Hybrid symmetric/asymmetric cryptography with user authentication

• US 8,189,788 B2
• Filed: 07/15/2005
• Issued: 05/29/2012
• Est. Priority Date: 07/15/2005
• Status: Active Grant

• Current Assignee: Tyfone Incorporated
• Original Assignee: Tyfone Incorporated
• Inventors: Narendra, Siva G., Tadepalli, Prabhakar, Spitzer, Thomas N.
• Primary Examiner(s): HOFFMAN, BRANDON S
• Application Number:
  US11/182,920
• Publication Number:
  US 20070014408A1
• Time in Patent Office: 2,510 Days
• Field of Search: None
• US Class Current: 380/270
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics

Abstract

A device uses a user authentication factor to generate an asymmetric decryption key for use in cryptography. An asymmetric encryption key is generated from the asymmetric decryption key using a one-way function, and the asymmetric encryption key is used to encrypt a symmetric key.

Claims

1. A method for encrypting data on a mobile device comprising:

receiving at least one user authentication factor to authenticate a user to the mobile device;

generating an asymmetric decryption key from the at least one user authentication factor;

generating an asymmetric encryption key from a one-way function of the asymmetric decryption key; and

encrypting a symmetric key using the asymmetric encryption key.

2. The method of claim 1 wherein the at least one user authentication factor includes a unique ID for a hardware device.

3. The method of claim 2 wherein the hardware device comprises a hardware device physically separate from an apparatus performing the method.

4. The method of claim 2 wherein the hardware device comprises a hardware device physically separable from an apparatus performing the method.

5. The method of claim 1 wherein the at least one user authentication factor includes a biometric factor.

6. The method of claim 1 wherein the at least one user authentication factor includes a unique ID for a hardware device and a biometric factor.

7. The method of claim 1 wherein generating an asymmetric decryption key comprises setting the asymmetric decryption key equal to the at least one user authentication factor.

8. The method of claim 1 further comprising encrypting the at least one user authentication factor using the asymmetric encryption key to produce an encrypted at least one user authentication factor.

9. The method of claim 8 further comprising:

storing the encrypted symmetric key;

storing the asymmetric encryption key; and

storing the encrypted at least one user authentication factor.

10. A method for decrypting data stored on a mobile device comprising:

receiving at least one user authentication factor to authenticate a user to the mobile device;

generating an asymmetric decryption key from the at least one user authentication factor; and

decrypting a stored symmetric key using the asymmetric decryption key.

11. The method of claim 10 further comprising encrypting the at least one user authentication factor using a stored asymmetric encryption key to produce a result, and comparing the result with a stored encrypted user authentication factor.

12. The method of claim 10 wherein the at least one user authentication factor includes a unique ID for a hardware device.

13. The method of claim 12 wherein the hardware device comprises a hardware device physically separate from an apparatus performing the method.

14. The method of claim 12 wherein the hardware device comprises a hardware device physically separable from an apparatus performing the method.

15. The method of claim 10 wherein the at least one user authentication factor includes a biometric factor.

16. The method of claim 10 wherein the at least one user authentication factor includes a unique ID for a hardware device and a biometric factor.

17. A mobile device with a machine accessible device having instructions stored thereon that when accessed result in the mobile device performing:

receiving at least one user authentication factor to authenticate a user to the mobile device;

generating an asymmetric decryption key from the at least one user authentication factor;

generating an asymmetric encryption key from a one-way function of the asymmetric decryption key; and

encrypting a symmetric key using the asymmetric encryption key.

18. The mobile device of claim 17 wherein the at least one user authentication factor includes a unique ID for a hardware device.

19. The mobile device of claim 18 wherein the hardware device comprises a hardware device physically separate from the mobile device performing the method.

20. The mobile device of claim 18 wherein the hardware device comprises a hardware device physically separable from the mobile device performing the method.

21. The mobile device of claim 17 wherein the at least one user authentication factor includes a biometric factor.

22. The mobile device of claim 17 wherein the at least one user authentication factor includes a unique ID for a hardware device and a biometric factor.

23. A mobile device with a machine accessible device having instructions stored thereon that when accessed result in the mobile device performing:

receiving at least one user authentication factor to authenticate a user to the mobile device;

generating an asymmetric decryption key from the at least one user authentication factor; and

decrypting a stored symmetric key using the asymmetric decryption key.

24. The mobile device of claim 23 wherein the instructions, when accessed, further result in the mobile device performing:

encrypting the at least one user authentication factor using a stored asymmetric encryption key to produce a result, and comparing the result with a stored encrypted user authentication factor.

25. The mobile device of claim 23 wherein the at least one user authentication factor includes a unique ID for a hardware device.

26. The mobile device of claim 25 wherein the hardware device comprises a hardware device physically separate from the mobile device performing the method.

27. The mobile device of claim 25 wherein the hardware device comprises a hardware device physically separable from the mobile device performing the method.

28. The mobile device of claim 23 wherein the at least one user authentication factor includes a biometric factor.

29. The mobile device of claim 23 wherein the at least one user authentication factor includes a unique ID for a hardware device and a biometric factor.

30. A computer system for storing and accessing encrypted data, comprising:

a user authentication factor collection component to receive at least one user authentication factor to authenticate a user to the computer system;

an asymmetric decryption key generation component to generate an asymmetric decryption key from the at least one user authentication factor;

an asymmetric encryption key generation component to generate an asymmetric encryption key from the asymmetric decryption key using a one-way function;

a symmetric encryption/decryption process component to encrypt data using a symmetric encryption key; and

an asymmetric encryption/decryption process component to encrypt the symmetric key using the asymmetric encryption key.

31. The computer system of claim 30 further comprising a storage component to store the asymmetric encryption key and the encrypted symmetric key.

32. The computer system of claim 30 wherein the user authentication factor collection component is configured to receive a unique ID for a hardware device as a user authentication factor.

33. The computer system of claim 32 wherein the hardware device comprises a hardware device physically separable from the computer system.

34. The computer system of claim 30 wherein the user authentication factor collection component is configured to receive a biometric factor as a user authentication factor.

35. The computer system of claim 30 wherein the user authentication factor collection component is configured to receive a unique ID for a hardware device and a biometric factor as user authentication factors.

36. A handheld device to store encrypted data, comprising:

a biometric collection device to collect a biometric user authentication factor to authenticate a user to the handheld device; and

a hybrid symmetric/asymmetric cryptography engine to generate an asymmetric decryption key from the biometric user authentication factor, to generate an asymmetric encryption key from the asymmetric decryption key, and to encrypt a symmetric key using the asymmetric encryption key.

37. The handheld device of claim 36 wherein the biometric collection device comprises a fingerprint collection device.

38. The handheld device of claim 36 wherein the biometric collection device comprises a retinal scanner.

39. The handheld device of claim 36 further comprising a wireless interface to receive a unique ID from a wireless device.

40. The handheld device of claim 39 wherein the hybrid symmetric/asymmetric cryptography engine is configured to generate the asymmetric decryption key from the unique ID and the biometric user authentication factor.