Generating and processing an authentication certificate

Patent metadata

Field	Value
Publication number	US-9686082-B2
Application number	US-201615047865-A
Country	US
Kind code	B2
Filing date	Feb 19, 2016
Priority date	Mar 31, 2006
Publication date	Jun 20, 2017
Grant date	Jun 20, 2017

Abstract

A method and system for generating and processing an authenticity certificate. A request for a step certificate is received from a requester entity. The step certificate authenticates an involvement of the requester entity about an object. The request includes an object identifier, a requester entity type of the requester entity, and a requester identity certificate of the requester entity. The object identifier is hashed. A signature is created and includes the hashed object identifier, the requester entity type, a certifier identity certificate, and the requester identity certificate. A hashing result is generated by hashing a concatenation of the object identifier, the requester entity type, the certifier entity certificate, the requester identity certificate, and the signature. The step certificate is generated and includes the hashing result. The step certificate is encrypted. The encrypted step certificate is sent to the requester entity for subsequently storing the step certificate on a media.

First claim

What is claimed is:

1. A method, said method comprising:
receiving, by a processor of a computer system from a requester entity, a request for a step certificate, said step certificate authenticating an involvement of the requester entity about an object, said request comprising, an object identifier, a requester entity type of the requester entity, and a requester identity certificate of the requester entity, wherein the object identifier identifies the object;
after said receiving the request, said processor hashing the object identifier;
after said hashing the object identifier, said processor creating a signature comprising the hashed object identifier, the requester entity type, a certifier identity certificate of a certifier entity that has certified the authenticity of the object, and the requester identity certificate;
said processor generating a hashing result by hashing a concatenation of the object identifier, the requester entity type, the certifier entity certificate, the requester identity certificate, and the signature; and
said processor generating the step certificate comprising the hashing result.

2. The method of claim 1 , said method further comprising:
said processor encrypting the step certificate using a random key; and
said processor sending the encrypted step certificate to the requester entity for subsequently storing the step certificate on a media.

3. The method of claim 2 , wherein the request further comprising a media identifier and a media key block, wherein the media identifier identifies the media and is unique to the media, wherein the media key block is a data block of the media providing access to a media key used to unlock a title key stored on the media, and wherein the title key is configured to encrypt data stored on the media, and wherein the method further comprises:
said processor receiving the random key encrypted, wherein the encrypted random key is based on the random key, the media identifier, and the media key block; and
said processor sending the encrypted random key to the requester entity.

4. The method of claim 3 , wherein the data block of the media provides access to a media key used to unlock a title key stored on the media, and wherein the title key is configured to encrypt data stored on the media.

5. The method of claim 3 , wherein the method further comprises:
after said encrypting the step certificate, said processor transmitting the random key, the media identifier, and the media key block to a clearing house, wherein said receiving the random key encrypted comprises receiving the encrypted random key from the clearing house.

6. The method of claim 3 , said method further comprising: after said receiving the request, said processor verifying the signature, said verifying the signature comprising:
generating a first hash result (H 1 ) by applying a hash function to an input message comprising the media identifier, the media key block , the object identifier, and the requester identity certificate;
extracting a public key from the requestor identity certificate, said requestor identity certificate having been encrypted by a private key of the requester entity, said public key and said private key being a public/private key pair;
decrypting a signature of the input message through use of the public key;
generating a second hash result (H 2 ) by applying the hash function to the decrypted signature of the input message; and
determining that H 1 and H 2 are identical.

7. The method of claim 1 , said method further comprising:
said processor verifying a validity of the object identifier, wherein said verifying the validity of the object identifier comprises scanning an object table, wherein said scanning comprises determining that the object identifier exist as an entry in an objectID column of the object table, and wherein the objectID column comprises an object identifier of a different object for each different row of a plurality of rows of the table.

8. The method of claim 1 , said method further comprising:
said processor determining that a manufacturer has manufactured the object, and wherein the requester entity is the manufacturer.

9. A computer readable hardware storage device comprising instructions that when executed on a processor of a computer system performs a method, said method comprising:
said processor receiving, from a requester entity, a request for a step certificate, said step certificate authenticating an involvement of the requester entity about an object, said request comprising, an object identifier, a requester entity type of the requester entity, and a requester identity certificate of the requester entity, wherein the object identifier identifies the object;
after said receiving the request, said processor hashing the object identifier;
after said hashing the object identifier, said processor creating a signature comprising the hashed object identifier, the requester entity type, a certifier identity certificate of a certifier entity that has certified the authenticity of the object, and the requester identity certificate;
said processor generating a hashing result by hashing a concatenation of the object identifier, the requester entity type, the certifier entity certificate, the requester identity certificate, and the signature; and
said processor generating the step certificate comprising the hashing result.

10. The computer readable hardware storage device of claim 9 , said method further comprising:
said processor encrypting the step certificate using a random key; and
said processor sending the encrypted step certificate to the requester entity for subsequently storing the step certificate on a media.

11. The computer readable hardware storage device of claim 10 , wherein the request further comprising a media identifier and a media key block, wherein the media identifier identifies the media and is unique to the media, wherein the media key block is a data block of the media providing access to a media key used to unlock a title key stored on the media, and wherein the title key is configured to encrypt data stored on the media, and wherein the method further comprises:
said processor receiving the random key encrypted, wherein the encrypted random key is based on the random key, the media identifier, and the media key block; and
said processor sending the encrypted random key to the requester entity.

12. The computer readable hardware storage device of claim 11 , wherein the data block of the media provides access to a media key used to unlock a title key stored on the media, and wherein the title key is configured to encrypt data stored on the media.

13. The computer readable hardware storage device of claim 11 , wherein the method further comprises:
after said encrypting the step certificate, said processor transmitting the random key, the media identifier, and the media key block to a clearing house, wherein said receiving the random key encrypted comprises receiving the encrypted random key from the clearing house.

14. The computer readable hardware storage device of claim 11 , said method further comprising: after said receiving the request, said processor verifying the signature, said verifying the signature comprising:
generating a first hash result (H 1 ) by applying a hash function to an input message comprising the media identifier, the media key block , the object identifier, and the requester identity certificate;
extracting a public key from the requestor identity certificate, said requestor identity certificate having been encrypted by a private key of the requester entity, said public key and

Assignees

• IBM

Inventors

• Bauchot Frederic
• Marmigere Gerard
• Mialon Christophe
• Secondo Pierre

Classifications

• H04L9/3263 Primary

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L9/3236

  using cryptographic hash functions · CPC title

• H04L9/0866

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title

• H04L9/3247

  involving digital signatures · CPC title