Cryptographic configuration control

• US 20060282681A1
• Filed: 05/26/2006
• Published: 12/14/2006
• Est. Priority Date: 05/27/2005
• Status: Abandoned Application

• Current Assignee: TecSec, Incorporated
• Original Assignee: TecSec, Incorporated
• Inventors: Wack, C. Jay, Scheidt, Edward M., Tsang, Wai, Butler, Roger
• Application Number:
  US11/441,793
• Publication Number:
  US 20060282681A1
• Time in Patent Office: Days
• US Class Current: 713/186
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics

Abstract

A method of providing object security includes selecting an object to secure, selecting at least one criterion for authorization to access the object, generating an authorization profile based on the at least one criterion, generating an encryption key, binding the authorization profile to at least one of the object and the key, and encrypting the object with the encryption key.

Claims

1. A method of providing object security, comprising:

selecting an object to secure;

selecting at least one criterion for authorization to access the object;

generating an authorization profile based on the at least one criterion;

generating an encryption key;

binding the authorization profile to at least one of the object and the key; and

encrypting the object with the encryption key.

2. The method of claim 1, wherein the at least one criterion includes at least one of a rule and a role corresponding to a person authorized to access the object.

3. The method of claim 2, wherein the at least one criterion is a role within a domain.

4. The method of claim 1, further comprising decrypting the object by an authorized person with a decryption key corresponding to the encryption key to access the object.

5. The method of claim 4, wherein the authorized person satisfies the at least one criterion.

6. The method of claim 5, further comprising authenticating the identity of the authorized person prior to decrypting the object.

7. The method of claim 6, wherein authenticating the identity of the authorized person comprises requiring the user to provide at least one of a knowledge-based input, a possession-based input, and a biometric representation.

8. The method of claim 7, further comprising binding the possession-based input to the biometric representation.

9. The method of claim 7, wherein generating the encryption key includes utilizing at least part of the at least one of a knowledge-based input, a possession-based input, and a biometric representation as an element of the key.

10. The method of claim 4, further comprising destroying the key on decryption.

11. The method of claim 10, further comprising recovering the destroyed key.

12. The method of claim 4, wherein the decryption key is identical to the encryption key.

13. The method of claim 1, wherein the object is one of data-at-rest and data-in-transit.

14. The method of claim 1, wherein the object is one of a program, an application, a device, a hardware operating mode, a database operation, a communications channel, a data flow path, computing platform BIOS, an operating system core, an operating system driver, operating system privilege level, computing platform scripts, computing platform macros, and an OSI stack.

15. A method of establishing a trusted platform, comprising:

exercising object security on a computing system platform according to the method of claim 1.

16. A method of controlling a computing operating environment, comprising:

exercising object security within the computing environment according to the method of claim 1;

wherein the object is an execution stack.

17. The method of claim 1, wherein encrypting the object with the encryption key includes applying the encryption key to the object according to a symmetric key algorithm.

18. A method of enforcing data separation, comprising:

nesting a plurality of objects encrypted according to the method of claim 1;

wherein at least one criterion selected for authorization to access one of the nested objects is different from another criterion selected for authorization to access at least another nested object.

19. The method of decrypting an object encrypted according to the method of claim 18, comprising:

selecting a first encrypted object;

determining if the first encrypted object is nested within a second object;

determining if the second object is encrypted;

decrypting the first encrypted object by an authorized person with a decryption key corresponding to the encryption key to access the object, wherein the authorized person satisfies the at least one criterion for the respective object, if the second object is not encrypted; and

preventing decryption of the first object if the second object is encrypted.

20. The method of claim 1, further comprising providing data integrity for at least one of the at least one criterion and the authorization profile.

21. The method of claim 20, wherein providing data integrity includes electronically signing.

22. The method of claim 20, wherein providing data integrity includes providing at least one of a message authentication code and a manipulation detection code.

23. The method of claim 1, further comprising applying a cryptographic hash to the object prior to encrypting the object.