

combine a first identifier, uniquely associated with the first organization, and a second identifier, uniquely associated with the key label to be produced, using a one-way function to produce a pedigree; and

associate the pedigree with the read-write key and the write-only key to form the cryptographic key label.

2. The computer program product of claim 1 further comprising instructions configured to cause the computer to associate parameters of an encryption technique associated with the read-write key with the pedigree, the read-write key and the write-only key as part of the label.

3. The computer program product of claim 1 further comprising maintenance instructions configured to cause the computer to alter at least one of the at least one base value.

4. The computer program product of claim 1 wherein the maintenance instructions are configured to cause the computer to alter the at least one of the at least one base value at regular time intervals.

5. The computer program product of claim 1 wherein one-way function is a cryptographic hash function.

6. A data arrangement stored in memory or transmitted electrically, the data arrangement comprising, in combination:

a read-write cryptographic key;

a write-only cryptographic key; and

a pedigree comprising a result of a one-way function applied to a first unique identifier of an organization and a second unique identifier of the data arrangement.

7. The data arrangement of claim 6 wherein the pedigree is the result of a cryptographic hash function applied to the first and second identifiers.

8. The data arrangement of claim 7 further comprising an indication of a cryptographic technique associated with the read-write cryptographic key.

9. The data arrangement of claim 8 wherein the indication is indicative of a cryptographic parameter of the cryptographic technique.

10. The data arrangement of claim 8 further comprising a human-readable name.

11. The data arrangement of claim 6 wherein the data arrangement comprises a portion of a memory.

12. The data arrangement of claim 6 wherein the data arrangement comprises signals.

13. A computer program product residing on a computer-readable medium and comprising computer-readable instructions configured to cause a computer to:

use a first one-way function to produce a first sequence of forward cryptographic base values;

use a second one-way function to produce a second sequence of backward cryptographic base values; and

combine corresponding forward and backward cryptographic base values to produce a third sequence of cryptographic keys.

14. The computer program product of claim 13 wherein the instructions configured to cause a computer to combine the base values are configured to cause the computer to combine an n^th forward cryptographic base value of the first sequence and a (m−

n+1)^th backward cryptographic base value of the second sequence to produce an n^th one of the cryptographic keys of the third sequence.

15. The computer program product of claim 13 further comprising key-production instructions configured to cause the computer to send, toward a recipient, at least one of the base values from at least one of the sequences to a recipient to limit which cryptographic keys of the third sequence the recipient can produce.

16. The computer program product of claim 15 wherein the key-production instructions are configured to cause the computer to send one of the forward base values from the first sequence and one of the backward base values from the second sequence to limit which of the cryptographic keys of the third sequence the recipient can produce to a range of the cryptographic keys of the third sequence.

17. The computer program product of claim 16 wherein the range is a consecutive group of the cryptographic keys in the third sequence.