Enhanced cryptographic system and method with key escrow feature

• US 5,872,849 A
• Filed: 02/19/1997
• Issued: 02/16/1999
• Est. Priority Date: 01/13/1994
• Status: Expired due to Term

• Current Assignee: Certco
• Original Assignee: Certco
• Inventors: Sudia, Frank Wells
• Primary Examiner(s): Barron, Jr., Gilberto
• Application Number:
  US08/802,818
• Time in Patent Office: 727 Days
• Field of Search: 380/23, 380/25, 380/30, 380/49
• US Class Current: 713/175
• CPC Class Codes: G06F 7/725 over elliptic curves
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

The invention provides a cryptographic system and method with a key escrow feature that uses a method for verifiably splitting users'"'"' private encryption keys into components and for sending those components to trusted agents chosen by the particular users, and provides a system that uses modern public key certificate management, enforced by a chip device that also self-certifies. The methods for key escrow and receiving an escrow certificate are also applied herein to a more generalized case of registering a trusted device with a trusted third party and receiving authorization from that party enabling the device to communicate with other trusted devices.

Claims

1. A method for secure communication in a system having at least one communicating party and a message key that is recoverable by one not a party to the communication, the method comprising steps of:

providing each user with a computer hardware device;

registering hardware devices with a center in accordance with control information determined by a device owner distinct from a device user;

certifying hardware devices, each certification generating a certificate associating a center, a user, and a hardware device;

initiating a secure communication from an initiating user to a recipient using a message key in a manner that permits the owner to access the communication.

2. The method of claim 1 wherein the registering step includes a step of registering a device only at a center selected from a plurality of centers in accordance with owner-determined information.

3. The method of claim 1 wherein the registering step includes a step of registering a device at a center selected from a plurality of centers in accordance with information incorporated into the device by one other than the user.

4. The method of claim 1 wherein the registering step includes steps of:

registering a device at a first center; and

registering a device at a second center selected from a plurality of centers in accordance owner-determined information.

5. The method of claim 1 wherein the registering step includes steps of certifying a device a limited number of times in accordance with owner-determined information.

6. The method of claim 1 wherein the registering step includes as step of registering a device with a center in accordance with control information determined by a second device owner distinct from a first device owner.

7. The method of claim 6 wherein the second device owner is a user.

8. The method of claim 1 wherein the registering step includes a step of identifying the owner to the center.

9. The method of claim 1 wherein a recipient is a storage device.

10. The method of claim 1 wherein at least one of the steps of the method requires a trusted device, and the trusted device engages in the required step only after incorporating owner information into the trusted device.

11. The method of claim 1 wherein a device performs a step of the method in response to an instruction confirmed by a key of one other than the user embedded in the device.

12. A method for encrypted communication in a system having communicating parties and a message key that is recoverable by one not a party to the communication the method comprising steps of:

providing each user with a computer hardware device having at least one device-associated key;

registering hardware devices with at least a selected one of a plurality of centers;

certifying the hardware devices, said certification generating a certificate for a device;

initiating a secure communication from an initiating user to a recipient using a message key, said communication containing an access portion encrypted by a key of the center to recover the message key, wherein the communication step includes steps of;

encrypting access information using a key of a first center; and

encrypting access information using a key of a second center.