Computer system for securing communications using split private key asymmetric cryptography

• US 5,737,419 A
• Filed: 06/07/1996
• Issued: 04/07/1998
• Est. Priority Date: 11/09/1994
• Status: Expired due to Term

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Bell Atlantic Network Services, Inc. (Verizon Communications Inc.)
• Inventors: Ganesan, Ravi
• Primary Examiner(s): Cain, David C.
• Application Number:
  US08/660,403
• Time in Patent Office: 669 Days
• Field of Search: 380/21, 380/30, 380/49
• US Class Current: 713/169
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/3218 using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A programmed computer secures communications between users of a crypto-system in which each user has an associated asymmetric crypto-key with a public key portion accessible to all system users and a corresponding private key portion having a first private key portion known only to the associated user and a corresponding second private key portion. The computer includes a processor programmed to generate a temporary asymmetric crypto-key having a first temporary key portion and an associated second temporary key portion. The computer then encrypts the second temporary key portion with the first private key portion of a first user crypto-key associated with a first user to form a first encrypted message. The processor directs the issuance of the first encrypted message to a second user having access to the second private key portion of the first user crypto-key. The processor next applies the public key portion of the first user crypto-key to decrypt a second encrypted message generated by the second user, which includes the first encrypted message encrypted with the second private key portion of the first user crypto-key, to thereby authenticate the second user to the first user. The computer also includes a storage medium for storing the first temporary key portion, and the public key portion of the first user crypto-key.

Claims

1. An article of manufacture for securing communications between users of a crypto-system having a plurality of users, each of said plurality of users having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, each private key portion having a first private key portion known only to the associated user and a corresponding second private key portion, comprising:

computer readable storage medium; and

computer programming stored on said storage medium;

wherein said stored computer programming is configured to be readable from said computer readable storage medium by a computer and thereby cause said computer to operate so as to;

generate a temporary asymmetric crypto-key having a first temporary key portion and an associated second temporary key portion;

encrypt said second temporary key portion with the first private key portion of a first user crypto-key associated with a first user to form a first encrypted message;

direct issuance of said first encrypted message to a second user having access to the second private key portion of the first user crypto-key, wherein the second temporary key portion is obtainable by application of the second private key portion of the first user crypto-key to the first encrypted message to thereby authenticate the first user to the second user; and

apply the public key portion of the first user crypto-key to decrypt a second encrypted message, which includes the first encrypted message encrypted with the second private key portion of the first user crypto-key, to thereby authenticate the second user to the first user.

2. An article of manufacture according to claim 1, wherein said stored computer programming is configured to be readable from said computer readable storage medium by the computer to thereby cause said computer to operate so as to:

apply the first temporary key portion to decrypt a third encrypted message, which includes a first symmetric session crypto-key encrypted with the second temporary key portion, to obtain a first symmetric session crypto-key;

apply the first temporary key portion to encrypt a fourth encrypted message, which includes the first symmetric session crypto-key encrypted with the second private key portion of a third user, to form a fifth encrypted message; and

direct issuance of said fifth encrypted message to said third user, wherein the first symmetric session crypto-key is obtainable by application of the first private key portion of the third user crypto-key and the second temporary key portion to decrypt the fifth encrypted message and thereby authenticate the first user and the second user to the third user.

3. An article of manufacture according to claim 2, wherein said stored computer programming is configured to be readable from said computer readable storage medium by the computer to thereby cause said computer to operate so as to apply said first symmetric session key to encrypt a first communication to the third user, or to decrypt a second communication from the third user.

4. An article of manufacture according to claim 2, wherein said stored computer programming is configured to be readable from said computer readable storage medium by the computer and thereby cause said computer to operate so as to:

apply the first symmetric session crypto-key to decrypt a sixth encrypted message, which includes a second symmetric session crypto-key encrypted with said first symmetric session crypto-key, to obtain the second symmetric session crypto-key;

apply the public key portion of the third user crypto-key to decrypt a seventh encrypted message, including the first symmetric session crypto-key encrypted with the first and the second private key portions of the third user, to obtain the first symmetric session crypto-key and thereby authenticate the third user to the first user;

apply the first temporary key portion to encrypt an eighth encrypted message, which includes the second symmetric session crypto-key encrypted with the second private key portion of a fourth user crypto-key associated with a fourth user, to form a ninth encrypted message;

direct issuance of said ninth encrypted message to the fourth user, wherein the second symmetric session crypto-key is obtainable by application of the second temporary key portion and the first private key portion of the fourth user crypto-key to decrypt the ninth encrypted message and thereby authenticate the first user and the second user to the fourth user.

5. An article of manufacture according to claim 4, wherein said stored computer programming is configured to be readable from said computer readable storage medium by the computer and thereby cause said computer to operate so as to decrypt a tenth encrypted message, which includes the second symmetric session crypto-key encrypted with the first and the second private key portions of the fourth user crypto-key, by application of the public key portion of the fourth user crypto-key to the tenth encrypted message and thereby authenticate the fourth user to the first user.

6. A programmed computer for securing communications between users of a crypto-system having a plurality of users, each of said plurality of users having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, each private key portion having a first private key portion known only to the associated user and a corresponding second private key portion, comprising:

a processor for generating a temporary asymmetric crypto-key having a first temporary key portion and an associated second temporary key portion, for encrypting said second temporary key portion with the first private key portion of a first user crypto-key associated with a first user to form a first encrypted message, for directing issuance of said first encrypted message to a second user having access to the second private key portion of the first user crypto-key, and for applying the public key portion of the first user crypto-key to decrypt a second encrypted message, which includes the first encrypted message encrypted with the second private key portion of the first user crypto-key, to thereby authenticate the second user to the first user; and

storage medium for storing the first temporary key portion, and the public key portion of the first user crypto-key.

7. A programmed computer according to claim 6, wherein:

said processor is adapted (i) to apply the first temporary key portion to decrypt a third encrypted message, which includes a first symmetric session crypto-key encrypted with the second temporary key portion, to obtain the first symmetric session crypto-key, (ii) to apply the first temporary key portion to encrypt a fourth encrypted message, which includes the first symmetric session crypto-key encrypted with the second private key portion of a third user crypto-key associated with a third user, to form a fifth encrypted message, and (iii) to direct the issuance of said fifth encrypted message to said third user;

said storage medium is adapted to store said first symmetric session crypto-key; and

the first symmetric session crypto-key is obtainable by application of the first private key portion of the third user crypto-key and the second temporary key portion to decrypt the fifth encrypted message and thereby authenticate the first user and the second user to the third user.

8. A programmed computer according to claim 7, wherein said processor is adapted to encrypt a message to or decrypt a message from the third user with said first symmetric session key.

9. A programmed computer according to claim 7, wherein:

said processor is adapted (i) to apply the first symmetric session crypto-key to decrypt a sixth encrypted message, which includes a second symmetric session crypto-key encrypted with said first symmetric session crypto-key, to obtain the second symmetric session crypto-key, (ii) to apply the public key portion of the third user crypto-key to decrypt a seventh encrypted message, which includes the first symmetric session crypto-key encrypted with the first and the second private key portions of the third user, to obtain the first symmetric session crypto-key and thereby authenticate the third user to the first user, (iii) to apply the first temporary key portion to encrypt an eighth encrypted message, which includes the second symmetric session crypto-key encrypted with the second private key portion of a fourth user crypto-key associated with a fourth user, to form a ninth encrypted message, and (iv) to direct issuance of said ninth encrypted message to the fourth user;

said storage medium is adapted to store said second symmetric session crypto-key, and the public key portion of the third user crypto-key; and

the second symmetric session crypto-key is obtainable by application of the second temporary key portion and first private key portion of the fourth user crypto-key to decrypt the ninth encrypted message and thereby authenticate the first user and the third user to the fourth user.

10. A programmed computer according to claim 9, wherein said processor is adapted to apply the public key portion of the fourth user crypto-key to decrypt a tenth encrypted message, which includes the second symmetric session crypto-key encrypted with the first and the second private key portions of the fourth user crypto-key, to obtain the second symmetric session crypto-key and thereby authenticate the fourth user to the first user.

11. An article of manufacture for jointly signing communications between users in a crypto-system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, each private key portion having a first private key portion known only to the associated user and a corresponding second private key portion, comprising:

computer readable storage medium; and

computer programming stored on said storage medium;

wherein said stored computer programming is configured to be readable from said computer readable storage medium by a computer and thereby cause said computer to operate so as to;

generate a temporary asymmetric crypto-key having a first temporary key portion and an associated second temporary key portion;

apply to the first private key portion of a first user crypto-key associated with a first user to encrypt said second temporary key portion to form a first encrypted message;

direct issuance of the first encrypted message to a second user having access to the second private key portion of the first user crypto-key;

apply the first private key portion of the first user crypto-key to encrypt a hash message to form a second encrypted message, and thereby place a signature of the first user on the hash message;

apply said first temporary key portion to encrypt said second encrypted message to form a third encrypted message;

direct issuance of the third encrypted message to the second user; and

apply the public key portion of the first user crypto-key to decrypt a fourth encrypted message, which includes the second encrypted message encrypted with the second private key portion of the first user crypto-key, to obtain the hash message to thereby verify the joint signatures of the first and the second users on the hash message;

wherein, the second temporary key portion is obtainable by applying the second private key portion of the first user crypto-key to decrypt the first encrypted message and thereby authenticate the first user to the second user, and the second encrypted message is obtainable by applying said second temporary key portion to decrypt the third encrypted message.

12. A programmed computer for jointly signing communications between users of a crypto-system having a plurality of users, each of said plurality of users having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, each private key portion having a first private key portion known only to the associated user and a corresponding second private key portion, comprising:

a processor (i) for generating a temporary asymmetric crypto-key having a first temporary key portion and an associated second temporary key portion, (ii) for applying the first private key portion of a first user crypto-key associated with a first user to encrypt said second temporary key portion to form a first encrypted message, (iii) for directing issuance of the first encrypted message to a second user having access to the second private key portion of the first user crypto-key, (iv) for applying the first private key portion of the first user crypto-key to encrypt a hash message to form a second encrypted message, and thereby place a signature of the first user on the hash message, (v) for applying said first temporary key portion to encrypt said second encrypted message to form a third encrypted message, (vi) for directing to issuance of the third encrypted message to the second user, and (vii) for applying the public key portion of the first user crypto-key to decrypt a fourth encrypted message, which includes the second encrypted message encrypted with the second private key portion of the first user crypto-key, to obtain the hash message and thereby verify the joint signatures of the first and the second users on the hash message; and

storage medium for storing the first temporary key portion, and the public key portion of the first user crypto-key;

wherein, the second temporary key portion is obtainable by applying the second private key portion of the first user crypto-key to decrypt the first encrypted message and thereby authenticate the first user to the second user, and the second encrypted message is obtainable by applying said second temporary key portion to decrypt the third encrypted message.

13. An article of manufacture, for authenticating users of a system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, each private key portion having a first private key portion known only to the associated user and a corresponding second private key portion known only to a trusted third party, comprising:

computer readable storage medium; and

computer programming stored on said storage medium;

wherein said stored computer programming is configured to be readable from said computer readable storage medium by a computer and thereby cause said computer to operate so as to;

apply the first private key portion of a first user crypto-key associated with a first user to encrypt a first message to form a first encrypted message;

direct issuance of said first encrypted message to said trusted third party; and

apply the public key portion of the first user crypto-key to decrypt to a second encrypted message, which includes the first encrypted message encrypted with the second private key portion of the first user crypto-key, to obtain the first message and thereby authenticate the trusted third party to the first user;

wherein the first message is obtainable by applying the second private key portion of the first user crypto-key to decrypt the first encrypted message and thereby authenticate the first user to the trusted third party.

14. An article of manufacture according to claim 13, wherein the first message is obtainable by applying the public key portion of the first user crypto-key to decrypt the second encrypted message and thereby authenticate the first user to a second user.

15. A programmed computer for authenticating users of a system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, each private key portion having a first private key portion known only to the associated user and a corresponding second private key portion known only to a trusted third party, comprising:

a processor (i) for applying the first private key portion of a first user crypto-key associated with a first user to encrypt a first message to form a first encrypted message, (ii) for directing issuance of said first encrypted message to said trusted third party, and (iii) for applying the public key portion of the first user crypto-key to decrypt a second encrypted message, which includes the first encrypted message encrypted with the second private key portion of the first user crypto-key, to obtain the first message and thereby authenticate the trusted third party to the first user; and

storage medium for storing the public key portion of the first user crypto-key and the first message;

wherein the first message is obtainable by applying the second private key portion of the first user crypto-key to decrypt the first encrypted message and thereby authenticate the first user to the trusted third party.

16. A programmed computer according to claim 15, wherein the first message is obtainable by applying the public key portion of the first user crypto-key to decrypt the second encrypted message and thereby authenticate the first user to a second user.

17. An article of manufacture for securing communications between users of a system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, each private key portion having a first private key portion known only to the associated user and a corresponding second private key portion known only to a trusted third party, comprising:

computer readable storage medium; and

computer programming stored on said storage medium;

wherein said stored computer programming is configured to be readable from said computer readable storage medium by a computer and thereby cause said computer to operate so as to;

generate a temporary asymmetric crypto-key having a first temporary key portion and an associated second temporary key portion;

apply the first private key portion of a first user crypto-key associated with a first user to encrypt said second temporary key portion to form a first encrypted message;

direct issuance of said first encrypted message to the trusted third party;

apply said first temporary key portion to encrypt a first communication to form a first encrypted communication or to decrypt a second communication, including a communication encrypted with said second temporary key portion, to obtain said second communication; and

direct issuance of said first encrypted communication to a second user;

wherein, said second temporary key portion is obtainable by applying the public key portion of the first user crypto-key to decrypt a second encrypted message, which includes the first encrypted message encrypted with a second private key portion of the first user crypto-key.

18. A programmed computer for securing communications between users of a system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, each private key portion having a first private key portion known only to the associated user and a corresponding second private key portion known only to a trusted third party, comprising:

a processor (i) for generating a temporary asymmetric crypto-key having a first temporary key portion and an associated second temporary key portion, (ii) for applying the first private key portion of a first user crypto-key associated with a first user to encrypt said second temporary key portion to form a first encrypted message, (iii) for directing issuance of said first encrypted message to the trusted third party, (iv) for applying said first temporary key portion to encrypt a first communication to form a first encrypted communication or to decrypt a second communication, including a communication encrypted with said second temporary key portion, to obtain the second communication, and (v) for directing issuance of said first encrypted communication to a second user; and

storage medium for storing said first temporary key portion;

wherein, said second temporary key portion is obtainable by applying the public key portion of the first user crypto-key to decrypt a second encrypted message, which includes the first encrypted message encrypted with a second private key portion of the first user crypto-key.

19. An article of manufacture for authenticating users of a system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, each private key portion having a first private key portion known only to the associated user and a corresponding second private key portion known only to a third party, comprising:

computer readable storage medium; and

computer programming stored on said storage medium;

wherein said stored computer programming is configured to be readable from said computer readable storage medium by a computer and thereby cause said computer to operate so as to;

apply the second private key portion of a first user crypto-key associated with a first user to decrypt a first encrypted message, which includes a first message encrypted with the first private key portion of the first user crypto-key, and thereby authenticate the first user to the third party;

encrypt the first encrypted message with the second private key portion of the first user crypto-key to form a second encrypted message; and

direct issuance of the second encrypted message to the first user, wherein the first message is obtainable by application of the public key portion of the first user crypto-key to decrypt the second encrypted message and thereby authenticate the third party to the first user.

20. A article of manufacture for authenticating users of a system according to claim 19, wherein said third party is an authentication server.

21. A programmed computer for authenticating users of a system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, each private key portion having a first private key portion known only to the associated user and a corresponding second private key portion known only to a third party, comprising:

a storage medium for storing the second private key portion of a first user crypto-key associated with a first user; and

a processor (i) for applying the second private key portion of the first user crypto-key to decrypt a first encrypted message, which includes a first message encrypted with the first private key portion of the first user crypto-key, and thereby authenticate the first user to the third party, (ii) for encrypting the first encrypted message with the second private key portion of the first user crypto-key to form a second encrypted message, and (iii) for directing issuance of the second encrypted message to the first user, wherein the first message is obtainable by application of the public key portion of the first user crypto-key to decrypt the second encrypted message and thereby authenticate the third party to the first user.

23. An article of manufacture for authenticating users of a system according to claim 21, wherein by obtaining said first message the signature of both the first user and the third party on the first message is verified.

24. An article of manufacture for authenticating users of a system according to claim 21, wherein said third party is an authentication server.

26. A programmed computer according to claim 24, wherein the application of the second private key portion of the first user crypto-key to encrypt the first encrypted message serves as a signature of the third party on said first message.

27. A programmed computer according to claim 24, wherein said third party is an authentication server.

22. An article of manufacture for authenticating users of a system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, each private key portion having a first private key portion known only to the associated user and a corresponding second private key portion known only to a third party, comprising:

computer readable storage medium; and

computer programming stored on said storage medium;

wherein said stored computer programming is configured to be readable from said computer readable storage medium by a computer and thereby cause said computer to operate so as to;

apply the second private key portion of a first user crypto-key associated with a first user to encrypt a first encrypted message, which includes a first message encrypted with a first private key portion of a first user crypto-key, to form a second encrypted message; and

direct issuance of said second encrypted message to a second user, wherein the first message is obtainable by applying the public key portion of the first user crypto-key to decrypt the second encrypted message and thereby authenticate the first user to the second user.

25. A programmed computer for authenticating users of a system having a plurality of system users, each said user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion, each public key portion being accessible to the plurality of system users, each private key portion having a first private key portion known only to the associated user and a corresponding second private key portion known only to a third party, comprising:

storage medium for storing the second private key portion of a first user crypto-key associated with a first user; and

a processor for applying the second private key portion of the first user crypto-key to encrypt a first encrypted message, which includes a first message encrypted with the first private key portion of the first user crypto-key, to form a second encrypted message, and for issuing said second encrypted message to a second user, wherein the first message is obtainable by applying the public key portion of the first user crypto-key to decrypt the second encrypted message and thereby authenticate the first user to the second user.