Multiple factor private portion of an asymmetric key

• US 7,630,493 B2
• Filed: 02/14/2005
• Issued: 12/08/2009
• Est. Priority Date: 01/18/2005
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: TriCipher, Inc. (Broadcom, Inc.)
• Inventors: Ganesan, Ravi, Schoppert, Brett Jason, Sandhu, Ravinderpal Singh, deSa, Colin Joseph, Bellare, Mihir
• Primary Examiner(s): LaForgia; Christian
• Assistant Examiner(s): Baum; Ronald
• Application Number:
  US11/056,120
• Publication Number:
  US 20060184788A1
• Time in Patent Office: 1,758 Days
• Field of Search: 380/44, 713/159
• US Class Current: 380/44
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 9/0847 involving identity based encryption [IBE] schemes
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Techniques for generating a private portion of a split private key of an asymmetric key pair are provided. Multiple factors upon which the private portion of the split private key is based are received. Each of these multiple factors is under control of a user associated with the asymmetric key pair. Multiple cryptographic operations are then performed using the received multiple factors to generate the private portion.

Claims

1. A method for generating a private portion of a split private key of an asymmetric key pair, comprising:

receiving multiple factors upon which the private portion is based, each of the multiple factors under control of a user associated with the asymmetric key pair; and

performing multiple cryptographic operations using the received multiple factors to generate the private portion.

2. The method of claim 1, wherein a first one of the multiple factors is not stored in a persistent state.

3. The method of claim 2, wherein the first factor is a password received from a user.

4. The method of claim 1, wherein a first one of the multiple factors is received from a first location, and a second one of the multiple factors is received from a second location different than the first location.

5. The method of claim 4, wherein the first location is a user computing device, and the second location is removable media.

6. The method of claim 1, wherein:

a first one of the multiple cryptographic operations is a hash function; and

a second one of the multiple cryptographic operations is a cryptographic signature.

7. The method of claim 1, wherein at least one of the multiple cryptographic operations is based upon less than all the multiple factors, and a final performed one of the multiple cryptographic operations is based upon all the multiple factors and produces a result, and further comprising:

performing a cryptographic operation based upon the produced result to generate the private portion.

8. The method of claim 7, wherein the cryptographic operation performed based upon the produced result is a password-based key derivation algorithm.

9. The method of claim 7, wherein:

the multiple factors are three factors;

a first factor is a text string;

a second factor is an entire private key of a first asymmetric key pair; and

a third factor is an entire private key of a second asymmetric key pair.

10. The method of claim 9, wherein the entire private key of the first asymmetric key pair is a first private key, and the entire private key of the second asymmetric key pair is a second private key, and further comprising:

determining a first hash of the text string to perform a first one of the multiple cryptographic operations;

signing the first hash with the first private key to perform a second one of the multiple cryptographic operations;

determining a second hash of the signed first hash to perform a third one of the multiple cryptographic operations; and

signing the second hash with the second private key to perform a fourth one of the multiple cryptographic operations, the signed second hash being the result.

11. A system for generating a private portion of a split private key of an asymmetric key pair, comprising:

a data repository configured to store at least one of multiple factors upon which the private portion is based, each of the multiple factors under control of a user associated with the asymmetric key pair; and

a processor configured to perform multiple cryptographic operations to generate the private portion.

12. The system of claim 11, wherein a first one of the multiple factors is not stored in a persistent state.

13. The system of claim 12, wherein the first factor is a password received from a user.

14. The system of claim 11, wherein a first one of the multiple factors is stored in the data repository, and a second one of the multiple factors is stored in a location other than the data repository.

15. The system of claim 14, wherein the data repository is a hard disk, and the other location is removable media.

16. The system of claim 11, wherein:

a first one of the multiple cryptographic operations is a hash function; and

a second one of the multiple cryptographic operations is a cryptographic signature.

17. The system of claim 11, wherein:

the multiple factors are three factors;

a first factor is a text string;

a second factor is an entire private key of a first asymmetric key pair; and

a third factor is an entire private key of a second asymmetric key pair.

18. The system of claim 11, wherein:

at least one of the multiple cryptographic operations is based upon less than all the multiple factors, and a final performed one of the multiple cryptographic operations is based upon all the multiple factors produces a result; and

the processor is further configured to perform a cryptographic operation based upon the produced result to generate the private portion.

19. The system of claim 18, wherein the cryptographic operation performed based upon the produced result is a password-based key derivation algorithm.

20. The system of claim 18, wherein:

the multiple factors are three factors;

a first factor is a text string;

a second factor is an entire private key of a first asymmetric key pair;

a third factor is an entire private key of a second asymmetric key pair;

the entire private key of the first asymmetric key pair is a first private key;

the entire private key of the second asymmetric key pair is a second private key; and

the processor is further configured to i) determine a first hash of the text string to perform a first one of the multiple cryptographic operations, ii) sign the first hash with the first private key to perform a second one of the multiple cryptographic operations, iii) determine a second hash of the signed first hash to perform a third one of the multiple cryptographic operations, and iv) sign the second hash with the second private key to perform a fourth one of the multiple cryptographic operations, the signed second hash being the result.