Secure method for roaming keys and certificates
First Claim
Patent Images
1. In an Internet based network comprising at least one server and at least one client which enables users to communicate with said at least one server, a method for encrypted communications using private keys and certificates, comprising steps of:
- (a) a user choosing a username and a passphrase via said at least one client;
(b) said at least one client generating a private key and a public key using random data collected from said user and other sources that cannot be accessed by said at least one server;
(c) calculating a first hash value of said passphrase using an algorithm;
(d) calculating an authentication value based on said private key and said passphrase, wherein said authentication value comprises a separate entity distinct from said private key and said passphrase;
(e) concatenating said private key and said authentication value, and encrypting said private key concatenated with said authentication value using said passphrase;
(f) submitting said username, along with said first hash value, said encrypted private key concatenated with said authentication value, and said public key to said at least one server over a secure channel;
(g) said at least one server checking whether a record of said user exists in a database associated with said at least one server;
(h) if a check result of (g) is yes, then verifying access to said user'"'"'s record by comparing said first hash value with a stored hash value of said passphrase;
(i) if a check result of (g) is no, then creating a record for said user;
(j) creating and signing a certificate that certifies said username and said public key;
(k) storing said first hash value, said encryption result and said certificate in said user'"'"'s record; and
(l) returning a confirmation to said at least one client.
11 Assignments
0 Petitions
Accused Products
Abstract
A simple scheme is provided for server storage of private keys and certificates in a secure manner, thus solving the difficult problems of roaming certificates. A user can access his private keys and certificates from anywhere in the network. Despite that the server stores the user'"'"'s private keys, the server must not be able to impersonate the user on a network or sign messages for the user. A scheme for truly secure transactions is also provided.
-
Citations
11 Claims
-
1. In an Internet based network comprising at least one server and at least one client which enables users to communicate with said at least one server, a method for encrypted communications using private keys and certificates, comprising steps of:
-
(a) a user choosing a username and a passphrase via said at least one client; (b) said at least one client generating a private key and a public key using random data collected from said user and other sources that cannot be accessed by said at least one server; (c) calculating a first hash value of said passphrase using an algorithm; (d) calculating an authentication value based on said private key and said passphrase, wherein said authentication value comprises a separate entity distinct from said private key and said passphrase; (e) concatenating said private key and said authentication value, and encrypting said private key concatenated with said authentication value using said passphrase; (f) submitting said username, along with said first hash value, said encrypted private key concatenated with said authentication value, and said public key to said at least one server over a secure channel; (g) said at least one server checking whether a record of said user exists in a database associated with said at least one server; (h) if a check result of (g) is yes, then verifying access to said user'"'"'s record by comparing said first hash value with a stored hash value of said passphrase; (i) if a check result of (g) is no, then creating a record for said user; (j) creating and signing a certificate that certifies said username and said public key; (k) storing said first hash value, said encryption result and said certificate in said user'"'"'s record; and (l) returning a confirmation to said at least one client. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. An Internet based network for secure communications using private keys and certificates, comprising:
-
at least one server; and at least one client via which a user logs in said network by entering a username and a passphrase; wherein said at least one client is operable to; generate a private key and a public key using random data collected from said user and other sources that cannot be accessed by said at least one server; calculate a hash result of said passphrase using an algorithm; calculate an authentication value based on said private key and said passphrase, wherein said authentication value comrprises a separate entity distinct from said private key and said passphrase; concatenate said private key and said authentication value, and encrypt said private key concatenated with said authentication value using said passphrase; submit said username, along, with said hash result, said encrypted private key concatenated with said authentication value and said public key to said at least one server over a secure channel; wherein said at least one server is operable to; check whether a record of said user exists in a database associated with said at least one server; if the check result is yes, verify access to said user'"'"'s record by comparing said hash result with a stored hash value of said passphrase; if the check result is no, create said record for said user; create and sign a certificate that certifies said username and said public key; store said hash result and said certificate in said user'"'"'s record; and return a confirmation to said at least one client. - View Dependent Claims (8, 9, 10, 11)
-
Specification