Device for and method of multilevel chain of trust/revision

• US 9,467,298 B1
• Filed: 03/19/2014
• Issued: 10/11/2016
• Est. Priority Date: 03/19/2014
• Status: Expired due to Fees

• Current Assignee: National Security Agency
• Original Assignee: National Security Agency
• Inventors: Alexander, Keith B., Dowd, Patrick W.
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US13/999,545
• Time in Patent Office: 937 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/007 involving hierarchical structures
• CPC Class Codes: H04L 9/3066 involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3265 using certificate chains, trees or paths; Hierarchical trust model

Abstract

A device and method of multilevel chain of trust/revision by certifying each user, device, action, and circumstance in the creation, modification, and transmission of computer information, including a revision history of any modification.

Claims

1. A method of multilevel chain of trust/revision, comprising the steps of:

a) requesting by a first user, via the first user'"'"'s computing device, certification of a certifiable characteristic;

b) receiving by a certification authority each certification request from the first user and comparing it against user-definable criteria for certifying the request and, if the criteria are satisfied, issuing to the first user a certificate authorizing the request;

c) upon issuance of a certificate from the certification authority, contacting by the first user each computing device from which a computer object is required and requesting the computer object;

d) contacting the certification authority by each computing device that receives a request for a computer object for verification that the first user is authorized to receive the computer object;

e) for each request for verification, informing the computing device by the certifying authority if the first user is authorized to receive the computer object;

f) upon receipt by the computing device of verification sending by the computing device the computer object to the first user; and

upon receipt of the computer object, executing the object, where the result includes a digital certificate for communicating with a subsequent user.

2. The method of claim 1, wherein the step of requesting by a first user, is comprised of requesting digital certification, and wherein the digital certificate includes a digital certificate in accordance with an X.509 standard published by the International Telecommunication Union.

3. The method of claim 1, wherein the step of requesting by a first user certification of a certifiable characteristic includes, requesting computing device authorization, and wherein the computing devices are selected from the group consisting of a computer, a personal digital assistant, and a mobile device.

4. The method of claim 1, wherein the step of requesting by a first user certification of a certifiable characteristic includes, requesting location authorization, where the certifying authority certifies that the first user'"'"'s computing device is located in an allowable geographical location.

5. The method of claim 1, wherein the step of requesting by a first user certification of a certifiable characteristic includes, requesting computer object authorization, where a computer object is selected from the group of data, software, and a library.

6. The method of claim 1, wherein the step of requesting by a first user certification of a certifiable characteristic includes requesting activity authorization, where the activity is selected from the group consisting of develop program, compile program, distribute program, update program, install program, and execute program.

7. The method of claim 1, wherein the step of requesting by a first user certification of a certifiable characteristic includes requesting circumstance authorization.

8. The method of claim 1, further including the step of associating with each computer object a tuple including the computer object, a pointer to a data structure that indicates what data objects, if any, were used to create the computer object, and a digital signature of the computer object that was signed by a computer platform on which the computer object was created, where the pointer is null if the computer object was created on the computer platform without using another data object with which a tuple is associated.

9. The method of claim 8, wherein the pointer points to a data structure containing a tuple, when the computer object was created using another data object with which a tuple is associated.

10. The method of claim 8, wherein the pointer points to a data structure containing a list of tuples, when the computer object was created using more than one data object with which a tuple is associated.

11. The method of claim 1, wherein said certifiable characteristic is selected from the group consisting of user authorization, computing device authorization, location authorization, access to computer object authorization, activity authorization, circumstance authorization, and communication authorization.

12. The method of claim 1, further comprising the steps of:

h) contacting the certification authority by the subsequent user and requesting verification that the subsequent user is authorized to process the communication;

i) upon receipt of verification that the subsequent user is authorized to process the received communication, then providing the subsequent user with a certificate to process the received communication; and

j) processing the received communication, wherein the processed communication includes all of the certificates associated with each communication providing a chain of trust/revision.