Method and system for the cipher key controlled exploitation of data resources, related network and computer program products

• US 20070079142A1
• Filed: 12/30/2003
• Published: 04/05/2007
• Est. Priority Date: 12/30/2003
• Status: Active Grant

• Current Assignee: Telecom Italia S.p.A.
• Original Assignee: Telecom Italia S.p.A.
• Inventors: Leone, Manuel, Caprella, Ettore
• Granted Patent: US 7,913,096 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect

Abstract

An arrangement for the cipher controlled exploitation of data resources (e.g., securely storing and retrieving sensitive data or securely registering and logging on a computer system) includes the steps of providing a subscriber identity module carrying a security algorithm; generating at least one, e.g., two, random values; subjecting the random value to the at least one security algorithm to generate at least one, e.g., two, session keys; processing the session keys via a mixer function such as a hash function to produce a cipher key; and using the cipher key thus produced for exploiting the data resources.

Claims

1-23. -23. (canceled)

24. A method for the cipher controlled exploitation of data resources stored in a database associated with a computer system, comprising the steps of:

providing a subscriber identity module carrying at least one security algorithm;

producing a cipher key via said at least one security algorithm; and

using said cipher key for protecting said data resources.

25. The method according to claim 24, wherein said step of using said cipher key for protecting said data resources comprises the steps of:

encrypting said data resources by means of said cipher key;

storing said encrypted data resources in said database associated with said computer system;

retrieving said encrypted data resources from said database; and

decrypting said encrypted data resources by means of said cipher key.

26. The method according to claim 24, wherein said step of producing a cipher key comprises the steps of:

generating at least one random value;

subjecting said at least one random value to said at least one security algorithm to generate at least one session key; and

processing said at least one session key via a mixer function to produce said at least one cipher key.

27. The method according to claim 26, comprising the steps of:

generating at least two random values;

subjecting said at least two random values to said at least one security algorithm to generate at least two session keys; and

combining said at least two session keys via a mixer function to produce said at least one cipher key.

28. The method according to claim 26, wherein said mixer function comprises a hash function.

29. The method according to claim 26, comprising the step of inserting in said mixer function a user specific secret unrelated to said subscriber identity module security algorithm, whereby said cipher key is unpredictable even based on knowledge of said security algorithm carried in said subscriber identity module.

30. The method according to claim 24, comprising the step of selecting said data resources from user sensitive data or user credentials.

31. The method according to claim 30, wherein said step of using said cipher key for protecting said data resources comprises the step of encrypting by means of said cipher key, said user sensitive data or said user credentials from plain text into an encrypted format.

32. The method according to claim 31, wherein said step of using said cipher key for protecting said data resources comprises the step of decrypting by means of said cipher key said user sensitive data or said user credentials from an encrypted format into plain text.

33. The method according to claim 31, wherein said user sensitive data or said user credentials in encrypted format have a cryptographic header associated therewith.

34. The method according to claim 33, wherein said cryptographic header comprises an identifier of said subscriber identity module and a cryptographic checksum based on said cipher key, said cryptographic checksum being used for detecting any unauthorized modifications of said encrypted format.

35. The method according to claim 30, wherein said data resources are user credentials, said database associated with said computer system is a remote database and said data resources based on said user credentials are stored in said remote database in an encrypted format.

36. The method according to claim 35, comprising the step of establishing a relationship between said user credentials stored in said encrypted format in said remote database and a corresponding user subscriber identity module.

37. The method according to claim 36, wherein said relationship is established by means of an identifier of said subscriber identity module.

38. The method according to claim 37, comprising the step of using said identifier for searching within said remote database to permit said user exploitation of said user credentials.

46. A computer program product loadable in the memory of at least one computer and comprising software code portions capable of performing the method of claim 24.

39. A system for the cipher-controlled exploitation of data resources, comprising:

at least a subscriber identity module carrying at least one security algorithm;

at least a computer system comprising at least one processing module, said processing module being interfaced with said subscriber identity module to generate at least one cipher key via said at least one security algorithm and being configured to protect via said cipher key said data resources; and

a database associated with said computer system for storing said data resources protected by said cipher key.

40. The system according to claim 39, wherein said at least one processing module is configured for:

encrypting said data resources by means of said cipher key;

storing said encrypted data resources in said database associated with said computer system;

retrieving said encrypted data resources from said database; and

decrypting said encrypted data resources by means of said cipher key.

41. The system according to claim 39, wherein said database is included in said computer system.

42. The system according to claim 39, wherein said database is remote from said computer system.

43. The system according to claim 39, wherein said processing module is interfaced with said subscriber identity module via a smart card reader or a Bluetooth mobile terminal or an IrDA mobile terminal or a mobile terminal through a cable.

44. The system according to claim 39, wherein said computer system comprises a personal computer or a notebook or a laptop or a PDA, or a smart phone.

45. A communication network comprising a system according to claim 39.