Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Particular communication authentication technique
Reexamination Certificate
1999-11-12
2004-03-09
Barrón, Gilberto (Department: 2132)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Particular communication authentication technique
C713S184000, C713S152000
Reexamination Certificate
active
06704868
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Technical Field
The present invention relates to a method and system for data processing in general, and in particular to a method and system for providing data security. Still more particularly, the present invention relates to a method for associating a pass phrase with a secured public/private key pair.
2. Description of the Prior Art
Cryptography involves a method for encrypting data in order to provide protection and security for the data. For example, before the transmission of a message from one party to another, the message can be encrypted using a mathematical function known as a cryptographic algorithm. The most common cryptographic algorithms are key-based, where special knowledge of variable information called a “key” is required to decrypt an encrypted message. There are two prevalent types of key-based cryptographic algorithms, namely, symmetric key (or secret key) algorithms and public key (asymmetric key) algorithms. The security provided by these cryptographic algorithms is centered around the keys and not the details of the cryptographic algorithms. In other words, the cryptographic algorithms can typically be known to all, but the keys can only be known by intended parties. As a result, it is possible to publish the cryptographic algorithm for public scrutiny, and then mass produce the cryptographic algorithm for incorporation into security products.
In most symmetric key algorithms, such as Data Encryption Standard (DES), the encryption key and the decryption key are the same. This single key encryption arrangement is not flaw-free because the sender and recipient of a message must somehow exchange information regarding the secret key. Each side must trust the other not to disclose the key. Furthermore, the sender must generally communicate the key via another relatively secure communication path (similar to a bank sending the personal identification number for an ATM card through the mail). This arrangement is not practical when, for example, the parties interact electronically for the first time over a computer network.
With public key algorithms, by comparison, the key used for encryption is different from the key used for decryption. It is generally very difficult to calculate the decryption key from an encryption key. In a typical operation, the public key used for encryption is made public via a readily accessible directory, while the corresponding private key used for decryption is known only to the recipient of the encrypted message. In an exemplary public key transaction, a sender retrieves the recipient's public key and uses it to encrypt the message prior to sending the message. The recipient then decrypts the encrypted message with the corresponding private key. It is also possible to encrypt a message using a private key and decrypt the encrypted message using a public key, which is sometimes used in digital signatures to authenticate the source of a message. of the more popular public key algorithms is RSA (named after its inventors—Rivest, Shamir, and Adleman). With RSA, when a message is encrypted utilizing a user public key, the encrypted message may only be decrypted utilizing a user private key. In one implementation, each user private key is also associated with a password, and both are enclosed within an individual secure wrapper. All user private keys along with their respective passwords are stored in a protected storage area within an encryption/decryption device, such as a signature chip. In order to allow the signature chip to perform an authentication procedure, such as signing signatures, a user must provide a correct password to the signature chip. The details of this process can be found in the above-mentioned copending application, the pertinent portion of which is incorporated by reference herein. For security purposes, it is important that no copy of any user private key exists outside the secure wrapper. Thus, a user private key and its respective password can only be unwrapped inside the signature chip, leaving no opportunity for the password to be changed. Nonetheless, for mnemonic reasons such as to allow for a password that is more memorable to a human user (the initial password is generated by a random number generator) and other security reasons such as to protect the private key after the password has been inadvertently disclosed, it is important that the password within the secure wrapper be changed periodically. The present disclosure is related to a method for associating a pass phrase with a secured user public/private key pair such that the above-mentioned problem can be resolved.
SUMMARY OF THE INVENTION
In accordance with a preferred embodiment of the present invention, a user public/private key pair is first established for a user. The user public/private key pair includes a user public key and a user private key. Then, the user public/private key pair is encrypted along with a random password, utilizing a chip public key. Next, a first symmetric key is generated. The random password is then encrypted utilizing the first symmetric key. A first password is generated by hashing a first pass phrase. Finally, the first password is encrypted along with the first symmetric key, also utilizing the chip public key. As a result, a user can access the user private key to perform an authentication function by providing the first pass phrase.
If the first pass phrase needs to be changed, a second password and a second symmetric key is generated. The second password is generated by hashing a second pass phrase. The first symmetric key can be obtained by utilizing the first pass phase, and the random password can then obtained by utilizing the first symmetric key. The random password is subsequently encrypted along with the second symmetric key, utilizing the chip public key. At this point, the user can access the user private key to perform the authentication function by providing the second pass phrase.
All objects, features, and advantages of the present invention will become apparent in the following detailed written description.
REFERENCES:
patent: 5398285 (1995-03-01), Borgelt et al.
patent: 5511122 (1996-04-01), Atkinson
patent: 5734718 (1998-03-01), Prafullchandra
patent: 5768373 (1998-06-01), Lohstroh et al.
patent: 5812669 (1998-09-01), Jenkins et al.
patent: 5812764 (1998-09-01), Heinz, Sr.
patent: 5825300 (1998-10-01), Bathrick et al.
patent: 5953422 (1999-09-01), Angelo et al.
patent: 6061799 (2000-05-01), Eldridge et al.
patent: 6081893 (2000-06-01), Grawrock et al.
patent: 6111956 (2000-08-01), Field et al.
patent: 6170058 (2001-01-01), Kausik
patent: 6178409 (2001-01-01), Weber et al.
patent: 6230272 (2001-05-01), Lockhart et al.
patent: 6253027 (2001-06-01), Weber et al.
patent: 6324650 (2001-11-01), Ogilvie
patent: 6567794 (2003-05-01), Cordery et al.
patent: 6594759 (2003-07-01), Wang
patent: 6594763 (2003-07-01), Madoukh
Challener David Carroll
Dayan Richard Alan
Vanover Michael
Ward James Peter
Barrón Gilberto
Bracewell & Patterson LLP
Zand Kambiz
LandOfFree
Method for associating a pass phase with a secured... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Method for associating a pass phase with a secured..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Method for associating a pass phase with a secured... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3279437