Method of securing a cryptographic key

• US 6,052,468 A
• Filed: 01/15/1998
• Issued: 04/18/2000
• Est. Priority Date: 01/15/1998
• Status: Expired due to Term

• Current Assignee: Activcard Ireland, Limited
• Original Assignee: DEW Engineering and Development Limited (Trelleborg AB)
• Inventors: Hillhouse, Robert D.
• Primary Examiner(s): Swann, Tod R.
• Assistant Examiner(s): CODDINGTON, TREVOR Q
• Application Number:
  US09/007,183
• Time in Patent Office: 824 Days
• Field of Search: 380/23, 380/44, 380/59, 380/277, 380/278, 380/279, 380/281, 380/283, 380/284, 713/168, 713/171, 713/182, 713/186
• US Class Current: 380/281
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861

Abstract

A method is disclosed for improving portability of secure encryption key data files. The method provides for re-securing key data files according to different security processes for mobility. For porting an encryption key secured using a fingerprint authentication process to a system having only a password authentication process, a user selects password authentication process, provides a fingerprint and is authorised, provides a new password and then the encryption key is accessed according to the fingerprint authentication process and secured according to the password authentication process. This allows the use of specialised security hardware at one location while retaining an ability to transport encryption keys in a secure fashion to other locations, which do not have similar security hardware.

Claims

1. In a system comprising a cryptographic key encrypted and stored in a key data file and a secured key for decrypting the cryptographic key wherein the secured key is stored in a secured fashion, a method of securing the secured key comprising the steps of:

a) accessing stored data associated with the secured key, the data indicative of an access method from a plurality of access methods for accessing the secured key on a first computer;

b) executing the indicated access method to access the secured key;

c) selecting a method from the plurality of methods for securing the accessed secured keys the method selected to provide for access to the key data file on a second other computer;

d) securing the accessed secured key according to the selected access method; and

,

e) storing data associated with the secured key, the data indicative of the selected access method.

2. A method of securing the secured key as defined in claim 1 wherein the plurality of access methods are methods of authenticating a user.

3. A method of securing the secured key as defined in claim 2 wherein the steps (a), (b), (d), and (e) are performed by at least a processor in a computer system and wherein each of the plurality of access methods is available for execution by the at least a processor.

4. A method of securing the secured key as defined in claim 2 wherein the methods of authenticating a user include password based user authentication and biometric user authentication.

5. A method of securing the secured key as defined in claim 4 wherein the biometric user authentication is fingerprint authentication.

8. A method of securing the secured key as defined in claim 1, wherein the encrypted cryptographic key, the secured key and the stored data are stored in a same electronic file.

9. A method of securing the secured key as defined in claim 1 comprising the steps of:

selecting a method from the plurality of methods for securing the secured key;

securing the secured key according to the selected access method; and

, storing data associated with the twice-secured key, the data indicative of the selected access method.

10. A method of securing the secured key as defined in claim 1, wherein the steps (a), (b), (d), and (e) are performed automatically and wherein steps (b) and (d) require information provided by an individual.

11. A method of securing the secured key as defined in claim 1, wherein the step (b) comprises the step of:

prompting for provision of authorisation information according to the access method; and

the step (d) comprises the steps of;

prompting for provision of authorisation information according to the selected authorisation method.

6. In a system comprising a cryptographic key encrypted and stored in a key data file and a secured key for decrypting the cryptographic key wherein the secured key is stored in a secured fashion, a method of securing the secured key comprising the steps of:

a) accessing stored data associated with the secured key, the data indicative of an access method from a plurality of access methods for accessing the secured key;

b) executing the indicated access method to access the secured key;

c) selecting a method from the plurality of methods for securing the accessed secured key;

d) securing the accessed secured key according to the selected access method;

e) storing data associated with the secured ken the data indicative of the selected access method;

wherein the accessed secured key is secured by the steps of;

providing user authentication information;

deriving from the user authentication information a second cryptographic key; and

encrypting the accessed secured key using the second cryptographic key.

7. A method of securing the secured key as defined in claim 6 wherein the secured key is accessed by the steps of:

providing user authentication information;

deriving from the user authentication information a third cryptographic key; and

,

decrypting the secured key using the third cryptographic key.

12. A method of accessing a secured cryptographic key comprising the steps of:

a) accessing data associated with the secured cryptographic key to determine an authorisation method necessary to access the secured cryptographic key;

b) providing user authorisation information;

c) executing the determined authorisation method to access the secured cryptographic key based on the user authorisation information provided.

13. A method of accessing a secured cryptographic key as defined in claim 12, comprising the step of:

prompting for provision of authorisation information according to the indicated access method.

15. A method of accessing a secured cryptographic key as defined in claim 12, wherein the secured cryptographic key is a secured key for securing a further cryptographic key.

14. A method of accessing a secured cryptographic key comprising the steps of:

a) accessing data associated with the secured cryptographic key to determine an authorisation method necessary to access the secured cryptographic key;

b) providing user authorisation information;

c) executing the determined authorisation method to access the secured cryptographic key based on the user authorisation information provided;

wherein the step (c) comprises the step of;

decrypting the secured cryptographic key using a cryptographic key determined from the provided authorisation information.

16. A method of securing portable key data including encryption key information comprising the steps of:

a) selecting a first authorisation process from a plurality of authorisation processes for securing the portable key data;

b) authenticating access to the secured portable key data according to a different authorisation process, removing the security from the portable key data, and implementing security of the portable key data according to the first authorisation process.

17. A method of securing portable key data including encrypt;

on key information as defined in claim 16 comprising the steps of

determining if the secured portable key data is secured using the first authorisation process;

when the secured portable key data is secured using the first authorisation process duplicating the secured portable key data;

wherein the step (b) is only executed when the secured portable key data is secured using an authorisation process different from the first authorisation process.