Cryptographic server with provisions for interoperability between cryptographic systems

• US 6,853,988 B1
• Filed: 09/20/2000
• Issued: 02/08/2005
• Est. Priority Date: 09/20/1999
• Status: Expired due to Term

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: Dickinson, Alexander G., Stark, Gregory H., Rohrbach, Mark D., Ferrante, Michelle, Clayton, Richard F.
• Primary Examiner(s): Trammell, James P.
• Assistant Examiner(s): CHEUNG, MARY DA ZHI WANG
• Application Number:
  US09/666,647
• Time in Patent Office: 1,602 Days
• Field of Search: 705 64- 67, 705 72- 75, 713153-155, 713156-162, 713166-171, 713/175, 713177-180, 713182-185, 713200-202, 380277-279, 380281-285, 380 44- 45, 380 28- 30
• US Class Current: 705/75
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/383 Anonymous user system
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The invention is a cryptographic server providing interoperability over multiple algorithms, keys, standards, certificate types and issuers, protocols, and the like. Another aspect of the invention is to provide a secure server, or trust engine, having server-centric keys, or in other words, storing cryptographic keys on a server. The server-centric storage of keys provides for user-independent security, portability, availability, and straightforwardness, along with a wide variety of implementation possibilities.

Claims

1. A method of performing remote requests for cryptographic functions on a secure server, the method comprising:

associating a user from multiple users with one or more keys from a plurality of private cryptographic keys stored on a secure server;

receiving a request for one or more cryptographic functions from an application executing on a remote computing device;

accessing the one or more keys; and

performing one or more cryptographic functions corresponding to the request using the one or more keys;

wherein the step of accessing the one or more keys further comprises;

selecting a type of certificate matching data provided in the request; and

determining whether the user owns a certificate matching the type;

when the user owns the certificate, accessing the one or more keys from the plurality of private cryptographic keys corresponding to the certificate;

wherein the step of performing one or more cryptographic functions using the one or more keys includes using the one or more keys corresponding to the certificate;

when the user does not own the certificate, determining whether the user owns a cross-certified-certificate cross-certified with the certificate; and

when the user owns the cross-certified certificate, accessing the one or more keys from the plurality of private cryptographic keys corresponding to the cross-certified certificate.

2. The method of claim 1, further comprising:

when the user does not own the cross-certified certificate, determining a certificate;

determining whether user authentication data meets requirements set by the certificate authority; and

when the user authentication data meets the requirements, enrolling the user with the certificate authority, thereby acquiring the one of the certificate or a cross-certified certificate.

3. The method of claim 2, further comprising using the one or more keys from the plurality of private cryptographic keys to enroll the user with the certificate authority.

4. The method of claim 2, further comprising generating one or more new keys and using at least one of the new keys to enroll the user with the certificate authority.

5. The method of claim 2, further comprising:

when the user authentication data does not meet the requirements, determining whether another certificate authority issues the one of the certificate or a cross-certified certificate.

6. The method of claim 2, further comprising:

when the user authentication data does not meet the requirements, requesting updated user authentication data from the user.