Cryptographic method and system

• US 8,842,841 B2
• Filed: 08/16/2013
• Issued: 09/23/2014
• Est. Priority Date: 02/20/2012
• Status: Active Grant

• Current Assignee: KL Data Security Pty Limited
• Original Assignee: Lock Box Pty Limited
• Inventors: Hook, David Geoffrey, Harvey, Richard Hans, Dettman, Peter Kai
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Pan, Peiliang
• Application Number:
  US13/969,071
• Publication Number:
  US 20140164776A1
• Time in Patent Office: 403 Days
• Field of Search: 380/284, 380/277, 380/278, 380/283, 713/171
• US Class Current: 380/284
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

The present invention relates to the field of security of electronic data and/or communications. In one form, the invention relates to data security and/or privacy in a distributed and/or decentralised network environment. In another form, the invention relates to enabling private collaboration and/or information sharing between users, agents and/or applications. Embodiment(s) of the present invention enable the sharing of key(s) and/or content between a first user and/or agent and a second user and/or agent. Furthermore, embodiment(s) of the present invention have application in sharing encrypted information via information sharing services.

A number of inventions, aspects and embodiments are disclosed herein.

Claims

1. A method of enabling the provisioning of keys between a first user and a second user, the first user having a first computer, a first key and a first bootstrap key, and the second user having a second computer and a second key, the method comprising the steps of:

the first computer encrypting the first key with the first bootstrap key;

the first user providing the encrypted first key to the second user via a first data store;

the first user providing to the second user the first bootstrap key and in a manner independent of the first data store;

the second computer decrypting the encrypted first key with the first bootstrap key for use by the second user;

the second computer encrypting the second key with the first key;

the second user providing the encrypted second key to the first user via a second data store; and

the first computer decrypting the encrypted second key with the first key for use by the first user.

2. The method as claimed in claim 1, wherein the first data store and the second data store are the same data store.

3. The method as claimed in claim 1, further comprising the step of:

a third user having a third computer and a third key;

the first user having a second bootstrap key;

the first computer encrypting the first key with the second bootstrap key;

the first user providing the encrypted first key to the third user via a third data store;

the first user providing to the third user the second bootstrap key and in a manner independent of the third data store;

the third computer decrypting the encrypted first key with the second bootstrap key for use by the third user;

the third computer encrypting the third key with the first key;

the third user providing the encrypted third key to the first user via a fourth data store; and

the first computer decrypting the encrypted third key with the first key for use by the first user.

4. The method as claimed in claim 3, wherein any one or any combination of the first data store, the second data store, the third data store and the fourth data store are the same data store.

5. The method as claimed in claim 1, wherein any encrypted key is provided to any data store at different times.

6. The method as claimed in claim 1, further comprising any one or any combination of encrypted keys is replicated from any data store to any further data store(s).

7. The method as claimed in claim 1, further comprising:

reusing any key to enable the encryption of further keys.

8. The method as claimed in claim 1, wherein at least one user is any one of or any combination of an agent(s), entity(s), person(s), organisation(s), application(s), service(s), any other interface(s).

9. The method as claimed in claim 1, further comprising the first and/or second key is used to encrypt any one or any combination of:

Certificate(s)

Key(s)

Task(s)

Message(s)

Authorisation(s)

Token(s)

Content

Information

Data

Meta-data

Stream(s)

Packet(s)

Box Data

Application Data

Application Field(s)

Database Field(s)

Anything communicable in digital form.

10. The method as claimed in claim 1, wherein at least one user can create and/or manage the lifecycle of and/or rollover and/or distribution of keys.

11. The method as claimed in claim 1, further comprising the first and/or second key being used by at least one user to decentralise any one or any combination of:

access management

authorisation management

certificate management

content management

credential management

entitlements management

identity management

key management

provisioning management

privacy management

privilege management

recovery management

rights management

role management

security management

storage management

trust management.

12. The method as claimed in claim 1, further comprising:

providing a credential layer adapted to establish the existence of credentials for each user.

13. The method as claimed in claim 1, further comprising:

providing a trust layer adapted to enable communication via the data store of encrypted data between the users and to enable the exchange of encrypted keys.

14. The method as claimed in claim 1, further comprising:

providing a control layer adapted to manage symmetric keys and other system information protected by encryption.

15. The method as claimed in claim 1 further comprising:

providing a sharing layer adapted to encrypt content or other end user information.

16. The method as claimed in claim 1, wherein at least one of the first key and the second key is a part of a certificate of a certificate based credential.

17. The method as claimed in claim 16, wherein the certificate-based credential may be obtained from any provider or be of any format.

18. The method as claimed in claim 16, further comprising:

providing a digital signature in association with any one or any combination of encrypted keys.

19. A computer readable storage medium for storing in non-transient form an application for executing a method of enabling the provisioning of keys between a first user and a second user, the first user having a first computer, a first key and a first bootstrap key, and the second user having a second computer and a second key, the method comprising the steps of:

the first computer encrypting the first key with the first bootstrap key;

the first user providing the encrypted first key to the second user via a first data store;

the first user providing to the second user the first bootstrap key and in a manner independent of the first data store;

the second computer decrypting the encrypted first key with the first bootstrap key for use by the second user;

the second computer encrypting the second key with the first key;

the second user providing the encrypted second key to the first user via a second data store; and

the first computer decrypting the encrypted second key with the first key for use by the first user.

20. A system operative on the basis of a provisioning of keys between a first user and a second user, comprising:

a first computer operable by the first user, the first computer having access to a first key and a first bootstrap key,

a second computer operable by the second user, the second computer having access to a second key, and

at least one data store,

wherein the first computer is operative to encrypt the first key with the first bootstrap key;

wherein the encrypted first key is provided to the second user via a first data store;

wherein the first user provides to the second user the first bootstrap key and in a manner independent of the first data store;

wherein the second computer is operative to decrypt the encrypted first key with the first bootstrap key for use by the second user;

wherein the second computer is operative to encrypt the second key with the first key;

wherein the second user provides the encrypted second key to the first user via a second data store; and

wherein the first computer is operative to decrypt the encrypted second key with the first key for use by the first user.

21. The system as claimed in claim 20, wherein the first data store and the second data store are the same data store structure.

22. The system as claimed in claim 20, further comprising:

a third computer operable by a third user, the third computer having access to a third key; and

a third data store and a fourth data store,

wherein the first user has access to a second bootstrap key;

wherein the first computer is operative to encrypt the first key with the second bootstrap key;

wherein the first user provides the encrypted first key to the third user via the third data store;

wherein the first user provides to the third user the second bootstrap key and in a manner independent of the third data store;

wherein the third computer is operative to decrypt the encrypted first key with the second bootstrap key for use by the third user;

wherein the third computer is operative to encrypt the third key with the first key;

wherein the third user provides the encrypted third key to the first user via the fourth data store; and

wherein the first computer is operative to decrypt the encrypted third key with the first key for use by the first user.

23. The system as claimed in claim 22, further comprising a computer reusing any key to enable the encryption of further keys.

24. The system as claimed in claim 20, wherein at least one user is any one of or any combination of an agent(s), entity(s), person(s), organisation(s), application(s), service(s), any other interface(s).

25. The system as claimed in claim 20, wherein the first and / or second key is used to encrypt any one or any combination of:

Certificate(s)

Key(s)

Task(s)

Message(s)

Authorisation(s)

Token(s)

Content

Information

Data

Meta-data

Stream(s)

Packet(s)

Box Data

Application Data

Application Field(s)

Database Field(s)

Anything communicable in digital form.