Granted Patent B2

US 8,756,706 · App. 12/902,638 · Granted Jun 17, 2014

Abstract

Claims (53)

1. A method of securing user credentials in a remote repository by a communication device, the method comprising:

generating, from a password, using an elliptic curve cryptography scheme, a first private key and a first public key pair;

generating a second private key and a second public key pair;

generating a storage key from the second private key and the first public key;

encrypting a set of credentials using the storage key;

creating an encrypted credential signature from the encrypted set of credentials and the first private key; and

sending the encrypted set of credentials, the encrypted credential signature, and the second public key to the remote repository,

wherein the set of credentials include one or both of a user identification (user ID) or a credential password.

2. The method of claim 1 wherein generating the second private key and the second public key pair utilizes the elliptic curve cryptography scheme.

3. The method of claim 1 wherein generating the storage key from the second private key and the first public key utilizes an elliptic curve Diffie-Hellman scheme.

4. The method of claim 1 wherein creating an encrypted credential signature from the encrypted set of credentials and the first private key utilizes an elliptic curve digital signature algorithm.

5. The method of claim 1 wherein the first private key and first public key pair are a static key pair, and the second private key and second public key pair are an ephemeral key pair.

6. A communication device for securing user credentials in a remote repository, the communication device comprising:

a processor;

memory; and

an encryption module which, when executed by the processor, configures the processor to

generate, from a password, using an elliptic curve cryptography scheme, a first private key and a first public key pair;

generate a second private key and a second public key pair;

generate a storage key from the second private key and the first public key;

encrypt a set of credentials using the storage key;

create an encrypted credential signature from the encrypted set of credentials and the first private key; and

send the encrypted set of credentials, the encrypted credential signature, and the second public key to the remote repository,

wherein the set of credentials include one or both of a user identification (user ID) or a credential password.

7. A communication device for accessing secured user credentials in a remote repository, the communication device comprising:

a processor;

memory; and

a remote credential management module which, when executed by the processor, configures the processor to

receive an encrypted set of credentials, an encrypted credential signature, and a second public key from the remote repository,

wherein the set of credentials include one or both of a user identification (user ID) or a credential password;

generate a first private key from a password using an elliptic curve cryptography scheme;

verify the encrypted credential signature from the encrypted set of credentials and the first private key;

generate a storage key from the first private key and the second public key;

decrypt the encrypted set of credentials using the storage key; and

populate the device with the unencrypted set of credentials.

8. The communication device of claim 6 wherein generating the second private key and the second public key pair utilizes the elliptic curve cryptography scheme.

9. The communication device of claim 6 wherein generating the storage key from the second private key and the first public key utilizes an elliptic curve Diffie-Hellman scheme.

10. The communication device of claim 6 wherein creating an encrypted credential signature from the encrypted set of credentials and the first private key utilizes an elliptic curve digital signature algorithm.

11. The communication device of claim 6 wherein the first private key and first public key pair are a static key pair, and the second private key and second public key pair are an ephemeral key pair.

12. The communication device of claim 7 wherein generating the second private key and the second public key pair utilizes the elliptic curve cryptography scheme.

13. The communication device of claim 7 wherein generating the storage key from the second private key and the first public key utilizes an elliptic curve Diffie-Hellman scheme.

14. The communication device of claim 7 wherein creating an encrypted credential signature from the encrypted set of credentials and the first private key utilizes an elliptic curve digital signature algorithm.

15. The communication device of claim 7 wherein the first private key and first public key pair are a static key pair, and the second private key and second public key pair are an ephemeral key pair.

16. A server for securing user credentials in a remote repository, the server comprising:

a processor;

memory; and

an encryption module which, when executed by the processor, configures the processor to

generate, from a password, using an elliptic curve cryptography scheme, a first private key and a first public key pair;

generate a second private key and a second public key pair;

generate a storage key from the second private key and the first public key;

encrypt a set of credentials using the storage key;

create an encrypted credential signature from the encrypted set of credentials and the first private key; and

send the encrypted set of credentials, the encrypted credential signature, and the second public key to the remote repository,

wherein the set of credentials include one or both of a user identification (user ID) or a credential password.

Assignments (11)