Security via hardware 536

misc. references

the issue isn't worrying about the certification of who is using an authentication hardware token .... since there are huge number of existing business processes that are related to registering authentication information about parties in established relationships .... but this is worrying about the certification of the hardware token that is actually used to generate the digital signature.

rather than replacing large number of existing business processes related to establishment of relationships between enbreasties (employer-employee, financial insbreastution-customer, etc) ... this looks at the integrity certification of hardware token used in such authentication processes.

the nominal authentication process for digital signatures is straight-foward, "something you have" authentication ... from three factor authentication paradigm

* something you have * something you know * something you are

where the validation of a digital signature with a public key implies that the subject enbreasty has access to and use of the corresponding private key. however, public key authentication registration frequently overlooks fundamental integrity issues regarding the access and use of such private keys .... are they purely software; are they contained in hardware token; were they generated inside the hardware token and have never existed outside the confines of a hardware tokem; if a hardware token is involved, what is the integrity of the hardware token.

There are several fundamental technical and business process integrity issues involved in the production, management, and use of private keys which can significantly affect the overall integrity of any operational infrastructure. This fundamental infrastructure integrity dependencies have been frequently overlooked when trying to convince infrastructures to eliminate there existing business relationship and registration processes (frequently involving paradigms that have evolved over hundreds of years) and instead subsbreastute questionable certification authorities as the mechanism that establishes business relationships.

To some extent, the AADS model freed us up from trying to replace deeply ingrained business process relationship management (with certification authorities), allowing us to concentrate on other signficant infrastructure integrity issues. One such example is the business process knowledge about hardware token integrity characteristics used in authentication operations.

"Colorado Inventors Develop Method of Incorporating Security Certificate"

US Fed News (05-13-05)

Anne M. Wheeler and Lynn Henry Wheeler have developed a method of providing for reliably identifying a Security Profile of a device that generates digital signatures. According to the U.S. Patent & Trademark Office: "A method of providing for reliably identifying a Security Profile of a device that generates digital signatures includes for each of a plurality of devices manufactured in a secure environment, recording together the public key with a Security Profile of the manufactured device and generating a digital signature therefor to collectively define a Security Certificate, the public key and Security Profile thereby being securely linked together, (b) before each manufactured device is released from the secure environment, incorporating its respective Security Certificate into the manufactured device such that the Security Certificate is sent with a digital signature that is generated by the manufactured device using the private key." The patent has been buttigned to First Data Corp., Greenwood Village.

misc. related patent activity:

--