Method for providing secure digital signatures
AssigneeLuxTrust S.A.
InventorThomas Kopp
Life of this patent
Estimating the term…
Abstract
The invention provides a method for providing a strong link between a Subject and a cryptographic public/private key pair. The proposed Subject device and key distribution algorithm is less prone to man-in-the middle attacks as comparable known algorithms, thereby inherently strengthening the trustworthiness of any digital signature made with a private key distributed to a user in accordance with the proposed method. The invention additionally enables distribution of authentication factors over unsecure channels and reducing the need of sensitive information transmission by at the same time augmenting security for finally associating a generated public/private key pair to a Subject and using it for signature creation purposes.
Claims19
A method for digitally signing data using a cryptographic key in a communication network comprising a server node and at least one further network node, the method comprising the following steps:
- (a) generating a cryptographic public key/private key pair using a cryptographic key generator, wherein said key pair is not associated with any Subject's identity;
- (b) at the server node, storing said public key in a public key store, and
- (c) storing said private key in a private key store, access to which is granted using a predetermined associated primary authentication factor and at least one yet undefined supplementary authentication factor;
- (d) subsequently providing an unidentified user, the Subscriber, with said primary authentication factor, said Subscriber being associated with an identifiable Subject yet unknown to the server node;
- (e) defining the at least one yet undefined supplementary authentication factor in association with said private key store with data chosen by, and proprietary to, said Subscriber, thereby uniquely associating said private key store and said key pair to the Subject associated with said Subscriber;
- (f) subsequently receiving, at the server node from at least one network node, data identifying said Subscriber and the associated Subject, said data being cryptographically signed with said private key using a digital signature creator;
- (g) at the server node, validating said received data, and associating the so-identified Subject with said key pair;
- (h) at any one of said network nodes, causing data to be cryptographically signed with said private key using the digital signature creator, said signed data being certifiable to have been signed by said Subject, based on the corresponding public key and the Subject associated therewith.
A computer program product comprising computer readable code embedded in a non-transitory computer readable medium, which when run on a computer, causes the computer, for digitally signing data using a cryptographic key in a communication network comprising a server node and at least one further network node, to carry out the following steps:
- (a) generating a cryptographic public key/private key pair using a cryptographic key generator, wherein said key pair is not associated with any Subject's identity;
- (b) at the server node, storing said public key in a public key store, and (c) storing said private key in a private key store, access to which is granted using a predetermined associated primary authentication factor and at least one yet undefined supplementary authentication factor;
- (d) subsequently providing an unidentified user, the Subscriber, with said primary authentication factor, said Subscriber being associated with an identifiable Subject yet unknown to the server node;
- (e) defining the at least one yet undefined supplementary authentication factor in association with said private key store with data chosen by, and proprietary to, said Subscriber, thereby uniquely associating said private key store and said key pair to the Subject associated with said Subscriber;
- (f) subsequently receiving, at the server node from at least one network node, data identifying said Subscriber and the associated Subject, said data being cryptographically signed with said private key using a digital signature creator;
- (g) at the server node, validating said received data, and associating the so-identified Subject with said key pair;
- (h) at any one of said network nodes, causing data to be cryptographically signed with said private key using the digital signature creator, said signed data being certifiable to have been signed by said Subject, based on the corresponding public key and the Subject associated therewith.
A computer system comprising computer readable code embedded in a non-transitory computer readable medium for carrying out digitally signing data using a cryptographic key in a communication network comprising a server node and at least one further network node, the computer system comprising:
- (a) generating a cryptographic public key/private key pair using a cryptographic key generator, wherein said key pair is not associated with any Subject's identity;
- (b) at the server node, storing said public key in a public key store, and (c) storing said private key in a private key store, access to which is granted using a predetermined associated primary authentication factor and at least one yet undefined supplementary, authentication factor;
- (d) subsequently providing an unidentified user, the Subscriber, with said primary authentication factor, said Subscriber being associated with an identifiable Subject yet unknown to the server node;
- (e) defining the at least one yet undefined supplementary authentication factor in association with said private key store with data chosen by, and proprietary to, said Subscriber, thereby uniquely associating said private key store and said key pair to the Subject associated with said Subscriber;
- (f) subsequently receiving, at the server node from at least one network node, data identifying said Subscriber and the associated Subject, said data being cryptographically signed with said private key using a digital signature creator;
- (g) at the server node, validating said received data, and associating the so-identified Subject with said key pair;
- (h) at any one of said network nodes, causing data to be cryptographically signed with said private key using the digital signature creator, said signed data being certifiable to have been signed by said Subject, based on the corresponding public key and the Subject associated therewith.
Dependencies are inferred from the claim text.