US6886096B2 — Identity-based encryption system

Claim 1

Independent Claim 135 words

A method for using identity-based encryption to support encrypted communications in a system in which users at user equipment communicate over a communications network, wherein the system has a plurality of private key generators each of which generates private keys for a group of associated users, wherein each user's private key may be used by that user to decrypt messages for the user that have been encrypted using the user's identity and public parameters, comprising: using a directory service coupled to the communications network to provide a sender having user equipment coupled to the communications network with an opportunity to determine which public parameters to use to encrypt a message for a receiver at user equipment coupled to the communications network, wherein the sender is associated with a different private key generator than the receiver.

Claim 2

Independent Claim 135 words

A method for using identity-based encryption to support encrypted communications in a system in which users at user equipment communicate over a communications network, wherein the system has a plurality of private key generators each of which generates private keys for a group of associated users, wherein each user's private key may be used by that user to decrypt messages for the user that have been encrypted using the user's identity and public parameters, comprising: using a directory service coupled to the communications network to provide a sender having user equipment coupled to the communications network with an opportunity to determine which public parameters to use to encrypt a message for a receiver at user equipment coupled to the communications network, wherein the sender is associated with a different private key generator than the receiver.

Claim 3

Dependent Claim 45 words

The method defined in claim 1 wherein the directory service is implemented using a directory server and wherein the directory server includes information that maps a group of email addresses to a particular public parameter that is associated with a particular corresponding private key generator.

Claim 4

Dependent Claim 44 words

The method defined in claim 1 wherein the message is an email message, and wherein the method further comprises using the directory service to look up the public parameters of the receiver's organization at the request of the sender based on email address information.

Claim 5

Dependent Claim 53 words

The method defined in claim 1 wherein there are multiple directory services coupled to the communications network, the method further comprising using at least one of the directory services to receive the public parameters of users from a clearinghouse service to which the public parameters of different private key generators have been provided.

Claim 6

Dependent Claim 95 words

The method defined in claim 1 , wherein the system includes a clearinghouse service to which the public parameters of different private key generators have been provided, wherein there are multiple directory services coupled to the communications network each of which includes a directory of multiple entries associating respective groups of users with the public parameters of their associated private key generators, and wherein the clearinghouse prevents at least some duplicate entries, the method further comprising using at least one of the directory services to receive the public parameters of users from the clearinghouse service.

Claim 7

Dependent Claim 48 words

The method defined in claim 1 wherein the system further comprises a certification authority through which at least some of the private key generators provide their associated public parameters, the method further comprising receiving these public parameters from the private key generators through at least the certification authority.

Claim 8

Dependent Claim 45 words

The method defined in claim 1 wherein the directory service is implemented using the computers of the Internet Domain Name System (DNS), the method further comprising using the computers of the Domain Name System to host information mapping particular domain names to particular public parameters.

Claim 9

Independent Claim 134 words

A method for providing a sender with appropriate public parameters to use to send an identity-based encrypted message to a given receiver over a communications network in a system in which there are multiple private key generators each of which has a unique master secret, unique public parameters, and a different group of associated users, wherein the sender has obtained the given receiver's identity to use in encrypting the message, the method comprising: using the receiver's identity that has been obtained by the sender to determine which of the unique public parameters that are associated with the multiple private key generators are appropriate to provide to the sender so that the sender may use identity-based encryption to encrypt the message for the given receiver based on the receiver's identity and the appropriate public parameters.

Claim 10

Independent Claim 134 words

A method for providing a sender with appropriate public parameters to use to send an identity-based encrypted message to a given receiver over a communications network in a system in which there are multiple private key generators each of which has a unique master secret, unique public parameters, and a different group of associated users, wherein the sender has obtained the given receiver's identity to use in encrypting the message, the method comprising: using the receiver's identity that has been obtained by the sender to determine which of the unique public parameters that are associated with the multiple private key generators are appropriate to provide to the sender so that the sender may use identity-based encryption to encrypt the message for the given receiver based on the receiver's identity and the appropriate public parameters.

Claim 11

Dependent Claim 31 words

The method defined in claim 8 further comprising using a directory service to provide the sender with the appropriate public parameters to use to encrypt the message for the given receiver.

Claim 12

Dependent Claim 63 words

The method defined in claim 8 wherein the sender and the given receiver are associated with different identity-based encryption private key generators and wherein the communications network comprises the Internet, the method further comprising: allowing the sender to access a database of information over the Internet, wherein the database includes information associating certain receivers to the public parameters of different private key generators.

Claim 13

Dependent Claim 52 words

The method defined in claim 8 wherein the sender and the given receiver are associated with different identity-based encryption private key generators, the method further comprising: using one of the private key generators to provide the sender with information mapping different groups of users to different respective sets of public parameter information.

Claim 14

Dependent Claim 46 words

The method defined in claim 8 wherein at least some of the private key generators generate time-sensitive private keys for the users, the method further comprising: providing the sender with the appropriate identity-based encryption public parameter information when the sender obtains the sender's current private key.

Claim 15

Dependent Claim 78 words

The method defined in claim 12 wherein the sender's private key generator is implemented on a local area network to which the sender is coupled, the method further comprising: using the sender's private key generator to generate and provide the sender with the sender's current private key over the local area network; and using the same private key generator to provide the sender with the appropriate public parameters to use to encrypt the message for the given receiver.

Claim 16

Dependent Claim 20 words

The method defined in claim 8 further comprising using the encrypted message to provide a symmetric key to the receiver.

Claim 17

Dependent Claim 27 words

The method defined in claim 8 further comprising using a clearinghouse service to process public parameter information provided by the multiple private key generators to avoid duplication.

Claim 18

Dependent Claim 35 words

The method defined in claim 8 further comprising using a certification authority to sign the public parameters of at least some of the private key generators before the public parameters are provided to the sender.

Claim 19

Independent Claim 130 words

A method for using identity-based encryption to support encrypted communications in a system in which users at user equipment communicate over a communications network, wherein the system has a plurality of private key generators each of which generates private keys for a group of associated users, wherein each user's private key may be used by that user to decrypt messages for the user that have been encrypted using the user's identity and public parameters, comprising: sending a peer-to-peer message from a first of the users to a second of the users, wherein the first user is associated with a private key generator with which the second user is not associated, and wherein the message includes the public parameters of the private key generator with which the first user is associated.

Claim 20

Independent Claim 130 words

A method for using identity-based encryption to support encrypted communications in a system in which users at user equipment communicate over a communications network, wherein the system has a plurality of private key generators each of which generates private keys for a group of associated users, wherein each user's private key may be used by that user to decrypt messages for the user that have been encrypted using the user's identity and public parameters, comprising: sending a peer-to-peer message from a first of the users to a second of the users, wherein the first user is associated with a private key generator with which the second user is not associated, and wherein the message includes the public parameters of the private key generator with which the first user is associated.

Claim 21

Independent Claim 135 words

A method for using identity-based encryption to support encrypted communications in a system in which users at user equipment communicate over a communications network, wherein the system has a plurality of private key generators each of which generates private keys for a group of associated users, wherein each user's private key may be used by that user to decrypt messages for the user that have been encrypted using the user's identity and public parameters, and wherein the system includes a global private key generator having associated global public parameters, comprising: allowing a sender associated with at least one of the private key generators to use user equipment to encrypt a message for a receiver associated with at least one different one of the private key generators using the global public parameters and the receiver's identity.

Claim 22

Independent Claim 135 words

A method for using identity-based encryption to support encrypted communications in a system in which users at user equipment communicate over a communications network, wherein the system has a plurality of private key generators each of which generates private keys for a group of associated users, wherein each user's private key may be used by that user to decrypt messages for the user that have been encrypted using the user's identity and public parameters, and wherein the system includes a global private key generator having associated global public parameters, comprising: allowing a sender associated with at least one of the private key generators to use user equipment to encrypt a message for a receiver associated with at least one different one of the private key generators using the global public parameters and the receiver's identity.

Claim 23

Dependent Claim 34 words

The method defined in claim 18 further comprising allowing the sender to use the user equipment to encrypt the message for the receiver when the user equipment is not connected to the communications network.

Claim 24

Dependent Claim 35 words

The method defined in claim 18 further comprising allowing the sender to send the encrypted message to the receiver, wherein the message includes the public parameters of the private key generator associated with the sender.

Claim 25

Dependent Claim 82 words

The method defined in claim 18 further comprising: allowing the sender to send the encrypted message to the receiver, wherein the encrypted message includes a request for the public parameters of the different one of the private key generators that is associated with the receiver; and using user equipment of the receiver to automatically respond to the encrypted message by providing the public parameters of the different one of the private key generators that is associated with the receiver for the sender.

Annuity Stage	Window Opens	Payment Deadline	Surcharge Period Until	Estimated Fee	Status
3.5 Years (Year 4)	2008-04-25	2008-10-25	2009-04-26	$2000.00	Window Closed / Lapsed
7.5 Years (Year 8)	2012-04-25	2012-10-25	2013-04-26	$3760.00	Window Closed / Lapsed
11.5 Years (Year 12)	2016-04-25	2016-10-25	2017-04-26	$7700.00	Window Closed / Lapsed

Identity-based encryption system

Abstract

Inventors

Bibliographic Details

Claims Analysis

References Cited (Backward Citations)

USPTO Annuity & Maintenance Windows

Assigned Categories & Tags

Assign Category Tag