Data processing system for providing authorization keys
A computer-implemented method for providing authorization keys, where the method includes receiving a further asymmetrical, cryptographic key pair, where the further asymmetrical key pair is part of a key pair sequence, where the further asymmetrical key pair includes a further first and a further second authorization key; retrieving a ciphertext, where the ciphertext is associated with the key pair which immediately precedes the further key pair in the sequence of key pairs, where the ciphertext includes the initial first key encrypted with the second authorization key of the key pair which immediately precedes the further key pair in the sequence of key pairs; decrypting the initial first authorization key using the first authorization key of the key pair which immediately precedes the further key pair in the sequence of key pairs; generating a further ciphertext through encryption of the decrypted initial first authorization key using the second authorization key of the further key pair; and saving the further ciphertext.
1. A method, comprising the following steps:
receiving an encrypted data object, which is a data object at a computer that has been encrypted using an initial public authorization key of an initial asymmetrical cryptographic key pair that includes an initial private authorization key,
accessing a further private authorization key, which together with a further public authorization key forms a further asymmetrical cryptographic key pair,
retrieving a ciphertext, which comprises the initial private authorization key encrypted with the further public authorization key such that the ciphertext is assigned to the further asymmetrical cryptographic key pair,
decrypting the encrypted initial private authorization key with the further private authorization key,
decrypting the encrypted data object by means of the decrypted initial first private authorization key, and
checking a signature of the encrypted data object, comprising the following steps:
reading a signature of the encrypted data object, and
verifying the signature of the encrypted data object, wherein the verification is effected with the further public authorization key.
2. The method of claim 1 , further comprising carrying out instructions on the computer for the step of receiving a key pair identifier assigned to the further asymmetrical cryptographic key pair, wherein the ciphertext is retrieved on the basis of the key pair identifier.
3. The method of claim 1 , wherein the ciphertext is retrieved from a database.
4. The method of claim 1 , wherein the further asymmetrical key pair is stored together with the ciphertext on a portable data carrier.
5. The method of claim 1 , wherein:
the data object is a symmetrical data object key, such that the step of receiving an encrypted data object includes receiving the symmetrical data object key, which has been encrypted with the initial public authorization key,
the method further comprises:
receiving a further encrypted data object, which is a further data object that has been encrypted by the symmetrical data object key,
performing the step of decrypting the encrypted initial private authorization key with the further private authorization key,
decrypting the encrypted symmetrical data object key with the decrypted initial private authorization key, and
decrypting the encrypted further data object using the decrypted symmetrical data object key.
6. The method of claim 1 , wherein accessing the further private authorization key comprises the following steps:
receiving a user identification and a user identifier assigned to the user identification,
retrieving a random value assigned to the user identification from a database,
calculating the further private authorization key, wherein the random value and the user identifier are included in the calculation.
7. The method of claim 6 , wherein the calculation of the further private authorization key is effected using a function g that is applied to the user identifier, wherein the function g is preferably a one-way function, such as e.g. a cryptographic hash function.
8. The method of claim 6 , wherein the user identifier is received as a function value of a function g that was applied to the user identifier, wherein the function g is preferably a one-way function, such as e.g. a cryptographic hash function.
9. The method of claim 6 , wherein the further private authorization key is calculated by applying a function f to the random value and g (user identifier).
10. The method of claim 6 , wherein the function f is a one-way function, e.g. a cryptographic hash function.
11. The method of claim 6 , wherein the signature check furthermore comprises the step of calculating the further public authorization key from the further private authorization key by means of an asymmetrical cryptographic key generating method, wherein the further private and the further public authorization keys form the further asymmetrical cryptographic key pair.
12. The method of claim 6 , wherein the random value is retrieved from the database via a secure communication link.
13. The method of claim 6 , wherein the random value is stored in encrypted fashion in the database.
14. A non-transitory, computer-readable recording medium containing a computer program comprising executable program instructions for carrying out a method, comprising the following steps:
receiving an encrypted data object, which is a data object that has been encrypted using an initial public authorization key of an initial asymmetrical cryptographic key pair, which includes an initial private authorization key,
accessing a further private authorization key, which together with a further public authorization key forms a further asymmetrical cryptographic key pair,
retrieving a ciphertext, which comprises the initial private authorization key encrypted with the further public authorization key such that the ciphertext is assigned to the further asymmetrical cryptographic key pair,
decrypting the encrypted initial private authorization key with the first further private authorization key,
decrypting the encrypted data object by means of the decrypted initial private authorization key, and
checking a signature of the encrypted data object, comprising the following steps:
reading a signature of the encrypted data object, and
verifying the signature of the encrypted data object, wherein the verification is effected with the further public authorization key.
15. The non-transitory, computer-readable recording medium of claim 14 , wherein the method further comprises receiving a key pair identifier assigned to the further asymmetrical cryptographic key pair, wherein the ciphertext is retrieved on the basis of the key pair identifier.
16. The non-transitory, computer-readable recording medium of claim 14 , wherein the ciphertext is retrieved from a database.
17. The non-transitory, computer-readable recording medium of claim 14 , wherein the further asymmetrical key pair is stored together with the ciphertext on a portable data carrier.
18. The non-transitory, computer-readable recording medium of claim 14 , wherein:
the data object is a symmetrical data object key, such that the step of receiving an encrypted data object includes receiving the symmetrical data object key, which has been encrypted with the initial public authorization key,
the method further comprises:
receiving a further encrypted data object, which is a further data object that has been encrypted by the symmetrical data object key,
performing the step of decrypting the encrypted initial private authorization key with the further private authorization key,
decrypting the encrypted symmetrical data object key with the decrypted initial private authorization key, and
decrypting the encrypted further data object using the decrypted symmetrical data object key.
19. The non-transitory, computer-readable recording medium of claim 14 , wherein accessing the further private authorization key comprises the following steps:
receiving a user identification and a user identifier assigned to the user identification,
retrieving a random value assigned to the user identification from a database,
calculating the further private authorization key, wherein the random value and the user identifier are included in the calculation.
20. The non-transitory, computer-readable recording medium of claim 19 , wherein the calculation of the further private authorization key is effected using a function g that is applied to the user identifier, wherein the function g is preferably a one-way function, such as e.g. a cryptographic hash function.
21. The non-transitory, computer-readable recording medium of claim 19 , wherein the user identifier is received as a function value of a function g that was applied to the user identifier, wherein the function g is preferably a one-way function, such as e.g. a cryptographic hash function.
22. The non-transitory, computer-readable recording medium of claim 19 , wherein the further private authorization key is calculated by applying a function f to the random value and g (user identifier).
23. The non-transitory, computer-readable recording medium of claim 19 , wherein the function f is a one-way function, e.g. a cryptographic hash function.
24. The non-transitory, computer-readable recording medium of claim 19 , wherein the signature check furthermore comprises the step of calculating the further public authorization key from the further private authorization key by means of an asymmetrical cryptographic key generating method, wherein the further private and the further public authorization keys form the further asymmetrical cryptographic key pair.
25. The non-transitory, computer-readable recording medium of claim 19 , wherein the random value is retrieved from the database via a secure communication link.
26. The non-transitory, computer-readable recording medium of claim 19 , wherein the random value is stored in encrypted fashion in the database.