Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Packet header designating cryptographically protected data
Reexamination Certificate
2000-04-27
2003-05-20
Hayes, Gail (Department: 2131)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Packet header designating cryptographically protected data
C713S163000, C713S152000, C380S278000
Reexamination Certificate
active
06567914
ABSTRACT:
BACKGROUND OF THE INVENTION
The invention relates generally to systems employing cryptography based security, and more particularly to systems employing public key encryption.
Communication systems such as computer networks, telecommunication systems, and other systems are increasingly using cryptography to encrypt information sent electronically. With the increase in electronic commerce, electronic mail communication, and other information that subscribers may wish to keep secret, public key cryptography systems employ an encryption key pair, such as a decryption private key and an encryption public key to decrypt and encrypt data. The encryption public key is typically available in a public key certificate. The decryption private keys are secret keys that are protected by the use of encryption techniques and other techniques to help ensure that an attacker cannot readily obtain this critical key.
Also, communication systems are known that additionally employ digital signing key pairs, such as a signing private key and a signing public key to allow the use of digital signatures so that e-mail, electronic contracts and other data may be uniquely and securely signed by an individual. Such systems are sometimes referred to as dual public key systems. Some dual public key systems generate and use a separate digital signature certificate and a separate encryption certificate that is sent with encrypted data or digitally signed data. The separate certificates contain the respective public key data along with certificate expiry data, and other data, as known in the art. Other dual public key systems use a single certificate that contains both the signature verification public key and the encryption public key.
When a subscriber's certificates expire, the cryptographic system typically generates new certificates. For encryption certificates, it is desirable to keep a history of all decryption private keys so that a subscriber can decrypt old e-mail messages even though the encryption certificates have expired.
Some standards exist that set forth particular requirements so that subscribers may communicate securely with one other, such as the revised versions of the Secure Multipurpose Internet Mail Extensions (S/MIME) standard. With such standards, header data is included in an encrypted message that typically includes key identifying data, allowing a recipient to determine which private decryption key is to be used to decrypt the encrypted message data.
However, an interoperability problem can still arise when a dual certificate system and a single certificate system communicate with one another if a sending unit or receiving subscriber unit misinterprets or ignores the key usage data. For example, a single certificate sending unit, sending data to a dual certificate subscriber unit, may encrypt data using the subscribers' public signing key since it may use the first public key listed in its single certificate which may be the digital signing certificate. For example, this may happen with RSA algorithm keys, which may be used for both encryption and signatures. The message is encrypted using the signing key data. However, for encrypting data, the single certificate system should have used the public encryption key from the encryption certificate. When a receiving unit receives an encrypted message, the unit typically searches a user profile containing the securely stored matching private decryption key to decrypt the message. The matching key is typically found by using a key identifier or by other mechanisms such as inclusion of the public key certificate in the message header. However, when the signing certificate data is used for encryption, a receiving subscriber who expects an encryption key to have been used is typically unable to locate the proper or matching private decryption key. Hence the message cannot be decrypted by the receiving unit. Hence when some systems send an encrypted message, the system does not send the encryption key identifier or certificate to allow decryption by a receiving user, but instead sends the signing key identifier or certificate.
A system that sends or encrypts a message using a signing public key from the signing key identifier or certificate and sends the signing key identifier or certificate to a receiving unit prevents secure communication among users expecting to communicate. Hence conventional cryptographic systems may not be capable of communicating with systems that may improperly encrypt message data. Accordingly, it would be desirable to have a cryptography based system that facilitates detection of an improper encryption process yet allows suitable decryption so that a user may still communicate with a sender that is improperly encrypting information.
Where a sender may wish to send an encrypted message to one hundred recipients, typically an encryption key package is sent for each recipient as part of message header data. An encryption key package may include, for example, key identification data, such as a certificate serial number or unique key identifier data, or other information identifying the named recipient, from which key identifier data may be obtained, along with an encrypted public encryption key separately for each of the one hundred recipients. One copy of the encrypted message data is also sent with the encryption key packages so that a recipient typically needs to retrieve and store all one hundred key identification data entries corresponding to encrypted public encryption key for each recipient. This results in the unnecessary use of bandwidth and memory since each recipient retrieves and stores data associated with the other ninety nine recipients.
Typically when a recipient receives an encrypted message, the message is decrypted and read and then restored in an encrypted manner so that an adversary cannot readily obtain the information off of a memory storage unit such as a computer's hard drive. The required storage increases dramatically when a recipient receives hundreds of e-mail messages on a daily basis. Accordingly, it would be desirable to have a system that facilitates data transmission bandwidth and/or memory storage reduction where message data includes encryption key packages associated with multiple recipients.
Also, some cryptographic systems are known that may re-encrypt entire messages to facilitate a higher level of security, or to conform with security policy data at a recipient's site. For example a system employing a single DES algorithm may also employ a triple DES algorithm to provide additional security through the use of a longer encryption key. However, the storage of the entire message requires a substantial amount of storage space in a receiving unit's memory whether or not the message is re-encrypted.
Consequently, there exists a need for a system that facilitates detection of improper encryption and can correct the improper encryption and/or a system that facilitates a reduction of memory storage for encrypted data for public key cryptography based security systems and other data security systems or that provides a reduction in data transmission bandwidth.
REFERENCES:
patent: 5325432 (1994-06-01), Gardeck et al.
patent: 5361256 (1994-11-01), Doeringer et al.
patent: 5548646 (1996-08-01), Aziz
Just Michael K.
Van Oorschot Paul
Entrust Technologies Limited
Hayes Gail
Seal James
Vedder Price Kaufman & Kammholz
LandOfFree
Apparatus and method for reducing transmission bandwidth and... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Apparatus and method for reducing transmission bandwidth and..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Apparatus and method for reducing transmission bandwidth and... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3075530