REVOCATION STATUS USING OTHER CREDENTIALS

• US 20180115429A1
• Filed: 11/13/2017
• Published: 04/26/2018
• Est. Priority Date: 06/17/2011
• Status: Active Grant

• Current Assignee: Assa Abloy AB
• Original Assignee: Assa Abloy AB
• Inventors: Le Saint, Eric F., Dulude, Robert F.
• Granted Patent: US 10,608,828 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/72 Signcrypting, i.e. digital signing and encrypting simultaneously
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3066 involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Providing revocation status of at least one associated credential includes providing a primary credential that is at least initially independent of the associated credential, binding the at least one associated credential to the primary credential, and deeming the at least one associated credential to be revoked if the primary credential is revoked. Providing revocation status of at least one associated credential may also include deeming the at least one associated credential to be not revoked if the primary credential is not revoked. Binding may be independent of the contents of the credentials and may be independent of whether any of the credentials authenticate any other ones of the credentials. The at least one associated credential may be provided on an integrated circuit card (ICC). The ICC may be part of a mobile phone or a smart card.

Claims

1. A method of providing revocation status of at least one associated credential stored on a first device, comprising:

providing information about a primary credential stored on a second device separate from the first device, the primary credential being cryptographically independent of the associated credential;

binding the at least one associated credential to the primary credential; and

deeming the at least one associated credential to be revoked if the primary credential is revoked.

3. A method, according to claim 1, wherein binding the at least one associated credential to the primary credential is independent of the contents of the credentials and is independent of whether any of the credentials authenticate any other ones of the credentials.

9. A method, according to claim 1, wherein a single primary credential is bound to a plurality of associated credentials so that revocation status of all of the associated credentials varies according to revocation status of the primary credential.

21. A method, according to claim 1, wherein the second device is a personal identity verification card.

22. A method, according to claim 21, wherein the first device is a mobile phone.

23. A method, according to claim 21, wherein the at least one associated credential includes a card verifiable certificate.

24. A method, according to claim 21, wherein the method is performed to control a door providing access to an area.

25. A method, according to claim 1, further comprising:

authenticating the primary credential.

2. (canceled)

4-8. -8. (canceled)

10-20. -20. (canceled)

26. A method of providing revocation status of at least one associated credential of a plurality of associated credentials, comprising:

providing information about a primary credential that is cryptographically independent of the associated credential;

binding the plurality of associated credentials to the primary credential; and

deeming the at least one associated credential to be revoked if the primary credential is revoked,

wherein revocation statuses of the plurality of associated credentials varies according to revocation status of the primary credential.

27. A method, according to claim 26, wherein the primary credential is provided on a personal identity verification card.

28. A method, according to claim 27, wherein the at least associated credential is provided on a mobile phone.

29. A method, according to claim 27, wherein the at least one associated credential includes a card verifiable certificate.

30. A method, according to claim 27, wherein the method is performed to control a door providing access to an area.

31. A method, according to claim 26, further comprising:

authenticating the primary credential.

32. A method of providing revocation status of at least one associated credential, comprising:

providing information about a primary credential that is cryptographically independent of the associated credential;

binding the at least one associated credential to the primary credential;

authenticating the primary credential; and

deeming the at least one associated credential to be revoked if the primary credential is revoked.

33. A method, according to claim 32, wherein the primary credential is provided on a personal identity verification card.

34. A method, according to claim 33, wherein the at least associated credential is provided on a mobile phone.

35. A method, according to claim 33, wherein the at least one associated credential includes a card verifiable certificate.

36. A method, according to claim 32, wherein the method is performed to control a door providing access to an area.

37. A method, according to claim 33, further comprising:

determining if the primary credential is revoked,

wherein the primary credential is authenticated prior to determining if the primary credential is revoked.