Bell Atlantic Network Services, Inc.

Bell Communications Research, Inc.

Ravi Ganesan

Yacov Yacobi

Christopher I Davies

An article of manufacture for improving an RSA cryptosystem, includes computer readable storage medium with computer programming stored thereon. The stored computer programming is configured to be readable from the computer readable storage medium by a computer and thereby cause the computer to operate so as to generate a private exponent key, having an associated modulus N of a predetermined bit length and a bit length of no greater than fifteen percent of the bit length of the associated modulus N but not less than 56 bits, and a corresponding public exponent key, to divide the private exponent key into a first private key portion and a second private key portion, to direct said first private key portion to a first user, and to direct the second private key portion to one or more other users of the RSA system.

Programmed computer for identity verification, forming joint signatures

A programmed computer for forming a pronounceable security password, includes storage medium having a plurality of first and second word segment portions stored thereon. Each second word segment portion is within one or more sets of second word segment portions, each set being associated with one first word segment portion. Each second word segment portion within a particular set is different from others within the set and is combinable with the associated first word segment portion to form a pronounceable word segment. A plurality of transition numbers each associated with one or more of the first word segment portions and corresponding to the number of said second word segment portions within the associate set of second word segment portions are also stored on the storage medium. The computer includes a processor programmed to select a first word segment portion and a second word segment portion from its associated set of second word segment portions. Selection of any one of the first word segment portions and any one of the second word segment portions within the associated set is of substantially equal probability. The processor combines the selected first and second word segment portions to form a first pronounceable word segment and determines if consecutive characters thereof are unacceptable based upon their correspondence to those of the first word segment portions having a transition number less than a threshold. If acceptable a pronounceable security password of eight or more characters is generated so as to include the first pronounceable word segment.

Programmed computer for generating pronounceable security passwords

An article of manufacture for effecting secure communications during a communications session between users in a secured communication cryptosystem in which users are each associated with a public crypto-key and a private crypto-key, includes computer readable storage medium having computer programming stored thereon. The stored computer programming is configured to be readable from the computer readable storage medium by a computer and thereby cause the computer to operate so as to generate a private crypto-key using a private exponent and a modulus N, which is the product of a plurality of numbers within a set of large prime numbers. The generated private crypto-key is divided into a private user key portion having a first bit length and a central authority key portion having a second bit length. The first bit length is smaller than the second bit length, and is no larger than fifteen percent of the bit length of the modulus N but no less than 56 bits. The private user key portion is directed only to a single user of the cryptosystem and the central authority's portion is directed to a central storage device.

Computer system for centralized session key distribution, privacy

A method is provided for securing stored files in a system having a plurality of system users with each system user having an associated asymmetric crypto-key with a public key portion and a corresponding private key portion. Each public key portion is accessible to the plurality of system users. Each private key portion has a first private key portion known only to the associated user and a corresponding second private key portion known only to a security server. Data to be stored is identified. A symmetric crypto-key is encrypted with only the second private key portion of a first user crypto-key to form an encrypted key message, thereby restricting access to the symmetric crypto-key to only the first user. The symmetric crypto-key is obtained by the first user by applying the first private key portion of the first user crypto-key to decrypt the encrypted key message. The first user encrypts the data with the symmetric crypto-key to form an encrypted file, and stores the encrypted file and the encrypted key message.

Securing E-mail communications and encrypted file storage using yaksha

A programmed computer secures communications between users of a crypto-system in which each user has an associated asymmetric crypto-key with a public key portion accessible to all system users and a corresponding private key portion having a first private key portion known only to the associated user and a corresponding second private key portion. The computer includes a processor programmed to generate a temporary asymmetric crypto-key having a first temporary key portion and an associated second temporary key portion. The computer then encrypts the second temporary key portion with the first private key portion of a first user crypto-key associated with a first user to form a first encrypted message. The processor directs the issuance of the first encrypted message to a second user having access to the second private key portion of the first user crypto-key. The processor next applies the public key portion of the first user crypto-key to decrypt a second encrypted message generated by the second user, which includes the first encrypted message encrypted with the second private key portion of the first user crypto-key, to thereby authenticate the second user to the first user. The computer also includes a storage medium for storing the first temporary key portion, and the public key portion of the first user crypto-key.

Computer system for securing communications using split private key

A pronounceable security password is generated using a plurality of first word segment portions and second word segment portions, each of which has at least one character. A transition number, for each of the plurality of first word segment portions is identified, preferably using a Markov model. Each transition number corresponds to the number of different second word segment portions which can be combined with the first word segment portion to form a pronounceable word segment, such a word syllable. A first word segment portion is randomly selected. The selection of any one of the plurality of first word segment portions is of substantially equal probability. A second word segment portion, to which the transition number associated with the selected first word segment portion corresponds, is then randomly selected. The selection of any one of the corresponding second word segment portions is likewise of substantially equal probability. The selected first and second word segment portions are combined to form at least a part of the pronounceable security password.

Method and system for generating pronounceable security passwords

A method for improving an RSA cryptosystem by generating a user private exponent key, having an associated modulus N, and a user public exponent key for each user of the system. Each user's public exponent key is provided to all users of the system. Each user's private exponent key is divided into a two user key portions. A first user key portion is maintained exclusively by the user for whom the associated private exponent key was generated. A second user key portion is entrusted to one or more other users of the RSA system. The bit length of the first user key portion is no greater than fifteen percent of the bit length of the associated modulus N but not less than 56 bits. The two portions of the private exponent key may be used by two users to exchange two numbers, the product of which is used as a session key to secure communications between the two users. The portions of the private exponent key may also be used by different users to verify the identity of each to the other. Additionally, the portions of the private exponent key can be used to form joint signatures on documents.

System and method for identity verification, forming joint signatures

A encryption method and system using split key public encryption. A first and second user private encryption key and a corresponding first and second user public encryption key are generated. The first and second user private encryption keys are divided into a first and second private user key portion and a corresponding first and second central authority key portion. The first and second private user key portions are respectively disclosed to the first and second users. The central authority key portions and the user public encryption keys are maintained by a central authority (CA). The first user request a communications session with the second user through the CA. After receiving the request, the CA encrypts a session encryption key with (i) the central authority key portion and user public encryption key associated with a first user to form a first encrypted session key and (ii) the central authority key portion and user public encryption key associated with the second user to form a second encrypted session key. The first encrypted session key is provided to the first user and the second encrypted session key is provided to the second user. The first user applies the first user's private user key portion to decrypt the first encrypted session key and the second user applies the second user's private user key portion to decrypt the second encrypted session key. The first user and the second user apply the decrypted common session key to encrypt and decrypt messages exchanged during a communications session. The method and system also provide for authorized wiretapping, video and data distribution and private enhanced messaging (PEM).

System and method for centralized session key distribution, privacy

In a system, such as a system utilizing a Kerberos protocol, system users each have an associated asymmetric crypto-key. The security of communications over the system is enhanced by a first user generating a temporary asymmetric crypto-key having a first temporary key portion and an associated second temporary key portion. The second temporary key portion is encrypted by the first user with the first private key portion of the first user crypto-key to form a first encrypted message. Another user, preferably an authentication server, applies the second private key portion and the public key portion of the first user crypto-key to the first encrypted message to decrypt the second temporary key portion and thereby authenticate the first user to the security server. The authentication server then encrypts the first encrypted message with the second private key portion of the first user crypto-key to form a second encrypted message. The first user next applies the public key portion of the first user crypto-key to decrypt the second encrypted message and obtain the second temporary key portion, thereby authenticating the security server to the first user.

Yaksha, an improved system and method for securing communications using

An improved method for password validation comprising the steps of identifying bad passwords having one or more characters; computing a frequency of occurrence of bad password characters; computing a probability of occurrence T of the bad password characters within the bad passwords based upon the computed frequency of occurrence; identifying a proposed password having one or more characters; and comparing the proposed password characters with the probability of occurrence T of the bad password characters. The method further comprises the steps of establishing a validation threshold and validating the proposed password based upon the correspondence between (i) a value, BAp, reflecting the relationship between the probability of occurrence T of bad password characters within bad passwords and the proposed password characters and (ii) an established validation threshold. A Markov model is use to compute the probability of occurrence. The present invention also includes an improved password validation system.

Growing community of inventors

Arlington, VA, United States of America

Ravi Ganesan