Cryptographic key management

• US 20060242407A1
• Filed: 07/29/2005
• Published: 10/26/2006
• Est. Priority Date: 07/29/2004
• Status: Active Grant

• Current Assignee: James G. Lightburn
• Original Assignee: Infoassure Incorporated
• Inventors: Viola, Leonard R., Lightburn, James G., Kimmel, Wayne R., Kimmel, Gerald D., Domangue, Ersin L., Adamouski, Francis J.
• Granted Patent: US 7,711,120 B2
• Time in Patent Office: Days
• US Class Current: 713/166
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A cryptographic coalition administrator for managing information access across multiple organizations includes a communications interface configured to communicate electronically transmit and receive information, a memory configured to store pairs of public and private cryptographic keys associated with different levels of access, and a key manager configured and connected to communicate with the interface and the memory and configured to: distribute cryptographic key sets, of public cryptographic keys and private cryptographic keys, to first and second organizations of members; determine a first group of members in the first organization to have authorization to exchange information with a second group of members in the second organization, the first and second groups sharing cryptographic parameters, and public and private cryptographic keys; and distribute a first cryptographic key set, from the cryptographic key sets, to the first group, the first group having a first sensitivity level at least as high as a second sensitivity level associated with the first cryptographic key set.

Claims

1. A cryptographic coalition administrator for managing information access across multiple organizations, the administrator comprising:

a communications interface configured to communicate electronically transmit and receive information;

a memory configured to store a plurality of pairs of public and private cryptographic keys associated with different levels of access; and

a key manager configured and connected to communicate with the interface and the memory and configured to;

distribute cryptographic key sets, of public cryptographic keys and private cryptographic keys, to first and second organizations of members;

determine a first group of members in the first organization to have authorization to exchange information with a second group of members in the second organization;

the first and second groups sharing cryptographic parameters, and public and private cryptographic keys; and

distribute a first cryptographic key set, from the cryptographic key sets, to the first group, the first group having a first sensitivity level at least as high as a second sensitivity level associated with the first cryptographic key set.

2. The administrator of claim 1 wherein the key manager is configured to distribute the cryptographic key sets in accordance with at least one of sensitivity levels and category labels associated with the sets and the groups of members.

3. The administrator of claim 1 wherein the key manager is disposed in at least one of the organizations.

4. The administrator of claim 1 wherein the key manager is disposed external to the organizations.

5. The administrator of claim 1 wherein the key manager is configured to alter access privileges of at least one of the members.

6. The administrator of claim 5 wherein the key manager is configured to revoke access privileges of one of the members by inhibiting recall of a portion of a key stored in association with the member.

7. The administrator of claim 5 wherein the key manager is configured to add a new member, from the first organization, to the first group by distributing the first cryptographic key set to the new member.

8. The administrator of claim 1 wherein the key manager comprises computer-readable software instructions configured to cause a computer to distribute the key sets and determine the first group of members.

9. The administrator of claim 1 wherein the key manager is further configured to:

determine a third group of members in the first organization to have authorization to exchange information with themselves, the members in the third group sharing cryptographic parameters, and public and private cryptographic keys; and

distribute a second cryptographic key set, from the cryptographic key sets, to the third group.

10. A system for use in transferring encrypted information between multiple organizations, the system comprising:

a communications interface configured to communicate electronically transmit and receive information;

a memory configured to store a plurality of pairs of public and private cryptographic keys; and

a key manager configured and connected to communicate with the interface and the memory and configured to;

receive a first write-only cryptographic key, associated with a first organization, that has been encrypted using a second write-only cryptographic key associated with a second organization;

decrypt the first write-only key using a first private cryptographic key;

encrypt a plaintext message using a data encryption key to produce a ciphertext;

encrypt the data encryption key using the first write-only key to produce a first encrypted key;

send the ciphertext and the first encrypted key toward the first organization;

encrypt the data encryption key using the a third write-only cryptographic key, associated with the second organization, to produce a second encrypted key; and

send the ciphertext and the second encrypted key toward a member of the second organization;

wherein the system is associated with the second organization.

11. A method of exchanging information, the method comprising:

transmitting a first write-only cryptographic key from a first entity to a second entity;

encrypting a second write-only cryptographic key at the second entity using the first write-only key;

transmitting the encrypted second write-only key to the first entity;

decrypting the second write-only key at the first entity using a first private cryptographic key associated with the first write-only key;

encrypting information at the first entity using a data encryption key to produce ciphertext;

encrypting the data encryption key using the second write-only key to produce a first encrypted key;

transmitting the ciphertext and the first encrypted key from the first entity to the second entity;

encrypting the data encryption key using a third write-only cryptographic key to produce a second encrypted key; and

transmitting the ciphertext and the second encrypted key from the first entity to a third entity.

12. The method of claim 11 further comprising signing the first write-only cryptographic key and wherein transmitting the first write-only key comprises transmitting the signed first write-only key.

13. The method of claim 11 wherein the first and third entities are members of a first organization of members, and the second entity is a member of a second organization of members that is separate from the first organization.