Administration and utilization of private keys in a networked environment

• US 6,925,182 B1
• Filed: 12/19/1997
• Issued: 08/02/2005
• Est. Priority Date: 12/19/1997
• Status: Expired due to Fees

• Current Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Original Assignee: Koninklijke Philips Electronics N.V. (Koninklijke Philips N.V.)
• Inventors: Epstein, Michael A.
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US08/994,878
• Time in Patent Office: 2,783 Days
• Field of Search: 713/168, 713/171, 713/182, 713/186, 713/189, 713/193, 713/200, 713/201, 713/183, 713/184, 713/185, 380/277, 380/278, 380281-282, 380283-286, 380/21, 380/23, 380/25, 380/49, 380/279
• US Class Current: 380/277
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

The private and public keys of users, as encrypted with a symmetric algorithm by using individual user identifying keys are stored at a network server, indexed or addressable by user ID, and are sent to the user equipment only when needed. The user identifying keys are determined by hashing the users'"'"' respective passphrases or biometric information. After use, the private key and user identifying key are not retained at the user equipment. The encrypted private key is transmitted via the network to the user equipment along with a document to be approved by the user (in the case where the private key is used for digital signature) and, at the user equipment, the received encrypted private key is decrypted using a key determined at the user equipment by hashing either the user'"'"'s passphrase, which is entered by the user, or the user'"'"'s biometric information which is obtained by measurement or scanning the user. The received document is modified or merely reviewed, and a digital signature signifying the user'"'"'s approval, is formed as a hash of the approved document encrypted using the user'"'"'s private key. The digital signature and document are transmitted to the server, where verification takes place.

Claims

1. A method for obtaining and using a private key at user equipment via a network, said method comprising:

transmitting from the user equipment an ID of a user;

receiving ecrypted private key of the user that is encrypted with a user identifying key associated with the user;

interacting with the user at the user equipment to determine the user identifying key; and

decrypting the encrypted private key using the user identifying key to obtain a decrypted private key,

using the decrypted private key, and

destroying all copies of the encrypted private key and all copies of the decrypted private key at the location of the user.

2. The method of claim 1, wherein

interacting with the user includes obtaining a passphrase from the user.

3. A method as claimed in claim 1, wherein

using the decrypted private key includes:

computing a hash of a document to manifest the user'"'"'s approval of the document;

encrypting the hash using the users private key; and

transmitting the encrypted bash.

4. A method as claimed in claim 2, wherein

using the decrypted private key includes:

computing a hash of a document to manifest the user'"'"'s approval of the document;

encrypting the hash using the user'"'"'s private key; and

transmitting the encrypted hash.

5. The method of claim 1, wherein

interacting with the user includes obtaining biometric information from the user.

6. The method of claim 5, wherein

using the decrypted private key includes:

computing a hash of a document to manifest the user'"'"'s approval of the document;

encrypting the hash using the user'"'"'s private key; and

transmitting the encrypted hash.