Identity-based-encryption messaging system

• US 8,086,857 B2
• Filed: 07/29/2009
• Issued: 12/27/2011
• Est. Priority Date: 03/14/2003
• Status: Expired due to Term

• Current Assignee: entIT Software LLC (Open Text Corporation)
• Original Assignee: Voltage Security Incorporated (HP Inc.)
• Inventors: Appenzeller, Guido, Pauker, Matthew J., Spies, Terence, Kacker, Rishi R.
• Primary Examiner(s): Hoffman, Brandon
• Application Number:
  US12/511,811
• Publication Number:
  US 20090307497A1
• Time in Patent Office: 881 Days
• Field of Search: None
• US Class Current: 713/171
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing

Abstract

A system is provided that uses identity-based encryption to support secure communications between senders and recipients over a communications network. Private key generators are used to provide public parameter information. Senders encrypt messages for recipients using public keys based on recipient identities and using the public parameter information as inputs to an identity-based encryption algorithm. Recipients use private keys to decrypt the messages. There may be multiple private key generators in the system and a given recipient may have multiple private keys. Senders can include private key identifying information in the messages they send to recipients. The private key identifying information may be used by the recipients to determine which of their private keys to use in decrypting a message. Recipients may obtain the correct private key to use to decrypt a message from a local database of private keys or from an appropriate private key server.

Claims

1. A method for using identity-based encryption to support encryption and decryption using computing equipment in a system, wherein the system has a plurality of identity-based-encryption private key generators each of which generates associated identity-based-encryption public parameter information and associated identity-based-encryption private keys, the method comprising:

with the computing equipment, encrypting digital information using the identity-based-encryption public parameter information that is associated with a given one of the plurality of the identity-based-encryption private key generators; and

with the computing equipment, appending identification information to the encrypted digital information, wherein the identification information specifies which one of the plurality of identity-based-encryption private key generators is the given one of the plurality of identity-based-encryption private key generators that generated the identity-based-encryption public parameter information that was used to encrypt the digital information.

2. The method defined in claim 1 further comprising:

obtaining the encrypted digital information and the appended identification information; and

using the identification information to determine which one of the plurality of identity-based-encryption private key generators is the given one of the plurality of identity-based-encryption private key generators that generated the identity-based-encryption public parameter information that was used to encrypt the digital information.

3. The method defined in claim 1 further comprising:

decrypting the encrypted digital information using an identity-based-encryption private key generated by the given identity-based-encryption private key generator that generated the identity-based-encryption public parameter information that was used to encrypt the digital information.

4. The method defined in claim 1 further comprising:

with the identification information, identifying which one of the plurality of identity-based-encryption private key generators is the given one of the plurality of identity-based-encryption private key generators that generated the identity-based-encryption public parameter information that was used to encrypt the digital information;

retrieving an identity-based-encryption private key from the identified identity-based-encryption private key generator; and

decrypting the encrypted digital information using the identity-based-encryption private key.

5. The method defined in claim 1 further comprising:

with the identification information, identifying which one of the plurality of identity-based-encryption private key generators is the given one of the plurality of identity-based-encryption private key generators that generated the identity-based-encryption public parameter information that was used to encrypt the digital information;

obtaining an identity-based-encryption private key that was generated by the identified identity-based-encryption private key generator from a local private key database; and

decrypting the encrypted digital information with the identity-based-encryption private key.

6. The method defined in claim 1 wherein the encrypted digital information comprises encrypted text, the method further comprising decrypting the encrypted text.

7. The method defined in claim 1 wherein the encrypted digital information comprises an encrypted email message, the method further comprising decrypting the encrypted email message.

8. The method defined in claim 1 wherein the encrypted digital information comprises encrypted executable code, the method further comprising decrypting the encrypted executable code.

9. A method for using identity-based encryption to support encryption and decryption using computing equipment in a system, wherein the system has a plurality of identity-based-encryption private key generators each of which generates associated identity-based-encryption public parameter information and associated identity-based-encryption private keys, the method comprising:

with the computing equipment, encrypting digital information using the identity-based-encryption public parameter information that is associated with a given one of the plurality of the identity-based-encryption private key generators; and

with the computing equipment, creating a data item that includes the encrypted digital information and that includes identification information that specifies which one of the plurality of identity-based-encryption private key generators is the given one of the plurality of identity-based-encryption private key generators that generated the identity-based-encryption public parameter information that was used to encrypt the digital information.

10. The method defined in claim 9 wherein the data item comprises a message that has an information field that includes the identification information and that has a payload that includes the encrypted digital information, the method further comprising sending the message to a recipient.

11. The method defined in claim 10 further comprising:

using computing equipment associated with the recipient, obtaining the message;

with the identification information from the information field, identifying which one of the plurality of identity-based-encryption private key generators is the given one of the plurality of identity-based-encryption private key generators that generated the identity-based-encryption public parameter information that was used to encrypt the digital information;

retrieving an identity-based-encryption private key from the identified identity-based-encryption private key generator; and

decrypting the encrypted digital information using the identity-based-encryption private key.