Cryptographic key construct

• US 7,739,501 B2
• Filed: 07/29/2005
• Issued: 06/15/2010
• Est. Priority Date: 07/29/2004
• Status: Active Grant

• Current Assignee: James G. Lightburn
• Original Assignee: Infoassure Incorporated
• Inventors: Kimmel, Gerald D., Domangue, Ersin L.
• Primary Examiner(s): Simitoski; Michael J
• Application Number:
  US11/193,911
• Publication Number:
  US 20060218400A1
• Time in Patent Office: 1,782 Days
• Field of Search: 713/168, 380/30, 380/38, 380/265, 380/44, 380/47
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A computer program product, for producing a cryptographic key label for use in exchanging information between first and second organizations of members, resides on a computer-readable medium includes computer-readable instructions configured to cause a computer to: produce a read-write cryptographic key using at least one base value; produce a write-only cryptographic key using the read-write cryptographic key; combine a first identifier, uniquely associated with the first organization, and a second identifier, uniquely associated with the key label to be produced, using a one-way function to produce a pedigree; and associate the pedigree with the read-write key and the write-only key to form the cryptographic key label.

Claims

1. A computer program product residing on a computer-readable storage medium and comprising computer-readable instructions configured to cause a computer to:

use a first one-way, forward-recursive function to produce a first sequence of forward cryptographic base values;

use a second one-way, backward-recursive function to produce a second sequence of backward cryptographic base values; and

combine corresponding forward and backward cryptographic base values to produce a third sequence of cryptographic keys.

2. The computer program product of claim 1, wherein the instructions configured to cause a computer to combine the base values are configured to cause the computer to combine an nth forward cryptographic base value of the first sequence and a (m−

n+1)^th backward cryptographic base value of the second sequence to produce an nth one of the cryptographic keys of the third sequence.

3. The computer program product of claim 1, further comprising key-production instructions configured to cause the computer to send, toward a recipient, at least one of the base values from at least one of the sequences to a recipient, wherein the at least one of the base values corresponds to a limit on which cryptographic keys of the third sequence the recipient will be able to produce.

4. The computer program product of claim 3, wherein the key-production instructions are configured to cause the computer to send one of the forward base values from the first sequence and one of the backward base values from the second sequence wherein the forward base value from the first sequence and the backward base value from the second sequence correspond to a limited range of which of the cryptographic keys of the third sequence the recipient will be able to produce.

5. The computer program product of claim 4, wherein the range is a consecutive group of the cryptographic keys in the third sequence.

6. The computer program product of claim 1, wherein to combine corresponding forward and backward cryptographic base values to produce a third sequence of cryptographic keys comprises combining exactly one forward cryptographic base value from the first sequence and exactly one backward cryptographic base value from the second sequence.

7. A computer-implemented cryptographic method comprising:

generating a first sequence of forward cryptographic base values using a one-way, forward-recursive function;

generating a second sequence of backward cryptographic base values using a one-way, backward-recursive function; and

combining corresponding forward and backward cryptographic base values to produce a third sequence of cryptographic keys.

8. The method of claim 7, wherein the combining comprises combining an nth forward cryptographic base value of the first sequence and a (m−

n+1)^th backward cryptographic base value of the second sequence to produce an nth one of the cryptographic keys of the third sequence.

9. The method of claim 7, further comprising sending, toward a recipient, at least one of the base values from at least one of the sequences to a recipient, wherein the at least one of the base values corresponds to a limit on which cryptographic keys of the third sequence the recipient will be able to produce.

10. The method of claim 9, wherein the sending comprises sending one of the forward base values from the first sequence and one of the backward base values from the second sequence, wherein the forward base value from the first sequence and the backward base value from the second sequence correspond to a limited range of which of the cryptographic keys of the third sequence the recipient will be able to produce.

11. The method of claim 10, wherein the range is a consecutive group of the cryptographic keys in the third sequence.

12. The method of claim 7, wherein the combining comprises combining exactly one forward cryptographic base value from the first sequence and exactly one backward cryptographic base value from the second sequence.