Access control and authorization system

• US 6,490,680 B1
• Filed: 12/04/1998
• Issued: 12/03/2002
• Est. Priority Date: 12/04/1997
• Status: Expired due to Term

• Current Assignee: TecSec, Incorporated
• Original Assignee: TecSec, Incorporated
• Inventors: Domangue, Ersin L., Scheidt, Edward M.
• Primary Examiner(s): BARRON JR, GILBERTO
• Application Number:
  US09/205,221
• Time in Patent Office: 1,460 Days
• Field of Search: 713/159, 713/166, 713/176, 713/185, 380/277, 380/286
• US Class Current: 713/166
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A process of encrypting an object includes applying a hash algorithm to the object, generating a random number, combining a first plurality of splits including the random number to form a working split, encrypting the object using the working split, combining a second plurality of splits not including the random number to form a value, encrypting the random number using the value, encrypting the hashed object according to a signature algorithm using a user private key, encrypting the hashed object according to a selected algorithm using the working split as a key, forming a header including information that can be used to decrypt the object, encrypting the header, and adding the encrypted header to the encrypted object. The pluralities of splits include a fixed split, a variable split, and a label split corresponding to a selected label. The header includes the encrypted random number, a label, and a digital signature.

Claims

1. A process of securing an object, comprising:

applying a cryptographic hash algorithm to the object to provide a hash value;

storing the hash value on a token;

generating a random key component;

combining a first plurality of key components to form a first key;

encrypting the object using the first key;

combining a second plurality of key components to form a second key;

encrypting the random key component using the second key to form an encrypted key component;

encrypting the hash value according to a digital signature algorithm using a user private key, to provide a digital signature;

encrypting the hash value according to a user algorithm using the first key;

forming a header including information that can be used to decrypt the encrypted object, wherein the information includes the user algorithm, the encrypted key component, and decrypt read credentials;

encrypting the header; and

adding the encrypted header to the encrypted object;

wherein the first plurality of key components includes the random key component, and the second plurality of key components does not include the random key component.

2. The process of claim 1, wherein the user algorithm is selected from among a plurality of user algorithms.

3. The process of claim 1, wherein the first plurality of key components includes a fixed organization key component.

4. The process of claim 1, wherein the first plurality of key components includes a variable maintenance key component.

5. The process of claim 1, further comprising:

selecting at least one permission instance from a plurality of permission instances;

wherein the first plurality of key components includes a label key component corresponding to the at least one selected permission instance.

6. The process of claim 1, wherein the random key component is generated on the token.

7. The process of claim 1, wherein the header is encrypted on the token.

8. The process of claim 5, wherein the second plurality of key components includes a fixed organization key component, a variable maintenance key component, and the label key component.

9. The process of claim 5, wherein the header further includes the encrypted key component, the at least one selected permission instance, and the digital signature.

10. A process of decrypting an object secured according to the process of claim 1, comprising:

decrypting the header to recover the information that can be used to decrypt the encrypted object, wherein the information includes the encrypted key component, the user algorithm, and the decrypt read credentials;

checking at least some of the information that can be used to decrypt the encrypted object against the decrypt read credentials;

using the second plurality of key components to recover the random key component;

using the first plurality of key components to recover the first key; and

decrypting the encrypted object using the algorithm and the first key.