Method and apparatus for encrypting data

A method for encrypting data comprising deriving a public key using a first data set that defines an instruction; encrypting a second data set with the public key; providing the encrypted third data set to a recipient; providing the public key to a third party such that on satisfaction of the instruction the third party provides an associated private key to the recipient to allow decryption of the encrypted second data set.

TECHNICAL FIELD

The present invention relates to a method and system for encrypting data.

BACKGROUND

Escrow and PKI encryption are two techniques that have been utilised to allow information to be removed from the control of the information owner while still preventing other parties having access to the information until a predetermined condition has been met.

Two common examples where these techniques have been used are in sealed bids and music distribution. Seal bids require that all bids are submitted by a specified date where the originator of the bid needs to be satisfied that their bid is not disclosed before the specified date. Music distributors may wish to publish their music on a public database, where the music distributors needs to be satisfied that the intended user of the music can not listen to the music until they have paid for the use of the music. However, the setting up and use of escrow and PKI encryption can be complex.

It is desirable to improve this situation.

SUMMARY OF THE INVENTION

In accordance with a first aspect of the present invention there is provided a method for encrypting data comprising deriving a public key using a first data set that defines an instruction and a second data set associated with the third party; encrypting a third data set with the public key; providing the encrypted third data set to a recipient; providing the public key to the third party such that on satisfaction of the instruction the third party provides an associated private key to the recipient to allow decryption of the encrypted third data set.

In accordance with a second aspect of the present invention there is provided a method for encrypting data comprising deriving a public key using a first data set that defines a term of an agreement and a second data set associated with a third party; encrypting a third data set with the public key; providing the encrypted third data set to a recipient; providing the public key to the third party such that on satisfaction of the term of the agreement the third party provides an associated private key to the recipient to allow decryption of the encrypted third data set.

Preferably a term of the agreement that needs to be satisfied is that the private key should not be released to the recipient until a specified date.

Preferably a term of the agreement that needs to be satisfied to allow release of the private key to the recipient is the making of a payment.

Most preferably the encrypted third data set includes a nonce.

In accordance with a third aspect of the present invention there is provided a computer system for encrypting data comprising a first computer entity for deriving a public key using a first data set that defines a term of an agreement and a second data set associated with a third party and encrypting a third data set with the public key; communication means for providing the encrypted data to a second computer entity and the public key to a third computer entity; wherein the third computer entity is arranged, on satisfaction of the term of the agreement, to provide an associated private key to the second computer entity to allow decryption of the encrypted third data set.

In accordance with a forth aspect of the present invention there is provided a computer system for encrypting data comprising a first computer node for deriving a public key using a first data set that defines an instruction and a second data set associated with the third party and encrypting a third data set with the public key; communication means for providing the encrypted data to a second computer node and the public key to a third computer node; wherein the third computer node is arranged, on satisfaction of the instruction to the third party, to provide an associated private key to the second computer node to allow decryption of the encrypted third data set.

In accordance with a fifth aspect of the present invention there is provided a computer apparatus for encrypting data comprising a processor for deriving a public key using a first data set that defines a term of an agreement and encrypting a second data set with the public key.

In accordance with a sixth aspect of the present invention there is provided a computer apparatus for encrypting data comprising a processor for deriving a public key using a first data set that defines an instruction and encrypting a second data set with the public key.

The present invention addresses the issue of controlling access to data, where the owner/originator of the relevant data wishes to place conditions on the access to the data. This is achieved by using a public key to encrypt the data where the public key itself stipulates the conditions under which access should be granted.

FIG. 1illustrates a computer system10according to an embodiment of the present invention. Computer system10includes a first computer entity11, a second computer entity12and a third computer entity13. Typically the three computer entities would be configured on separate computer platforms, however the computer entities11,12,13could be configured on a single computer platform. For the purposes of this embodiment, however, the three computer entities11,12,13are coupled via the internet14.

Associated with the first computer entity11is a user14having data15, for example a document, that they wish to make available, under certain conditions, to a third party. Associated with the second computer entity12is the intended recipient16of the data (i.e. the third party). Associated with the third computer entity13is a trust authority17(i.e. an authority that can be trusted by the user) for determining whether the conditions required for access to the data15and stipulated by the user14have been met. Additionally, the trust authority17makes publicly available the trust authorities public data18, as described below. As would be appreciated by a person skilled in the art the trust authorities public data18can be made available in a variety of ways, for example via a web site.

Having selected the trust authority17as the appropriate trust authority for the intended purpose the user obtains the trust authorities public data18; typically the user will have a selection of trust authorities from which to choose the one most appropriate.

The user14defines the terms and conditions for allowing access to the data. This string (i.e. the public encryption key), or typically a digital representation of this string, is then used to encrypt the user's data15(i.e. the data the user14wishes to control access too), as described below.

The user's terms and conditions can be expressed in any suitable language, for example XML where the following example illustrates the use of XML to encapsulate possible terms and conditions:

The use of ‘dataAfter’ is used to instruct the trust authority not to release the associated private key to the recipient until after the ‘01/01/02’. Additionally, the terms and conditions require that an amount ‘12.52UKP’ be paid by the recipient16before the trust authority releases the associated private key to the recipient16.

The trust authorities public data18includes a hash function # and a value N that is a product of two random prime numbers p and q, where the values of p and q are only known to the trust authority17.

The hash function # has the function of taking a string and returning a value in the range 0 to N−1. Additionally, the hash function # should have the jacobi characteristics: jacobi (#, N)=1. That is to say, where x2≡#mod N the jacobi (#, N)=−1 if x does not exist, and =1 if x does exist.

The values of p and q should ideally be in the range of 2511and 2512and should both satisfy the equation: p,q≡3 mod 4. However, p and q must not have the same value.

To encrypt each bit M of the user's data15the user14generates random numbers t+(where t+is an integer in the range [0, 2N)) until the user14finds a value of t+that satisfies the equation jacobi(t+,N)=M, where M represents the individual binary digits 0, 1 of the user's data15as −1, 1 respectively. The user14then computes the value:
s+=(t++#(publickeystring)/t+)modN.
for each bit M where s+corresponds to the encrypted bit of M.

In case #(publickeystring) is non-square the user14additionally generates additional random numbers t−(integers in the range [0, 2N)) until the user14finds one that satisfies the equation jacobi(t−,N)=m. The user14then computes the value:
s−≡(t−−#(publickeystring)/t−)modN
for each value of bit M.

The encrypted data, together with the identity of the trust authority17and the public key, are made available to intended recipient16by any suitable means, for example via e-mail or by being placed in a electronic public area.

The public key, together with the identity of the intended recipient16, is also made available to the trust authority17by any suitable means. Consequently, the trust authority17is able to determine the terms and conditions that need to be satisfied to allow the trust authority17to issue the intended recipient16with the associated private key.

The trust authority17determines the associated private key B by solving the equation:
B2≡#(publickeystring)modN

If a value of B does not exist, then there is a value of B that is satisfied by the equation:
B2≡−#(publickeystring)modN

As N is a product of two prime numbers p, q it would be extremely difficult for any one to calculate the private key B with only knowledge of the public key string and N. However, as the trust authority17has knowledge of p and q (i.e. two prime numbers) it is relatively straightforward for the trust authority17to calculate B.

Any change to the public key will result in a private key that will not decrypt the document15correctly. Therefore, the intended recipient16cannot alter the public key before being supplied to the trust authority17and therefore cannot alter the relevant terms and conditions that apply to the release of the private key.

On receipt of the public key, the trust authority17checks whether the relevant terms and conditions have been met. When the trust authority17is satisfied that the terms and conditions have been met they supply the recipient16with the private key together with some indication of whether the public key is positive or negative.

If the square root of the encryption key returns a positive value, the users data M can be recovered using:
M=jacobi(s++2B,N).

If the square root of the encryption key returns a negative value, the users data M can be recovered using:
M=jacobi(s−+2B,N).

The recipient16then uses the appropriate equation above, in conjunction with the private key, to decrypt the message.

The recipient16may choose to cache the private key to decrypt the message15at a later date.

To prevent the reuse of the private key a nonce, i.e. a random number, can be incorporated into the terms and conditions. This ensures that the public key is unique thereby ensuring that the corresponding private key will also be unique.

FIG. 2illustrates the use of the present invention for the purposes of a seal bid arrangement, where bidder21provides authorization for the tender manager22to read the contents of the bidders seal bid24after a given data, for example once all bids have been received.

The bidder defines a set of terms and conditions using a suitable language, for example XML. The terms and conditions would include a date after which the bid details could be decrypted. For example:

In order for the tender manager22to obtain the respective private key the tender manager22sends the public key to the appropriate trust authority23. The trust authority23would check that the requester is the named tender manager and that the current date is after 09:00 Nov. 5, 2001. Only when these conditions have been satisfied would the trust authority23release the private key, derived in accordance with the principles describe above. The nonce is included to ensure that the trust manager23will not have seen a public key identical to this in the past—and hence is not able to reuse an existing private key.

This embodiment only refers to a single trust authority, however, each bidder might choose a trust authority of their own choosing. The tender manager would then have to go to the appropriate trust authority to obtain the private key.

The language used to define the terms and conditions would be selected to allow expression of a variety of terms and conditions.

FIG. 3illustrates the use of the present invention for the purposes of enabling electronic distribution of music, where a music provider31provides authorization for a recipient32to listen to the music after a specified payment has been made.

The prospective recipient32would retrieve the encrypted music, together with the public key used to encrypt the music35and the name of the appropriate trust authority33. The encrypted music could be access, for example, via a public electronic database (not shown).

The public key might have the format:

That is to say, the private key should only be release after the recipient32has paid a specified sum of money into a specified bank account34.

In order for the music to be played it must be decrypted, which requires providing the public key to the appropriate trust authority33, who can then determine what conditions have to be satisfied to allow release of the appropriate private key.

Any attempt on the part of the recipient to modify the terms and conditions would result in a public key that does not decrypt the music.