Abstract: A computer program product, for producing a cryptographic key label for use in exchanging information between first and second organizations of members, resides on a computer-readable medium includes computer-readable instructions configured to cause a computer to: produce a read-write cryptographic key using at least one base value; produce a write-only cryptographic key using the read-write cryptographic key; combine a first identifier, uniquely associated with the first organization, and a second identifier, uniquely associated with the key label to be produced, using a one-way function to produce a pedigree; and associate the pedigree with the read-write key and the write-only key to form the cryptographic key label.

Abstract: A system for encrypting a data encryption key includes a key encryption key generator configured to receive a public portion of a label, the label including an asymmetric key pair of the public portion and a private portion, the key encryption key generator being further configured to process the public portion of the label to obtain a key encryption key, and a data encryption key encoder configured to receive the key encryption key from the key encryption key generator and to receive a data encryption key from a random number generator, the encoder being further configured to encrypt the data encryption key using the key encryption key to produce an encrypted data encryption key and to provide the encrypted data encryption key to an encryption device.

Abstract: A cryptographic coalition administrator for managing information access across multiple organizations includes a communications interface configured to communicate electronically transmit and receive information, a memory configured to store pairs of public and private cryptographic keys associated with different levels of access, and a key manager configured and connected to communicate with the interface and the memory and configured to: distribute cryptographic key sets, of public cryptographic keys and private cryptographic keys, to first and second organizations of members; determine a first group of members in the first organization to have authorization to exchange information with a second group of members in the second organization, the first and second groups sharing cryptographic parameters, and public and private cryptographic keys; and distribute a first cryptographic key set, from the cryptographic key sets, to the first group, the first group having a first sensitivity level at least as high as

Abstract: A method of electronically signing a document includes initializing a user, including generating an asymmetric key pair including a private signing key and a public signing key, and storing the private signing key and the public signing key; and providing an electronic signature, including receiving document data corresponding to at least one selected portion of the document, binding the stored private signing key and the document data to create an electronic signature, and providing the electronic signature for a recipient.

Abstract: A method of electronically signing a document includes initializing a user, including generating an asymmetric key pair including a private signing key and a public signing key, and storing the private signing key and the public signing key; and providing an electronic signature, including receiving document data corresponding to at least one selected portion of the document, binding the stored private signing key and the document data to create an electronic signature, and providing the electronic signature for a recipient.

Abstract: A cryptographic coalition administrator for managing information access across multiple organizations includes a communications interface configured to communicate electronically transmit and receive information, a memory configured to store pairs of public and private cryptographic keys associated with different levels of access, and a key manager configured and connected to communicate with the interface and the memory and configured to: distribute cryptographic key sets, of public cryptographic keys and private cryptographic keys, to first and second organizations of members; determine a first group of members in the first organization to have authorization to exchange information with a second group of members in the second organization, the first and second groups sharing cryptographic parameters, and public and private cryptographic keys; and distribute a first cryptographic key set, from the cryptographic key sets, to the first group, the first group having a first sensitivity level at least as high as

Abstract: The invention uses symmetric key cryptography for secrecy. Role-based access controls are implemented with the use of labeled splits that are combined to generate the keys used in symmetric key cryptographic algorithms. Strong user authentication is realized with CKM technology in the form of user passwords, biometric data, and tokens, such as a supercard. Data separation, with labeling and algorithm selection, provides functionality comparable to physical separation. CKM technology lends itself to data-at-rest that may be defined as objects that exist for some time, such as computer files, databases, e-mail messages, etc. However, CKM is also suited for channel or pipeline transmitted data. CKM technology can be extended beyond applications into lower levels of a network protocol, e.g., in IEEE 802 protocols or at level 2 in the OSI model of networking. The CKM encryption protocol to establish the session key for the channel can be adapted to the parameters of the communications environment.

Abstract: A process of encrypting an object includes applying a hash algorithm to the object, generating a random number, combining a first plurality of splits including the random number to form a working split, encrypting the object using the working split, combining a second plurality of splits not including the random number to form a value, encrypting the random number using the value, encrypting the hashed object according to a signature algorithm using a user private key, encrypting the hashed object according to a selected algorithm using the working split as a key, forming a header including information that can be used to decrypt the object, encrypting the header, and adding the encrypted header to the encrypted object. The pluralities of splits include a fixed split, a variable split, and a label split corresponding to a selected label. The header includes the encrypted random number, a label, and a digital signature.

Abstract: A method of electronically signing a document includes initializing a user, including generating an asymmetric key pair including a private signing key and a public signing key, and storing the private signing key and the public signing key; and providing an electronic signature, including receiving document data corresponding to at least one selected portion of the document, binding the stored private signing key and the document data to create an electronic signature, and providing the electronic signature for a recipient.