Identity-based-encryption system with hidden public key attributes

• US 7,961,879 B1
• Filed: 07/31/2009
• Issued: 06/14/2011
• Est. Priority Date: 06/25/2003
• Status: Expired due to Term

• Current Assignee: entIT Software LLC (Open Text Corporation)
• Original Assignee: Voltage Security Incorporated (HP Inc.)
• Inventors: Kacker, Rishi R., Appenzeller, Guido, Pauker, Matthew J., Spies, Terence
• Primary Examiner(s): Lanier; Benjamin E
• Application Number:
  US12/534,040
• Time in Patent Office: 683 Days
• Field of Search: None
• US Class Current: 380/44
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing

Abstract

A system is provided that uses identity-based encryption (IBE) to allow a sender to securely convey information in a message to a recipient over a communications network. IBE public key information may be used to encrypt messages and corresponding IBE private key information may be used to decrypt messages. Information on which IBE public key information was used in encrypting a given message may be provided to the message recipient with the message. Multiple IBE public keys may be used to encrypt a single message. A less sensitive IBE public key may be used to encrypt a more sensitive public key, so that the more sensitive public key can remain hidden as it is sent to the recipient.

Claims

1. A method for using multi-layer identity-based encryption (IBE) to support encryption and decryption using computing equipment in a system, comprising:

encrypting digital information with the computing equipment using at least two layers of IBE encryption by using an inner layer of encryption having an associated inner-layer IBE public key to encrypt the digital information and by using an outer layer of encryption having an associated outer-layer IBE public key to encrypt the inner-layer IBE public key; and

decrypting the encrypted digital information using an outer-layer IBE private key corresponding to the outer-layer IBE public key and using an inner-layer IBE private key corresponding to the inner layer IBE public key.

2. The method defined in claim 1 wherein using the outer layer of encryption to encrypt the inner-layer IBE public key comprises encrypting the inner-layer IBE public key with the outer-layer IBE public key without using a symmetric key.

3. The method defined in claim 1 wherein using the outer layer of encryption to encrypt the inner-layer IBE public key comprises encrypting the inner-layer IBE public key with a symmetric key and encrypting the symmetric key with the outer-layer IBE public key.

4. The method defined in claim 3 wherein decrypting the encrypted digital information further comprises using the outer-layer IBE private key in decrypting the encrypted inner-layer IBE public key to produce an unencrypted version of the inner-layer IBE public key.

5. The method defined in claim 1 wherein encrypting the digital information comprises encrypting the digital information using at least three layers of IBE encryption and wherein the outer layer is not an outermost layer.

6. The method defined in claim 1 wherein encrypting the digital information comprises encrypting the digital information using a symmetric key.

7. The method defined in claim 6 wherein encrypting the digital information comprises encrypting the digital information using the symmetric key and encrypting the symmetric key using the inner-layer IBE public key.

8. The method defined in claim 7 wherein encrypting the digital information further comprises encrypting the inner-layer IBE public key using the outer-layer IBE public key.

9. The method defined in claim 8 wherein decrypting the encrypted digital information comprises:

using the outer-layer IBE private key to decrypt the inner-layer IBE public key that has been encrypted using the outer-layer IBE public key;

using the inner-layer IBE private key to decrypt the symmetric key that has been encrypted using the inner-layer IBE public key; and

using the symmetric key that has been decrypted using the inner-layer IBE private key to decrypt the digital information that was encrypted using the symmetric key.

10. The method defined in claim 1 wherein the outer-layer IBE public key is less sensitive than the inner-layer IBE public key and wherein encrypting the digital information comprises using the outer-layer IBE public key to encrypt the inner-layer IBE public key to conceal the inner-layer IBE public key.

11. The method defined in claim 10 wherein encrypting the digital information comprises encrypting the digital information using at least three layers of IBE encryption and wherein the outer layer is not an outermost layer.

12. The method defined in claim 1 wherein the digital information is provided in an XML data structure containing data attributes, the method further comprising using at least some of the data attributes in forming the inner-layer IBE public key and the outer-layer IBE public key.

13. The method defined in claim 12 wherein at least one of the data attributes has an associated sensitivity level and wherein encrypting the digital information comprises using the sensitivity level in determining how to encrypt the digital information.

14. The method defined in claim 13 further comprising:

obtaining information on the associated sensitivity level in the form of an XML record.

15. The method defined in claim 1 wherein the digital information comprises content having an age-based access policy criteria and wherein encrypting the digital information comprises using the age-based access criteria as at least part of the inner-layer IBE public key.

16. The method defined in claim 1 wherein encrypting the digital information comprises encrypting an email message.

17. The method defined in claim 1 wherein encrypting the digital information comprises encrypting an instant message.

18. The method defined in claim 1 wherein the inner-layer IBE public key and the outer-layer IBE public key have overlapping components and wherein encrypting the digital information comprises performing the inner layer of the encryption using the inner-layer IBE public key that has overlapping components.

19. The method defined in claim 1 wherein encrypting the digital information further comprises using an additional-layer IBE public key to perform an additional layer of IBE encryption on the digital information, wherein the additional-layer IBE public key is less sensitive than the outer-layer IBE public key and is used to encrypt the outer-layer IBE public key.

20. The method defined in claim 19 wherein the inner-layer IBE public key, the outer-layer IBE public key, and the additional-layer IBE public key each have corresponding IBE public key components and wherein each IBE public key component in the additional-layer IBE public key is contained in the outer-layer IBE public key and wherein each IBE public key component in the outer-layer IBE public key is contained in the inner-layer IBE public key.