Certificate-based encryption implemented with multiple encryption schemes

A method for a certificate-based encryption system, comprising:

• configuring an encryption module on a device of a first user encrypt a message;
• configuring the encryption module and a decryption module to cooperate with an identity-based key generator of users in a communication system in order to use an identity-based and certificate-based construction using two or more encryption schemes with an encrypted message communicated between users of the communication system such that the encrypted message received by the device of the first user needs keys from each of the two or more encryption schemes to be able to decrypt the encrypted message;
• configuring a validation module on the device of the first user to cooperate with a limited-time of validity certificate issued from a certificate authority platform to decrypt the encrypted message via the limited-time of validity certificate, where the validation module is further configured to allow the decryption module to decrypt the encrypted message with the limited-time of validity certificate, corresponding to an identity of the first user, when the first user is determined to be actually validated for a period of time specified for the limited-time of validity certificate;
• configuring the limited-time of validity certificate to indicate a secret key of an identity-based encryption scheme tied to an identity of the first user;
• and
• configuring the validation module to reference the limited-time of validity certificate to confirm i) the identity of the first user tied to the secret key of the identity- based encryption scheme and ii) a current time period of validity for the limited-time of validity certificate is within a time period indicated by the limited-time of validity certificate.

A non-transitory computer-readable medium including executable instructions that, when executed with one or more processors, cause a computing device to perform operations as follows, comprising:

• causing an encryption module and a decryption module to cooperate with an identity-based key generator of users in a communication system in order to use an identity-based and certificate-based construction using two or more encryption schemes with an encrypted message communicated between users of the communication system such that the encrypted message received by the device of a first user needs keys from each of the two or more encryption schemes to be able to decrypt the encrypted message;
• causing a validation module on the device of the first user to cooperate with a limited-time of validity certificate issued from a certificate authority platform to decrypt the encrypted message via the limited-time of validity certificate, where the validation module is further configured to allow the decryption module to decrypt the encrypted message with the limited-time of validity certificate, corresponding to an identity of the first user, when the first user is determined to be actually validated for a period of time specified for the limited-time of validity certificate;
• and
• causing the limited-time of validity certificate to indicate a secret key of an identity-based encryption scheme tied to an identity of the first user;
• causing the validation module to reference the limited-time of validity certificate to confirm i) the identity of the first user tied the secret key of the identity-based encryption scheme and ii) a current time period of validity for the limited-time of validity certificate is within a time period indicated by the limited-time of validity certificate;
• and
• causing the certificate authority platform to grant the first user's validation and use the identity-based key generator.

A system, comprising:

• a certificate authority platform including an identity-based key generator configured to grant users of a communication system validation to decrypt messages via a limited-time of validity certificate corresponding to that particular user's identity issued from the certificate authority platform,
• where a validation module on each device of each user of the communication system is configured to allow a decryption module on a device of that user to decrypt an encrypted message with the limited-time of validity certificate when that user is validated during that time period, where the limited-time of validity certificate is configured to indicate a secret key of an identity-based encryption scheme tied to an identity of the first user;
• where the validation module is further configured to reference the limited-time of validity certificate to confirm i) the identity of the first user tied to the secret key of the identity-based encryption scheme and ii) a current time period of validity for the limited-time of validity certificate is within a time period indicated by the limited-time of validity certificate,
• where the identity-based key generator uses an identity-based encryption scheme, where the identity-based key generator and the validation module are configured to cooperate to designate that the particular user can legitimately use an identity-based key in the limited-time of validity certificate to unencrypt during its designated time period;
• and thus, the identity-based key generator is configured to act as the certificate authority that grants a first user validation, where the identity-based key generator is configured to cooperate with the certificate authority platform to send each validated user the limited-time of validity certificate corresponding to that particular user's identity and the time period when that certificate is valid, where a formerly valid limited-time of validity certificate becomes invalidated after the designated time period and a formerly valid user becomes invalidated after the designated time period,
• a plurality of instances of public-secret key pair generators, each resident on its own device of the users of the communication system, where the public-secret key pair generators are configured to implement a second encryption scheme, where an encryption module of the device of the first user is configured to apply aspects of both encryption schemes to ciphertext, including messages, communicated between the devices of the users of the communication system, where an instance of a secret key generated by each public-secret key pair generator is not sent or in any other way communicated to the certificate authority platform so that the certificate authority platform does not have any ability to decrypt the messages communicated between the users of the communication system, where the second encryption scheme is independent from and different than the identity-based encryption scheme,
• where the validation module is configured to check whether the first user's device is valid to decrypt the encrypted message with the limited-time of validity certificate when they are validated for that time period;
• and
• where algorithms of the identity-based key generator, the encryption module, the decryption module, the public-secret key pair generators, and the validation module are implemented in hardware electronic components, in software stored in one or more non-transitory machine-readable mediums to be executed by one or more processors, and any combination of both.