Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements

Definitions

• the present invention relates to a system and a public key cryptographic method and a certification server, memories adapted for this system.
• Public key cryptosystems include:
• a computer entity capable of decrypting a message and / or signing with the aid of a private key corresponding to the public key
• At least a first memory in which an electronic certificate of the public key signed by a certification authority is recorded, this certificate comprising information for retrieving the public key
• At least one terminal capable of verifying the signature of the certificate and retrieving the public key from the information contained in the certificate before encrypting a message and / or verifying a signature using this public key.
• the electronic certificate has a field in which the public key is stored in the clear. This electronic certificate is public and therefore transmitted to any terminal that requests it. This certificate is used by the terminals to verify that the public key it wishes to use is that corresponding to the private key used by the IT entity. However, there are situations where it is desirable that among all the terminals able to verify the signature of the electronic certificate only some of them, called below authorized terminals, can retrieve the public key. Cryptographic systems in which electronic public key certificates are used do not currently allow for restricting access to the public key contained in the certificate.
• the invention aims to remedy this drawback by proposing a public key cryptographic system in which access to the public key is restricted to authorized terminals.
• the subject of the invention is therefore a public key cryptographic system in which the information contained in the certificate is insufficient on its own to retrieve the public key to be used.
• the system comprises at least a second memory in which additional information is recorded for retrieving the public key when used in combination with the information contained in the certificate, access to this additional information being reserved for a limited number of authorized terminals among all the terminals capable of verifying the signature of the certificate.
• the additional information is reserved for a limited number of authorized terminals among all the terminals that can verify the signature of the electronic certificate.
• the public key can only be retrieved by these authorized terminals, which limits the accessibility of this public key while using an electronic certificate public key.
• Embodiments of this system may include one or more of the following features: the information contained in the certificate comprises a cryptogram of at least a portion of the public key, and the additional information includes a decryption key for decrypting the cryptogram, the information contained in the certificate includes an identifier of at least a part of the public key in a list, this list comprising several said at least one key part each associated with an identifier, and the additional information includes this list, the information contained in the certificate include the address of an authentication server to allow access to at least some of the additional information in response to the identification and / or
• the information contained in the certificate include an identifier of a method of recovering additional information among several possible recovery methods, and the system comprises at least one list of recovery methods for finding the recovery method to be used depending on the identifier of the recovery process.
• the subject of the invention is also a certification server of a certification authority, a memory comprising this electronic certificate and a memory containing the additional information used in the above system.
• the invention also relates to a public key cryptographic method implemented in the system described above.
• FIG. 1 is a schematic illustration of the architecture of a public key cryptosystem
• FIG. 2 is a schematic illustration of an electronic public key certificate used in the system of FIG. 1
• FIG. is a flowchart of a public key cryptographic process.
• FIG. 1 represents a cryptographic system with a public key designated by the general reference 2.
• This system 2 comprises a computer entity 4 able to decipher a message and / or to sign using a private key Pr (U) and terminals capable of encrypting a message and / or verifying a signature using a public key Pub (U) corresponding to the private key Pr (U).
• Pub Pub
• the entity 4 comprises in particular an electronic module 10 for decrypting a message and / or signature using the key Pr (U).
• the module 10 is connected to a memory 12 containing the key Pr (U).
• this memory 12 also includes the pub public key (U) and an electronic certificate C of the pub public key (U).
• This certificate C is adapted so that terminals such as the terminal 6 can verify that the public key Pub (U) it wishes to use actually corresponds to the private key Pr (U) used by the entity 4.
• the entity 4 is connected to the different terminals with which it is able to exchange encrypted messages via an information transmission network 16.
• This network 15 is a local area network or a wide area network such as the Internet network.
• the entity 4 is, for example, a computer server.
• the certificate C of the entity 4 is shown in more detail in FIG. 2.
• This certificate C comprises a location 20 comprising two fields 22 and 24 of information.
• the field 22 is normally intended to contain an identifier of an encryption or decryption algorithm and the field 24 is normally intended to contain the plaintext public key to be used together with the algorithm identified by the field 22.
• the exact content of the Field 22 and the Pub '(U) content of field 24, in the context of system 2, will be detailed later.
• the certificate C also comprises other fields such as in particular: a field 26 intended to contain the identity of the possessor of the certificate C, that is to say here the identity of the entity 4 such as, for example, his name or his address on the network 16,
• the certificate C contains a cryptographic signature 32 established by encrypting, for example, all or only some of the information contained in the preceding fields using a private key Pr (AC) of the certification authority.
• This signature enables a terminal to verify the authenticity of the certificate and thus to have confidence in the information contained in this certificate and in particular in the information contained in the location 20.
• the system 2 also comprises at least one certification server 40 of the certification authority that has established the certificate C.
• the server 40 is associated with a memory 42 in which the key Pr (AC) used to sign the certificate C.
• this memory 42 also includes the key Pub (U), a cryptographic key E (T) and a list 46 of several keys associating with each public key a unique identifier.
• This list 46 includes in particular an identifier for the key Pub (U).
• the key E (T) is, for example, a public key corresponding to a private key D (T) known and used only by the terminal 6.
• the memory 42 also comprises a list 48 of methods for setting the content Pub '(U) of the field 24 and a list 49 of methods for retrieving the key Pub (U).
• the list 48 includes an identifier Pi of the method.
• the same identifier Pi is associated with the recovery method making it possible to retrieve the key Pub (U) from the content Pub '(U) established according to the procedure of establishment Pi.
• the server 40 is connected to the network 16 to transmit through this network the certificates it has established.
• the terminal 6 comprises a module 50 for encryption and / or signature verification capable of executing cryptographic algorithms.
• this module 50 is associated with a memory 52 comprising the cryptographic algorithms used and the corresponding keys.
• the memory 52 includes in particular a public key Pub (AC).
• This memory 52 also includes additional information for retrieving the key Pub (U) when used together with the information contained in the certificate C.
• the memory 52 here comprises, the key D (T), a list 56 of keys associating for each key identifier a public key and a list 58 of methods of recovery of the key Pub (U).
• the list 56 is, for example, identical to the list 46.
• the list 58 associates each recovery method with an identifier of this method.
• This list 58 is, for example, identical to the list 49.
• Access to the memory 52 is reserved for a limited number of authorized terminals such as, for example, the terminal 6, among all the terminals capable of verifying the signature of the certificate C.
• the system 2 comprises a module 62 for restricting access to the additional information contained in the memory 52.
• This module 62 is, for example, able to identify and / or authenticate a third party before authorizing access to the memory 52. illustration, this module 62 is implemented in the terminal 6 to, in particular, identify and authenticate the user of the terminal 6 before the module 50 can access the memory 52.
• the system 2 comprises an identification and authentication server 70 connected to the network 16.
• This server 70 is associated with a memory 72 containing the public key Pub (U).
• the server 70 comprises a restriction module 74 able to identify and authenticate a terminal or a user before authorizing access to the Pub key. (U) contained in its memory 72.
• the memory 72 comprises, for example, a list 76 of identifiers and authenticators of authorized terminals to which the key Pub (U) can be communicated.
• the authenticator is, for example, a simple password.
• the entity 4 transmits to the certification server 40 a request to obtain the certificate C for the public key Pub (U).
• This request contains, for example, proof that the entity 4 has the private key Pr (U).
• the entity 4 signs a message with its private key Pr (U).
• This request contains other information identifying the entity 4, such as its name or address on the network 16.
• the certification server 40 builds the certificate C. More specifically, the server 40 begins by checking, during a step 94, the proof transmitted by the entity 4. For example, the server 40 decrypts with the key Pub (U) the encrypted message using the key Pr (U) transmitted during the step 90. In the case where this verification is negative, the process s' stopped. In the opposite case, the server chooses, during a step 96, a method of establishing the information contained in the certificate C and more precisely the information contained in the element 20 of the certificate. This method of establishment is chosen, for example, from the list 48. By way of illustration, the list 48 comprises three methods Pi, P 2 and P 3 for setting the content Pub '(U) of the field 24.
• the content Pub '(U) is obtained by encrypting the public key Pub (U) using the key E (T).
• the content Pub '(U) is the identifier associated with the key Pub (U) in the list 46.
• the content Pub '(U) is the address on the network 16 of the authentication server 70.
• the other fields of the certificate are completed as recommended by the X.509 standard.
• this method is executed in a step 98.
• the certificate of the key Pub (U) is constructed, during a step 100, by completing the field 22 with the identifier Pi of the method of retrieving the key Pub (U) and the field 24 with the content Pub '(U).
• the identifier Pi of the recovery method is here identical to the identifier Pi of the content establishment method Pub '(U).
• the server 40 transmits, during a step 102, this certificate C to the entity 4 which stores it in its memory 12.
• the entity 4 transmits, during a step 104, the certificate C to the terminal 6.
• the terminal 6 saves it in a non-volatile memory , such as the memory 52, or in a volatile memory and checks, during a step 106, the signature of this certificate C. For this purpose, during step 106, the terminal 6 decrypts the signature 32 to the using the Pub Key (AC). If this check is negative, that is, the certificate C is not authenticated, then the process stops. In the opposite case, the terminal 6 proceeds to a phase 110 of recovery of the public key Pub (U).
• Pub Pub
• the terminal 6, during a step 112 identifies the method of recovery of the key Pub (U) to be used by using the content of the field 22 of the certificate C.
• the terminal 6 extracts the content Pub '(U) of the field 24. Then, the terminal 6 accesses, during a step 116, the additional information necessary to obtain the key Pub (U) from the content Pub '(U).
• the module 62 checks, during an operation 128, whether the conditions for accessing the memory 52 are met. For example, access to the memory 52 is allowed only if the user of the terminal 6 is correctly identified and authenticated.
• the terminal 6 connects, during an operation 122, to the authentication server identified by the address contained in the field 24. Here, it is assumed that this address is that of the identification and authentication server 70. Then, during an operation 124, the terminal 6 transmits to the server 70 the information to identify and authenticate.
• the module 74 checks, during a step 126, whether the identification and authentication information transmitted by the terminal 4 corresponds to identification and authentication information contained in the list 76. If so, the module 74 allows access to the additional information constituted here by the key Pub (U) stored in the memory 72. In the opposite case, the process stops.
• the terminal 6 uses, in a step 130, the additional information to retrieve the key Pub (U). More precisely, during this step 130, if the identifier of the recovery method is P 1 , the terminal 6 decrypts, during an operation 132, the content Pub '(U) using the key D (T ).
• the terminal 6 retrieves, during an operation 134, the key Pub (U) in the list 56 using this identifier.
• the terminal 6 retrieves, during an operation 136, the key Pub (U) stored in the memory 72 of the server 70.
• the terminal 6 uses it to encrypt a message and / or verify the signature of the entity 4. For example, during a step 140, the terminal encrypts a message transmitted to the entity 4 by means of the key Pub (U) then, during a step 142, the entity 4 decrypts this message using the key Pr (U).
• the entity 4 transmits to the terminal 6 a signature established using the key Pr (U) and the terminal 6 verifies this signature, during the step 142, to the using the Pub key (U).
• the key Pub (U) thus recovered can also be used to authenticate the entity 4 during information exchanges between the terminal 6 and the entity 4. For example, the terminal 6 transmits a random number to the entity 4 who numbers it or signs it using, the key
• the terminal 6 decrypts the cryptogram transmitted using the public key Pub (U) to authenticate the entity 4.
• certificate C is public, that is, it can be obtained by many terminals and many terminals of system 2 are able to verify the signature of this system. certificate, only authorized terminals can retrieve the public key from the information contained in this certificate. For unauthorized terminals, that is to say those who do not have access to the additional information, the certificate C is unusable to recover the key Pub (U). Thus, in the system 2, access to the pub public key (U) is restricted, although a public key certificate is used.
• the keys E (T) and D (T) can be replaced by symmetric keys.
• the restriction software module 62 may be replaced by a mechanical memory access restriction module 52.
• the memory 52 may only be accessible from the terminal 6. This will, for example, be the case if the terminal 6 is a computer and if the memory 52 corresponds to a non-shared portion of the hard disk of this computer.
• the certificate is stored in a memory 12 associated with the entity 4, then transmitted via the network 16 to the terminal 6.
• the certificate C is stored in a removable memory such as, for example , the memory of a smart card, and it is this removable memory that is transmitted to the terminal 6 when it wishes to communicate with the entity 4.
• the certificate C can also be registered in a directory available to all terminals so that in this variant, step 104 of the method is replaced by a step of consulting this directory.
• the list 58 of recovery methods has been described as part of the additional information whose access is reserved for authorized terminals.
• this list 58 is stored in a memory freely accessible by all authorized or unauthorized terminals of the system 2.
• the content Pub '(U) can be formed by the concatenation of several cryptograms of the key Pub (U) respectively obtained using keys E (T 1 ), E (T 2 ), ..., the keys E (Ti) being respective cryptographic keys of the authorized terminals T 1 , T 2 , ....
• the content Pub '(U) may be formed of a cryptogram A of the key Pub (U) obtained using a key K and cryptograms Ki obtained by encrypting the key K using keys E (Tj . ) specific to each authorized terminal Ti.
• the content Pub '(U) will preferably conform to the PKCS # 7 / CMS standard.
• the identifier of the key Pub (U) has been described as being predefined in a list 46.
• this identifier is dynamically created by the authentication server when the certificate is created. C and the authentication server is able to update the list 56 of the terminal 6 so that it includes the dynamically created identifier associated with the public key Pub (U).
• the authentication server uses, alternatively, as identifier of the key Pub (U) one or more of information contained in the other fields of the certificate such as, for example, the serial number of the certificate.
• the field 22 contains the identifier P 2 and the field 24 is empty since, for example, the serial number of the certificate is already contained in the field 30.
• the server 70 has been described as being separate from the server 40. In a variant, these two servers are merged.
• the server 70 is, alternatively, either only able to identify a terminal or only able to authenticate a terminal.
• System 2 has been described in the particular case where three methods of recovering the key Pub (U) can be used. Alternatively, only one or two of these recovery methods are used. The elements corresponding to the unused recovery methods are then deleted from the system 2. In particular, in the case where a single recovery method is used in the system 2, the step 96 may be deleted and the recovery phase 110 may be simplified. Finally, the system 2 has been described in the particular case where all the additional information necessary to recover the key Pub (U) by implementing a recovery process Pi are recorded in a single location. As a variant, the additional information to be used during the execution of a recovery method Pi is distributed in different memories protected by different access restriction modules.
• the recovery methods Pi described here can also be combined.
• the key Pub (U) is split into first and second parts.
• the first part is encrypted using the key E (T) and the second part is stored in the memory 72 of the authentication server 70.
• the content Pub '(U) is then formed by the cryptogram of the first part of the key and by the address of the authentication server.
• the content Pub '(U) can also be formed by an identifier of the first part of the key Pub (U) in a list stored in the memory 52 and by the address of an authentication server able to authorize the access to the second part of the Pub key (U).
• the memories described here may also be particular areas of larger information storage means.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Storage Device Security (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=34950358

Family Applications (1)

Country Status (4)

Families Citing this family (6)

Family Cites Families (7)

• 2004
  • 2004-09-29 FR FR0410307A patent/FR2875977A1/fr not_active Withdrawn
• 2005
  • 2005-09-28 WO PCT/FR2005/002396 patent/WO2006035159A1/fr active Application Filing
  • 2005-09-28 US US11/663,991 patent/US20080159543A1/en active Pending
  • 2005-09-28 EP EP05804306A patent/EP1794926A1/de not_active Withdrawn

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events