Method for providing authentication assurance in a key-binding system

• US 6,405,313 B1
• Filed: 04/23/1998
• Issued: 06/11/2002
• Est. Priority Date: 04/25/1997
• Status: Expired due to Fees

• Current Assignee: AT&T Corporation (AT&T, Inc.)
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Reiter, Michael Kendrick, Stubblebine, Stuart Gerald
• Primary Examiner(s): BARRON JR, GILBERTO
• Application Number:
  US09/064,769
• Time in Patent Office: 1,510 Days
• Field of Search: 380/280, 713/175, 713/155-156, 713/170, 713/157, 713/775, 709/241, 709/209, 709/229, 709/201, 709/238
• US Class Current: 713/156
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model

Abstract

A name-to-target binding system generates certificates for use in authenticating a target key. In the system the certificate includes a first key. At least one attribute is assigned to the first key. A liability value is assigned to the combination of the first key and the at least one attribute. The system includes a second key used to sign a combination of the first key, the at least one attribute and the liability value wherein the second key is associated with the insurer agreeing to be liable for the liability value.

Claims

1. A method for determining a minimum assurance of a name-to-key binding for a target key, the method comprising the steps of:

a) identifying a plurality of paths from a source key to the target key, each path including at least one edge and at least two nodes;

b) dividing the nodes into a first set and a second set wherein said source key is associated with said first set and said target key is associated with said second set;

c) evaluating edges between said first and said second set to determine a cut insurance amount;

d) repeating steps b) and c) such that at least one node is moved between the first and second sets and until a minimum cut insurance amount is determined; and

e) providing the determined minimum cut insurance amount.

2. A method for determining a minimum assurance of a name to key binding for a target key, the method comprising the steps of:

a) identifying a plurality of paths from a source key to the target key, each path including a plurality of nodes;

b) analyzing a certificate from every node intermediate to said source key and said target key, said step of analyzing including the step of determining an insurance indicator contained in the certificates of the respective nodes;

c) calculating a minimum assurance using the determined insurance indicators; and

d) providing the calculated minimum assurance.

3. The method of claim 2 wherein said step of calculating the minimum assurance comprises the substeps of:

i) dividing the nodes into a first set and a second set, wherein said source key is in said first set and said target key is in said second set;

ii) evaluating edges between said first set and said second set to determine a cut insurance amount;

iii) dividing the nodes into another pair of sets, each set in said another pair of sets differing from any previously created sets of the nodes;

iv) evaluating edges between said another pair of sets to determine a cut insurance amount; and

v) repeating steps iii) and iv) until a minimum cut insurance amount is determined.

4. The method of claim 3 wherein said steps of evaluating edges includes examining an insurance indicator contained in certificates associated with the edges.