Public key cryptography based security system to facilitate secure roaming of users

• US 6,317,829 B1
• Filed: 06/19/1998
• Issued: 11/13/2001
• Est. Priority Date: 06/19/1998
• Status: Expired due to Term

• Current Assignee: Entrust Corp.
• Original Assignee: Entrust Technologies Limited
• Inventors: Van Oorschot, Paul C.
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US09/099,840
• Time in Patent Office: 1,243 Days
• Field of Search: 713/155, 713/161, 713/168, 713/170, 713/182
• US Class Current: 713/155
• CPC Class Codes: G06Q 20/3672 initialising or reloading thereof
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A public key cryptography based security system and method stores decryption private key history data in a common directory accessible by roaming users, to facilitate roaming use of the encryption system. A security management server stores per user security data, such as decryption private key history data in a secure database as master copy data. A public repository unit stores remotely accessible per user security data including the decryption private key history data stored in the security management server. A second computing device, different from a primary computing device, communicates with the public repository unit to obtain the decryption private key history data to decrypt encrypted data associated with the primary computing device to facilitate portable security capability.

Claims

1. A public key cryptography based security system to facilitate secure roaming of users among at least a first computing device and a second computing device comprising:

storage means for storing per user security data including decryption private key history data that includes multiple private decryption keys associated with the same user;

public repository means, operatively coupled to the storage means, for storing remotely accessible per user security data including the decryption private key history data stored in the storage means to facilitate portable security capabilities; and

the second computing device, in operative communication with the public repository means, for obtaining the decryption private key history data including the multiple private decryption keys from the public repository means to facilitate decryption of encrypted data.

2. The public key cryptography based security system of claim 1 wherein the first computing unit is a primary computing unit and the second computing unit is an alternate computing unit.

3. The public key cryptography based security system of claim 1 wherein the first computing device, is operatively coupled to the storage means and has a decryption private key history request generator for obtaining decryption private key data from at least one of:

the public repository means and the storage means, to facilitate decryption of data.

4. The public key cryptography based security system of claim 3 wherein the public repository means includes means for communicating the requested decryption private key data in response to receiving the decryption private key history request from the first computing unit.

5. The public key cryptography based security system of claim 1 wherein the public repository means provides decryption private key history data to the second computing device.

6. The public key cryptography based security system of claim 1 wherein the second computing device includes a decryption private key history request generator for obtaining decryption private key history data from the public key repository means.

7. The public key cryptography based security system of claim 6 wherein the public repository means includes means for communicating requested decryption private key history data in response to receiving the decryption private key history request.

8. The public key cryptography based security system of claim 1 wherein the public repository means includes per user security data further including at least one of:

encryption public key certificate data, signature verification public key certificate data, signing private key data, policy data and trusted verification public key data of certificate issuing units.

9. The public key cryptography based security system of claim 1 wherein the storage means includes means for generating a new per user decryption private key and updating the decryption private key history data in accordance therewith.

10. The public key cryptography based security system of claim 9 wherein the first computing unit receives the updated decryption private key history data from the storage means and communicates the updated decryption private key history data for storage by the public repository means.

11. The public key cryptography based security system of claim 9 wherein the storage means communicates the updated decryption private key history data for storage by the public repository means.

12. The public key cryptography based security system of claim 1 wherein the first computing unit includes means for generating a new per user decryption private key and updating the decryption private key history data in at least one of:

the first computing unit, the public repository means and the storage means.

13. The public key cryptography based security system of claim 1 wherein the first computing unit includes means for generating a new decryption private key, transferring the new decryption private key to the storage means, and wherein the storage means includes means for updating the decryption private key history and for updating the decryption private key history in the public repository means.

14. The public key cryptography based security system of claim 1 wherein the decryption private key history data includes a plurality of per user decryption private keys wherein at least one per user decryption private key corresponds to a non-current public key certificate.

15. A public key cryptography based security system to facilitate secure roaming of users among at least a first computing device and a second computing device comprising:

storage means for storing per user security data including decryption private key history data wherein the decryption private key history data includes a plurality of per user decryption private keys associated with each of a plurality of users wherein at least one per user decryption private key corresponds to a non-current public key certificate;

public repository means, operatively coupled to the storage means, for storing remotely accessible per user security data on a per user basis, including encrypted decryption private key history data stored in the storage means wherein the decryption private key history data includes a plurality of per user decryption private keys wherein at least one per user decryption private key corresponds to a non-current public key certificate, and encryption public key certificate data to facilitate portable security capabilities; and

the second computing device, in operative communication with the public repository means, for obtaining the encrypted decryption private key history data including the multiple private decryption keys and the encryption public key certificate data from the public repository to facilitate decryption of encrypted data.

16. The public key cryptography based security system of claim 15 wherein the second computing device includes a decryption private key history request generator for obtaining decryption private key data from the public key repository means.

17. The public key cryptography based security system of claim 16 wherein the public repository means includes means for communicating requested decryption private key history data in response to receiving the decryption private key history request.

18. The public key cryptography based security system of claim 17 wherein the public repository means includes per user security data further including at least one of:

signing public key certificate data, policy data, signing private key data and trusted verification public key data of certificate issuing units.

19. The public key cryptography based security system of claim 15 wherein the public repository means provides decryption private key history data to the second computing device.

20. A public key cryptography based method to facilitate secure roaming of users among at least a first computing device and a second computing device comprising the steps of:

storing per user security data including decryption private key history data that includes multiple private decryption keys associated with the same user;

storing, in a public remotely accessible repository, per user security data including the stored decryption private key history data to facilitate portable security capabilities; and

obtaining, for the second computing device, the decryption private key history data including the multiple private decryption keys from the public remotely accessible repository to facilitate decryption of encrypted data.

21. The public key cryptography based method of claim 20 wherein the step of obtaining the decryption private key history data includes obtaining, using a private key history request generator, decryption private key history data from the public repository.

22. The public key cryptography based method of claim 21 including communicating the requested decryption private key history data in response to receiving the decryption private key history request from the first computing unit.

23. The public key cryptography based method of claim 20 wherein the second computing device includes a decryption private key history request generator for obtaining decryption private key history data from the public repository.

24. The public key cryptography based system of claim 23 including communicating requested decryption private key history data in response to receiving the decryption private key history request.

25. The public key cryptography based method of claim 20 wherein the public repository includes per user security data further including at least one of:

encryption public key certificate data, signature verification public key certificate data, policy data, signing private key data and trusted verification public key data of certificate issuing units.

26. The public key cryptography based security method of claim 20 including providing decryption private key history data to the second computing device.

27. The public key cryptography based method of claim 20 including generating a new per user decryption private key and updating the decryption private key history data in accordance therewith.

28. The public key cryptography based method of claim 27 including the steps of receiving, by the first computing unit, the updated decryption private key history data from the non-public memory and communicating the updated decryption private key history data for storage in the public repository.

29. The public key cryptography based method of claim 27 including the step of communicating the new decryption private key history data for storage by the public repository.

30. The public key cryptography based method of claim 20 including the steps of generating a new per user decryption private key, updating the decryption private key history data in accordance therewith in both the first computing unit and in a storage device, and communicating the new decryption private key history data to the public repository.

31. The public key cryptography based method of claim 20 including the steps of:

generating a new decryption private key, transferring the new decryption private key to the storage means, updating the decryption private key history data and updating the decryption private key history data in the public repository.

32. The public key cryptography based method of claim 20 wherein the decryption private key history data includes a plurality of per user decryption private keys wherein at least one per user decryption private key corresponds to a non-current public key certificate.

33. A public key cryptography based method to facilitate secure roaming of users among at least a first computing device and a second computing device comprising:

storing per user security data including decryption private key history data wherein the decryption private key history data includes a plurality of per user decryption private keys associated with each of a plurality of users wherein at least one per user decryption private key corresponds to a non-current public key certificate;

storing, in a remotely accessible public repository, per user security data on a per user basis, including encrypted decryption private key history data stored in the storage means wherein the decryption private key history data includes a plurality of per user decryption private keys wherein at least one per user decryption private key corresponds to a non-current public key certificate, and encryption public key certificate data to facilitate portable security capabilities; and

obtaining the encrypted decryption private key history data including the multiple private decryption keys and the encryption public key certificate data from the public repository,

decrypting at least one private key in the encrypted decryption private key history data, and

decrypting encrypted data previously accessible by the first unit, based on the decryption private key history data stored in the public repository.

34. The public key cryptography based method of claim 33 including generating a decryption private key history request to request decryption private key data from the public key repository.

35. The public key cryptography based method of claim 34 including communicating requested decryption private key history data in response to receiving the decryption private key history request.

36. The public key cryptography based method of claim 35 wherein the public repository includes per user security data further including at least one of:

signing public key certificate data, policy data, signature verification private key data and trusted verification public key data of certificate issuing units.

37. A public key cryptography based security system to facilitate secure roaming of users among at least a first computing device and a second computing device comprising:

storage means for storing per user security data including decryption private key history data that includes multiple private decryption keys associated with the same user; and

public repository means, operatively coupled to the storage means, for storing remotely accessible per user security data including the decryption private key history data stored in the storage means to facilitate portable security capabilities.

38. The public key cryptography based security system of claim 37 wherein the public repository means includes means for communicating requested decryption private key history data in response to receiving the decryption private key history request.

39. The public key cryptography based security system of claim 37 wherein the public repository means includes per user security data further including at least one of:

encryption public key certificate data, signature verification public key certificate data, signing private key data, policy data and trusted verification public key data of certificate issuing units.

40. The public key cryptography based security system of claim 37 wherein the storage means includes means for generating a new per user decryption private key and updating the decryption private key history data in accordance therewith.

41. The public key cryptography based security system of claim 40 wherein the first computing unit receives the updated decryption private key history data from the storage means and communicates the updated decryption private key history data for storage by the public repository means.

42. The public key cryptography based security system of claim 37 wherein the storage means communicates the updated decryption private key history data for storage by the public repository means.