US5452357A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for access control and/or identification
Assignee: Vantiva SA
•
Filing: 1995-03-06
•
Granted: 1995-09-19
•
Expires: 2015-03-06
Abstract
Abstract A system providing access control, including encryption and decryption capability, replaces a public key directory by a transmission between an authority, or a sender S, and a receiver R of a "seed" value. The seed is processed to provide both identity information for R and public keys, i.e. a "virtual public key directory", or VPKD. The VPKD is generated prior to execution of the algorithm requiring the public directory, i.e. the host algorithm.
Inventors
- 👤 David Naccache
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 21:50
CPC Classifications
G; G07; G07F; G07F7/00; G07F7/08; G07F7/10; G07F7/1008; G06; G06Q; G06Q20/00; G06Q20/30; G06Q20/34; G06Q20/341; G06Q20/38; G06Q20/40; G06Q20/409; G06Q20/4097; G06Q20/40975; H; H04; H04L; H04L9/00; H04L9/32; H04L9/3218; H04L9/3234
Claims Analysis
Total Claims: 32
Claim 1
Independent Claim
348 words
A method for access control for authorizing a user device, comprising the steps of: generating in an authorizing device an identification data signal representative of identification data unique to the user device; generating in the authorizing device an encrypted data signal including data encrypted depending on the identification data and having been calculated mod n, where n is a product of at least two prime numbers; providing the encrypted data signal to the user device from the authorizing device; exchanging between the user device and a verifier device at least a portion of the encrypted data; checking by the verifier device the validity of the data exchanged on a mod n basis; and further comprising authorizing steps performed in an initial user set-up interval including: a) combining by the authorizing device the identification data with public key data PK j and data representative of a number c to produce data representative of a combined number G having a d-th root g mod n such that G=g d mod n, and such that each PK j has ε roots rood n, designated SK j -1 ; b) storing data representative of g and n in a memory included in the user device; and further comprising verifying steps including: c) sending data representative of g from the user device to the verifier device; d) computing, in the verifier device, G=g 2 mod n; and separating, in the verifier device, the identification data and the public key data PK j from G; e) selecting, in the user device, a random number δ in the range ##EQU12## and computing in the user device, a value E where E=δ.sup.ε mod n; and sending E to the verifier device; f) selecting in the verifier device a random binary vector v where v=(v 1 v 2 . . . v k ); and sending v to the user device g) computing in the user device; ##EQU13## sending z to the verifier device; h) checking in the verifier device to determine if: ##EQU14## wherein ε=2 or ε=3 and a and b are a constant, especially a=b=1.
Claim 2
Independent Claim
348 words
A method for access control for authorizing a user device, comprising the steps of: generating in an authorizing device an identification data signal representative of identification data unique to the user device; generating in the authorizing device an encrypted data signal including data encrypted depending on the identification data and having been calculated mod n, where n is a product of at least two prime numbers; providing the encrypted data signal to the user device from the authorizing device; exchanging between the user device and a verifier device at least a portion of the encrypted data; checking by the verifier device the validity of the data exchanged on a mod n basis; and further comprising authorizing steps performed in an initial user set-up interval including: a) combining by the authorizing device the identification data with public key data PK j and data representative of a number c to produce data representative of a combined number G having a d-th root g mod n such that G=g d mod n, and such that each PK j has ε roots rood n, designated SK j -1 ; b) storing data representative of g and n in a memory included in the user device; and further comprising verifying steps including: c) sending data representative of g from the user device to the verifier device; d) computing, in the verifier device, G=g 2 mod n; and separating, in the verifier device, the identification data and the public key data PK j from G; e) selecting, in the user device, a random number δ in the range ##EQU12## and computing in the user device, a value E where E=δ.sup.ε mod n; and sending E to the verifier device; f) selecting in the verifier device a random binary vector v where v=(v 1 v 2 . . . v k ); and sending v to the user device g) computing in the user device; ##EQU13## sending z to the verifier device; h) checking in the verifier device to determine if: ##EQU14## wherein ε=2 or ε=3 and a and b are a constant, especially a=b=1.
Claim 3
Dependent Claim
47 words
The method of claim 1, wherein ε>2 and further comprising the step of receiving in the verifier device data representative of the values SK j -2 , especially via the user device, the values SK j -2 being stored in the memory included in the user device.
Claim 4
Dependent Claim
31 words
The method of claim 1, wherein in step a) the number c is omitted and the combination of ID and PK is permuted until G is a d-th power mod n.
Claim 5
Dependent Claim
14 words
The method of claim 1, wherein d has a value of d=2 or d=3.
Claim 6
Dependent Claim
29 words
The method of claim 1, wherein in step a) for forming G, ID and PK and/or c are combined according to ID&PK&c in which the symbol & indicates concatenation.
Claim 7
Dependent Claim
13 words
The method of claim 1, wherein the identification data ID is a constant.
Claim 8
Dependent Claim
34 words
The method of claim 1, wherein the exponentiation of g is replaced by a polynomial computation such that the authority uses a sequence of public numbers Ω i and computes g such that ##EQU15##
Claim 9
Dependent Claim
14 words
The method of claim 1 wherein a and b are algebraic or electronic functions.
Claim 10
Dependent Claim
24 words
The method of claim 1 wherein the number n is a binary number having a number of bits in the range 450 to 570.
Claim 11
Dependent Claim
70 words
The method of claim 1, wherein the user device and the verifier device generate a value Ω from the random binary vector v and/or from the random number δ and/or from data and/or numbers resulting from previous calculations, and wherein steps g) and h) are modified to: g) computing in the user device ##EQU16## sending z to the verifier device; h) checking in the verifier device to determine if: ##EQU17##
Claim 12
Dependent Claim
31 words
The method of claim 1, wherein steps e) to h) are repeated t times with different random binary vectors v and/or random numbers δ, t greater than or equal to 1.
Claim 13
Independent Claim
13 words
The method of 11, wherein t has a value of at least t=4.
Claim 14
Independent Claim
13 words
The method of 11, wherein t has a value of at least t=4.
Claim 15
Dependent Claim
17 words
The method of claim 1, wherein a set of at least k=18 key values PKj is used.
Claim 16
Dependent Claim
19 words
The method of claim 11, wherein the product k*t has a value in the range of 64 to 80.
Claim 17
Dependent Claim
20 words
The method according to claim 1 wherein steps e) to h) are carried out using binary or trinary logic signals.
Claim 18
Dependent Claim
313 words
In an access control system or identification system, a user device which has been authorized by an authorizing device having calculated identification data ID unique to the user device and having provided the user device with encrypted data depending on the identification data ID which are calculated mod n, wherein for verifying the identity of the user device, the user device exchanges at least a part of the encrypted data with a verifier device which checks the validity of the data exchanged on a mod n basis, n being a product of at least two prime numbers, and wherein the identification data ID are combined with a public key data PK j and data representative of a number c to provide data representative of a combined number G having a d-th root g mod n according to G=g d mod n, and wherein each data value PK j has ε-roots mod n designated SK j -1 , the user device comprising: memory means for storing data representative of g and n; means for calculating; and interface means for exchanging data between the verifier device and the user device; wherein for verifying: i) the user device sends, via the interface means, data representative of g to the verifier device; j) the user device selects a random number δ in the range ##EQU18## and computes in the calculating means a value E=δ.sup.ε mod n, and sends via the interface means data representative of value E to the verifier device; k) the user device receives from the verifier device via the interface means data representative of a random binary vector v=(v 1 v 2 . . . v k ); l) the user device computes in the calculating means ##EQU19## sends data representative of z via the interface means to the verifier device, wherein ε=2 or ε=3 and a and b are a constant, especially a=b=1.
Claim 19
Dependent Claim
313 words
In an access control system or identification system, a user device which has been authorized by an authorizing device having calculated identification data ID unique to the user device and having provided the user device with encrypted data depending on the identification data ID which are calculated mod n, wherein for verifying the identity of the user device, the user device exchanges at least a part of the encrypted data with a verifier device which checks the validity of the data exchanged on a mod n basis, n being a product of at least two prime numbers, and wherein the identification data ID are combined with a public key data PK j and data representative of a number c to provide data representative of a combined number G having a d-th root g mod n according to G=g d mod n, and wherein each data value PK j has ε-roots mod n designated SK j -1 , the user device comprising: memory means for storing data representative of g and n; means for calculating; and interface means for exchanging data between the verifier device and the user device; wherein for verifying: i) the user device sends, via the interface means, data representative of g to the verifier device; j) the user device selects a random number δ in the range ##EQU18## and computes in the calculating means a value E=δ.sup.ε mod n, and sends via the interface means data representative of value E to the verifier device; k) the user device receives from the verifier device via the interface means data representative of a random binary vector v=(v 1 v 2 . . . v k ); l) the user device computes in the calculating means ##EQU19## sends data representative of z via the interface means to the verifier device, wherein ε=2 or ε=3 and a and b are a constant, especially a=b=1.
Claim 20
Dependent Claim
27 words
Apparatus according to claim 16, wherein the number n is a binary number and the number of bits in n is in the range 450 to 570.
Claim 21
Dependent Claim
31 words
Apparatus according to claim 16, wherein steps j) to l) are repeated t times with different random binary vectors v and/or random numbers δ, t greater than or equal to 1.
Claim 22
Dependent Claim
14 words
Apparatus according to claim 18, wherein t has a value of at least t=4.
Claim 23
Dependent Claim
19 words
Apparatus according to claim 16, wherein steps j) to l) are carried out using binary or trinary logic signals.
Claim 24
Dependent Claim
334 words
In a system for access control or identification, a verifier device which verifies the identity of a user device which has been authorized by an authorizing device, the authorizing device having calculated identification data ID unique to the user device, and having provided the user device with encrypted data depending on the identification data ID which are calculated mod n, wherein the verifier device and the user device exchange at least a part of the encrypted data and check the validity of the data exchanged on a mod n basis, wherein n is a product of at least two prime numbers, and wherein the identification data ID are combined with data representative of a public key PK j and data representative of a number c to provide data representative of a combined number G having a d-th root g mod n such that G=g d mod n, and wherein each PK j has ε-roots mod n designated SK j -1 , the verifier device comprising: memory means for storing data representative of the value n; means for calculating; and interface means for exchanging data between the verifier device and the user device; wherein for verifying: m) the verifier device receives data representative of g via the interface means from the user device and, in the calculating means, computes G=g 2 mod n and separates from G the identification data ID and the public key data values PK j ; n) the verifier device receives data representative of a value E=δ.sup.ε mod n from the user device via the interface means, and selects a random binary vector v=(v 1 v 2 . . . v k ) and sends data representative of v to the user device via the interface means; o) the verifier device receives data representative of the value z from the user device via the interface means where ##EQU20## and p) the verifier device checks to determine if ##EQU21## wherein ε=2 or ε=3 and a and b are a constant, especially a=b=1.
Claim 25
Dependent Claim
334 words
In a system for access control or identification, a verifier device which verifies the identity of a user device which has been authorized by an authorizing device, the authorizing device having calculated identification data ID unique to the user device, and having provided the user device with encrypted data depending on the identification data ID which are calculated mod n, wherein the verifier device and the user device exchange at least a part of the encrypted data and check the validity of the data exchanged on a mod n basis, wherein n is a product of at least two prime numbers, and wherein the identification data ID are combined with data representative of a public key PK j and data representative of a number c to provide data representative of a combined number G having a d-th root g mod n such that G=g d mod n, and wherein each PK j has ε-roots mod n designated SK j -1 , the verifier device comprising: memory means for storing data representative of the value n; means for calculating; and interface means for exchanging data between the verifier device and the user device; wherein for verifying: m) the verifier device receives data representative of g via the interface means from the user device and, in the calculating means, computes G=g 2 mod n and separates from G the identification data ID and the public key data values PK j ; n) the verifier device receives data representative of a value E=δ.sup.ε mod n from the user device via the interface means, and selects a random binary vector v=(v 1 v 2 . . . v k ) and sends data representative of v to the user device via the interface means; o) the verifier device receives data representative of the value z from the user device via the interface means where ##EQU20## and p) the verifier device checks to determine if ##EQU21## wherein ε=2 or ε=3 and a and b are a constant, especially a=b=1.
Claim 26
Dependent Claim
27 words
Apparatus according to claim 21, wherein the number n is a binary number and the number of bits in n is in the range 450 to 570.
Claim 27
Dependent Claim
31 words
Apparatus according to claim 21, wherein steps n) to o) are repeated t times with different random binary vectors v and/or random numbers δ, t greater than or equal to 1.
Claim 28
Dependent Claim
14 words
Apparatus according to claim 23, wherein t has a value of at least t=4.
Claim 29
Dependent Claim
19 words
Apparatus according to claim 21, wherein steps n) to o) are carried out using binary or trinary logic signals.
Claim 30
Dependent Claim
22 words
The method of claim 1 wherein the user device comprises a smart card and the verifier device comprises a smart card reader.
Claim 31
Dependent Claim
39 words
The user device of claim 16 wherein the user device comprises a smart card, the smart card includes the interface means for coupling the smart card to the verifier device, and the verifier device comprises a smart card reader.
Claim 32
Dependent Claim
41 words
The verifier device of claim 21 wherein the verifier device comprises a smart card reader, the smart card reader includes the interface means for coupling the smart card reader to the user device, and the user device comprises a smart card.
References Cited (Backward Citations)
US4354201A
Cited
WO1980002901A1
Cited
EP0252499A2
Cited
WO1988002899A1
Cited
US4933970A
Cited
EP0325238A2
Cited
WO1989011706A1
Cited
EP0383985A1
Cited
EP0384475A1
Cited
US4995082A
Cited
US4932056A
Cited
EP0389895A1
Cited
US5289542A
Cited
US5204901A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1998-09-18 | 1999-03-20 | 1999-09-19 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2002-09-18 | 2003-03-20 | 2003-09-19 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2006-09-18 | 2007-03-20 | 2007-09-19 | $7700.00 | Window Closed / Lapsed |