Non-hierarchical infrastructure for managing twin-security keys of physical persons or of elements (IGCP/PKI)
Inventors
Thoniel, Pascal • Melemedjian, Francis
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-9397839-B2
Publication Date
2016-07-19
Expiration Date
Abstract
A non-hierarchical infrastructure for managing twin-security keys of physical persons or of elements includes a public key and a private key with a public key certificate. The structure does not include any certification authority distinct from the physical persons or elements, but does include at least one registering authority and its electronic notary server. There is provided at least one registering authority and its electronic notary server for a circle of trust. The registering authority includes local registering agencies. The local registering agency establishes, after face-to-face verification of the identity of the physical person or of the identification of the element, a public key certificate, and a “public key ownership certificate”, which does not contain the public key of the person or of the element but the print thereof, and which is transmitted in a secure manner to the associated electronic notary server for storing in a secure manner.
Core Innovation
The invention relates to a non-hierarchical infrastructure for managing security key pair for physical persons or items, comprising a public key and a private key. It uses a public key certificate having a unique number, and it explicitly excludes any certification authority separate from the physical persons or items. The infrastructure comprises registration authorities with electronic notary servers in a trust circle, where each registration authority includes a plurality of proximity local registration agencies.
For each physical person or item, a local registration agency, implemented as a computer device with an installed program, establishes a public key certificate. The public key certificate comprises first data including the unique number, the public key, an identification of the physical person or item, and an address of the electronic notary server for which the local agency has registered the physical person or item, together with a signature of the first data. The same program also establishes a public key ownership certificate which is self-sealed and comprises second data including the same unique number, the identity or element identification, a representation of the public key, and a signature with the private key of the physical person or item associated with the public key.
The third data of the public key ownership certificate includes the identity of the physical person or the identification of the element and a representation of the public key, and this third data is encrypted with the private key of the physical person or item according to an atypical use, so that the third data is opaque but the unique number is not. The ownership certificate is transmitted securely and stored by the associated electronic notary server. The architecture further relies on an electronic notary server database in which the ownership certificates are stored and indexed, enabling a verification workflow that associates requests to the electronic notary server using information from the public key certificate, and delivers authenticity versus non-authenticity assertions based on matching certificate numbers and subsequent checks on stored representations.
Claims Coverage
The partial content provides one independent claim. The main claim coverage centers on a non-hierarchical PKI infrastructure without a separate certification authority, registration authorities with electronic notary servers in a trust circle, self-sealed public key ownership certificates tied to unique certificate numbers, and notary-based verification producing authenticity versus non-authenticity assertions using database lookups and checks.
Non-hierarchical infrastructure without separate certification authority
A non-hierarchical infrastructure for managing a security key pair for physical persons or items, comprising a public key and a private key, with a public key certificate having a unique number, wherein the infrastructure does not include any certification authority separate from the physical persons or items.
Registration authority with trust circle electronic notary server and proximity local registration agencies
For each of at least one registration authority, an electronic notary server of said registration authority provided for a trust circle, the registration authority comprising a plurality of proximity local registration agencies.
Self-sealed public key certificate and public key ownership certificate with shared unique number
For each physical person or item, establishing a public key certificate comprising first data including a unique number, a public key, an identification, an address of the electronic notary server for which the local agency has registered the physical person or item, and a signature of said first data, and establishing a public key ownership certificate which is self-sealed, comprising second data including the same unique number as the public key certificate, the identity or element identification, a representation of the public key thereof, and a signature with a private key of the physical person or item associated with said public key.
Atypical encryption to render third data opaque while preserving the unique number
Third data of the public key ownership certificate including the identity or identification and a representation of the public key thereof, wherein said third data is encrypted with the private key of the physical person or item according to an atypical use of this key to render said third data opaque but not the unique number.
Secure transmission and storage of public key ownership certificate in associated electronic notary server
Transmitting securely said public key ownership certificate to the associated electronic notary server which stores it.
Server public key certified by internationally recognized certification authority excluding client certificates
The electronic notary server’s public key is certified by an internationally recognized certification authority that does not certify client certificates of physical persons or items.
Across the independent claim and the provided dependent claim refinements, the architecture is centered on a non-hierarchical security-key management infrastructure that removes any separate certification authority for physical persons or items, uses registration authorities with electronic notary servers in a trust circle, and binds public key material to unique certificate numbers through self-sealed public key ownership certificates transmitted to and stored by the electronic notary servers.
Stated Advantages
Reduces systemic risk and cost versus hierarchical CA-based PKIs.
Documented Applications
Notary-based real-time verification workflow for authentic versus non-authentic assertions of alleged public keys using request and response modules querying and consulting electronic notary server databases indexed by certificate number.
Interested in licensing this patent?