Patent ID: 6606387
Filing Date: 2003-08-12
Classification: G06Q,G07F

Abstract:
A system for securely establishing a shared cryptographic key between a first cryptographic device and a second cryptographic device, said system comprising:a plurality of randomly-generated key components, each of said plurality of key components having a corresponding unique component identifier that is used as an index to store an encrypted version of the key component in an electronic database accessible to a first cryptographic device; means for separately entering into a second cryptographic device, by each of a plurality of key custodians, a different one of said plurality of key components, said second cryptographic device being assigned a unique device identifier; means for combining, at the second cryptographic device, the plurality of entered key components to create a new shared cryptographic key to be shared between the second cryptographic device and the first cryptographic device; means for communicating, to the fist cryptographic device, the unique component identifier corresponding to each one of the entered key components and said unique device identifier assigned to said second cryptographic device; and means for determining, by the first cryptographic device, the shared cryptographic key, further comprising: means for receiving each of the communicated unique component identifiers and the communicated unique device identifier; means for using each of the received unique component identifiers as the index into the electronic database, to retrieve the stored encrypted version of each of the key components to which the received unique component identifiers correspond; means for decrypting each of said retrieved encrypted versions of the key components, thereby creating decrypted key components; means for combining said decrypted key components to create the first cryptographic device's copy of said shared cryptographic key created in said second cryptographic device; and means for determining that the copy is the shared cryptographic key to be shared between the first cryptographic device and the second cryptographic device, because the unique device identifier received with the unique component identifiers is assigned to the second cryptographic device.