Information-centric security

• US 7,715,565 B2
• Filed: 07/29/2005
• Issued: 05/11/2010
• Est. Priority Date: 07/29/2004
• Status: Active Grant

• Current Assignee: Infoassure.Com., Inc., Infoassure Incorporated
• Original Assignee: Infoassure Incorporated
• Inventors: Kimmel, Gerald D., Domangue, Ersin L., Adamouski, Francis J.
• Primary Examiner(s): Orgad; Edan
• Assistant Examiner(s): Jackson; Jenise E
• Application Number:
  US11/193,607
• Publication Number:
  US 20060050870A1
• Time in Patent Office: 1,747 Days
• Field of Search: 380/281
• US Class Current: 380/281
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A system for encrypting a data encryption key includes a key encryption key generator configured to receive a public portion of a label, the label including an asymmetric key pair of the public portion and a private portion, the key encryption key generator being further configured to process the public portion of the label to obtain a key encryption key, and a data encryption key encoder configured to receive the key encryption key from the key encryption key generator and to receive a data encryption key from a random number generator, the encoder being further configured to encrypt the data encryption key using the key encryption key to produce an encrypted data encryption key and to provide the encrypted data encryption key to an encryption device.

Claims

1. A system for encrypting a data encryption key, the system comprising:

a key encryption key generator configured to receive a public key portion of a label, the label including an asymmetric key pair including of the public key portion and a private key portion, the key encryption key generator being further configured to process the public key portion of the label to obtain a key encryption key;

a data encryption key encoder configured to receive the key encryption key from the key encryption key generator and to receive a data encryption key from a random number generator, the encoder being further configured to encrypt the data encryption key using the key encryption key to produce an encrypted data encryption key and to provide the encrypted data encryption key to an encryption device for forwarding with data encrypted using the data encryption key;

and a combiner configured to receive and to combine at least two pieces of the label to provide the public key portion of the label to the key encryption key generator, wherein the at least two pieces of the label are the result of a parsing process applied to the label that produces pieces of the label, wherein each piece of the label is useless for indicating a key unless combined with at least one other piece of the label.

2. The system of claim 1 wherein the key encryption key generator is configured to receive public key portions of a plurality of labels and to generate a corresponding key encryption key corresponding to each public key label portion received, and wherein the encoder is configured to encrypt the data encryption key using each corresponding key encryption key received from the key encryption key generator to produce a plurality of encrypted data encryption keys.

3. The system of claim 2 further comprising the encryption device, wherein the encryption device is configured to encrypt a plaintext message using the data encryption key to produce ciphertext, and is further configured to transmit the ciphertext in association with each of the plurality of encrypted data encryption keys.

4. The system of claim 1 wherein the key encryption key generator is configured to multiply the public key portion and an ephemeral private key to produce a multiplication result.

5. The system of claim 4 wherein the key encryption key generator is further configured to combine the multiplication result and a unique identifier of the label associated with the public key portion multiplied to generate the key encryption key.

6. The system of claim 5 wherein the key encryption generator is configured to use a standard-based key derivation function to combine the multiplication result and the unique identifier.

7. The system of claim 1 wherein the key encryption generator and the data encryption key encoder comprise software instructions configured to cause a computer to perform the recited functions.

19. The system of claim 1, wherein the key encryption key generator is configured to generate the key encryption key using only the public key portion of the label.

26. The system of claim 1, wherein at least one of the at least two pieces of the label is required for being able to reconstruct the public key portion of the label, and wherein at least one of the at least two pieces of the label is an optional portion that enables the system to reconstruct the public key portion of the label.

8. A system for decrypting an encrypted data encryption key, the system comprising:

a key encryption key generator configured to receive a private key portion of a label, the label including an asymmetric key pair including a public key portion and the private key portion, the key encryption key generator being further configured to process the private key portion of the label to obtain a key encryption key;

a data encryption key decoder configured to receive the key encryption key from the key encryption key generator and to receive an encrypted data encryption key associated with ciphertext, the decoder being further configured to decrypt the data encryption key using the key encryption key to produce an unencrypted data encryption key and to provide the unencrypted data encryption key to a decryption device;

and a combiner configured to receive and to combine at least two pieces of the label to provide the public key portion of the label to the key encryption key generator, wherein the at least two pieces of the label are the result of a parsing process applied to the label that produces pieces of the label, wherein each piece of the label is useless for indicating a key unless combined with at least one other piece of the label.

9. The system of claim 8 wherein the received encrypted data encryption key was encrypted using multiple key encryption keys, one of which corresponds to the label.

10. The system of claim 8 wherein the key encryption generator and the data encryption key decoder comprise software instructions configured to cause a computer to perform the recited functions.

20. The system of claim 8, wherein the key encryption key generator is configured to generate the key encryption key using only the private key portion of the label.

27. The system of claim 8, wherein at least one of the at least two pieces of the label is required for being able to reconstruct the private key portion of the label, and wherein at least one of the at least two pieces of the label is an optional portion that enables the system to reconstruct the private key portion of the label.

11. A cryptographic system for providing cryptographic key management, the system comprising:

a communications interface configured to communicate electronically with a plurality of clients;

a memory configured to store at least one of a public key portion and a private portion of a cryptographic key pair associated with different levels of access; and

a key management module configured and connected to communicate with the interface and the memory and configured to;

split public and private key portions of encryption keys into pieces, wherein each piece is useless for indicating a key unless combined with at least one other piece;

provide access by one or more clients through the communication interface to public and private key portions if the one or more clients satisfy at least one authentication mechanism associated with a first security level at least as high as a second security level associated with the key portions that the one or more clients desire to access, wherein the access is provided by providing to the one or more clients access to one or more pieces of the public and/or private key portions based on results of the at least one authentication mechanism; and

to enable at least one of the clients to encrypt a data encryption key, based on the one or more pieces of the public and/or private key portions to which the at least one of the clients is provided with access, wherein the data encryption key is to be used in encrypting a plaintext message.

12. The system of claim 11 wherein the key management module is further configured to actively audit client interactions with the system and activity of the key management module.

13. The system of claim 12 wherein the key management module is further configured to monitor and report authorized information accesses and unauthorized information access attempts by clients.

14. The system of claim 12 wherein the key management module is configured to encrypt the data encryption key for each of a plurality of public key portions received associated with a plurality of encryption keys.

15. The system of claim 12 wherein the key management module is further configured to assign roles to clients and to associate with the clients an indication of what information sensitivity level or levels each client is authorized to access.

16. The system of claim 11 wherein the key management module is further configured to provide full tokens to members where the tokens enable the members to encrypt and decrypt information.

17. The system of claim 16 wherein the key management module is configured to encrypt a full asymmetric key pair using a member'"'"'s write-only key and sign the encrypted key pair with a digital certificate to produce the full token.

18. The system of claim 11 wherein the key management module is protected within a software application by an encapsulation technique against malicious code attacks.

22. The system of claim 11, wherein the key management module is configured to split the public and private key portions into pieces that are combinable to regenerate at least one of the public or private key portions, wherein fewer than all of the pieces are required to regenerate at least one of the public or private key portions.

23. The system of claim 11, wherein at least one particular piece is required in combination with at least one other piece to regenerate at least one of the public or private key portions.

24. The system of claim 23, wherein the key management module is configured to provide access to at least one client by providing to the client at least one other piece, based on the client'"'"'s security level, to be combined with the at least one particular piece.

21. A computer program product for encrypting/decrypting information, the computer program-product residing on a computer-readable medium and comprising computer-readable instructions configured to cause a computer to:

receive a public key portion of a label for key encryption and to receive a private key portion of the label for key decryption, the label including an asymmetric key pair including the public and private key portions;

cause the computer to produce the public and private key portions of the label by combining portions of the public and private key portions, wherein the portions of the public and private key portions of the label are the result of a parsing process applied to the label that produces portions of the label, wherein each portion of the label is useless for indicating a key unless combined with at least one other portion of the label;

process the public key portion and an ephemeral private key to obtain a key encryption key for information encryption and to process the private key portion and an ephemeral public key to obtain the key encryption key for information decryption;

for information encryption;

receive a data encryption key from a random number generator;

encrypt the data encryption key using the key encryption key to produce an encrypted data encryption key; and

provide the encrypted data encryption key to an encryption device; and

for information decryption;

receive the key encryption key and an encrypted data encryption key associated with ciphertext;

decrypt the data encryption key using the key encryption key to produce an unencrypted data encryption key; and

provide the unencrypted data encryption key to a decryption device.

25. The system of claim 21, wherein the ephemeral public key and the ephemeral private key form an asymmetric key pair.

28. The computer program product of claim 21, wherein the instructions configured to cause the processor to process the public key portion and an ephemeral private key and to cause the processor to process the private key portion and an ephemeral public key are configured to process only the public key portion of the label and only the private key portion of the label, respectively.

29. The computer program product of claim 21 wherein the instructions configured to cause the processor to process the public key portion and an ephemeral private key to obtain the key encryption key for information encryption cause the processor to multiply the public key portion and the ephemeral private key and to apply a standards-based key derivation function.

30. The computer program product of claim 21 further comprising instructions configured to cause the computer to encrypt a plaintext message using the data encryption key to produce ciphertext, and to transmit the ciphertext in association with the encrypted data encryption key.

31. The computer program product of claim 30 wherein the instructions configured to cause the computer to produce the encrypted data encryption key are configured to cause the computer to produce a plurality of encrypted data encryption keys each being produced using at least one of a plurality of received public key portions of labels, and wherein the instructions configured to cause the computer to transmit the ciphertext in association with the encrypted data encryption key cause the computer to transmit the ciphertext in association with the plurality of encrypted data encryption keys.

32. The computer program product of claim 21 wherein the received encrypted data encryption key was encrypted using multiple key encryption keys, one of which corresponds to the label.