-
公开(公告)号：CA1124810A
公开(公告)日：1982-06-01
申请号：CA316966
申请日：1978-11-28
Applicant: IBM
Inventor： EHRSAM WILLIAM F , ELANDER ROBERT C , MATYAS STEPHEN M , MEYER CARL H W , POWERS ROBERT L , PRENTICE PAUL N , SMITH JOHN L , TUCHMAN WALTER L
Abstract: CRYPTOGRAPHIC COMMUNICATION SECURITY FOR SINGLE DOMAIN NETWORKS A communication security system for data transmissions between remote terminals and a host system. The remote terminals and the host system include data security devices capable of performing a variety of cryptographic operations. At initialization time, a host-master key is written into the host data security device and the host system generates a series of terminal master keys for the remote terminals. Protection is provided for the terminal master keys by enciphering them under a variant of the host master key. The terminal master keys are then written into the data security devices of the respective remote terminals to permit cryptographic operations to be performed. When a communication session is to be established between a designated remote terminal and the host system, a random number is generated and defined as an operational key enciphered under the host master key which permits the operational key to be used at the host system for enciphering or deciphering data operations. The host data security device, using the enciphered master key of the designated remote terminal, transforms the enciphered operational key under control of the host master key into a form in which the operational key is enciphered under the terminal master key of the designated remote terminal. The operational key enciphered under the terminal master key of the designated remote terminal is transmitted to the remote terminal to permit the enciphered operational key to be used at the remote terminal for enciphering or deciphering data operations. KI977007 -1-
-
公开(公告)号：CA1119268A
公开(公告)日：1982-03-02
申请号：CA317159
申请日：1978-11-30
Applicant: IBM
Inventor： LENNON RICHARD E , MATYAS STEPHEN M , MEYER CARL H W , OSEAS JONATHAN , PRENTICE PAUL N , TUCHMAN WALTER L
Abstract: CRYPTOGRAPHIC VERIFICATION OF OPERATIONAL KEYS USED IN COMMUNICATION NETWORKS In a data communication network providing communication security for communication session between a first station and a second station where each station has cryptographic apparatus provided with an operational key which should be common to both stations for cryptographic operation, an operational key verification arrangement is provided in which a first number provided at the first station is operated upon in accordance with the first station operational key to obtain cryptographic data for transmission to the second station, requiring the second station to perform an operation on the first station cryptographic data in accordance with the second station operational key to obtain cryptographic data for transmission back to the first station and performing an operation at the first station in accordance with the first number and the second station cryptographic data to verify that the second station is the source of second station cryptographic data only if the operational keys are identical.
-
公开(公告)号：DE69230489D1
公开(公告)日：2000-02-03
申请号：DE69230489
申请日：1992-09-11
Applicant: IBM
Inventor： MATYAS STEPHEN M , JOHNSON DONALD B , LE AN V , PRYMAK ROSTISLAW , MARTIN WILLIAM C , ROHLAND WILLIAM S , WILKINS JOHN D
Abstract: Device A in a public key cryptographic network will be constrained to continue to faithfully practice a security policy dictated by a network certification center, long after device A's public key PUMa has been certified. If device A alters its operations from the limits encoded in its configuration vector, for example by loading a new configuration vector, device A will be denied participation in the network. To accomplish this enforcement of the network security policy dictated by the certification center, it is necessary for the certification center to verify at the time device A requests certification of its public key PUMa, that device A is configured with the currently authorized configuration vector. Device A is required to transmit to the certification center a copy of device A's current configuration vector, in an audit record. The certification center then compares device A's copy of the configuration vector with the authorized configuration vector for device A stored at the certification center. If the comparison is satisfactory, then the certification center will issue the requested certificate and will produce a digital signature dSigPRC on a representation of device A's public key PUMa, using the certification center's private certification key PRC. Thereafter, if device A attempts to change its configuration vector, device A's privacy key PRMa corresponding to the certified public key PUMa, will automatically become unavailable for use in communicating in the network.
-
公开(公告)号：DE69230429D1
公开(公告)日：2000-01-20
申请号：DE69230429
申请日：1992-09-11
Applicant: IBM
Inventor： MATYAS STEPHEN M , JOHNSON DONALD B , LE AN V , PRYMAK ROSTISLAW , MARTIN WILLIAM C , ROHLAND WILLIAM S , WILKINS JOHN D
Abstract: A computer apparatus, program and method function in a data processing system to replicate a cryptographic facility. The system includes a first cryptographic facility containing a portable part which personalizes the first cryptographic facility. The system also includes a second cryptographic facility which is linked to the first cryptographic facility by a public key cryptographic system. The portable part of the first cryptographic facility is encrypted and transferred to the second cryptographic facility, where it is decrypted and used to personalize the second cryptographic facility to enable replication of the first cryptographic facility. In one application, personalization of the second cryptographic facility can be in response to the detection of a failure in the first cryptographic facility. In another application, multiple cryptographic facilities can be brought on-line for parallel operation in the data processing system.
-
公开(公告)号：CA2100234C
公开(公告)日：1999-01-19
申请号：CA2100234
申请日：1993-07-09
Applicant: IBM
Inventor： ELANDER ROBERT C , HOLLOWAY CHRISTOPHER J , JOHNSON DONALD B , RANDALL JAMES D , WILKINS JOHN D , KELLY MICHAEL J , LE AN V , LUBOLD PAUL G , MATYAS STEPHEN M
Abstract: A method and system are disclosed for the implementation of a weakened privacy channel. This is achieved through use of a weakened symmetric cryptographic algorithm called commercial data masking. The masked text is created from clear text at one system and may to transported electronically to another system where the masked text may be unmasked to produce the clear text. The reason to use the commercial data masking algorithm for data privacy is that it is exportable to organizations to which products which contain the Data Encryption Algorithm when used for data privacy are not exportable. In addition, a method and system is disclosed by which the key when used for commercial data masking may be transformed into a key that may be used with the Data Encryption Algorithm.
-
Patent Agency Ranking36.发明专利
公开(公告)号：CA2071413C
公开(公告)日：1999-01-05
申请号：CA2071413
申请日：1992-06-17
Applicant: IBM
Inventor： ROHLAND WILLIAM S , WILKINS JOHN D , JOHNSON DONALD B , LE AN V , MARTIN WILLIAM C , PRYMAK ROSTISLAW , MATYAS STEPHEN M
Abstract: Device A in a public key cryptographic network will be constrained to continue to faithfully practice a security policy dictated by a network certification center, long after device A s public key PUMa has been certified. If device A alters its operations from the limits encoded in its configuration vector, for example by loading a new configuration vector, device A will be denied participation in the network. To accomplish this enforcement of the network security policy dictated by the certification center, it is necessary for the certification center to verify at the time device A requests certification of its public key PUMa, that device A is configured with the currently authorized configuration vector. Device A is required to transmit to the certification center a copy of device A's current configuration vector, in an audit record. The certification center then compares device A's copy of the configuration vector with the authorized configuration vector for device A stored at the certification center. If the comparison is satisfactory, then the certification center will issue the requested certificate and will produce a digital signature dSigPRC on a representation of device A's public key PUMa, using the certification center's private certification key PRC. Thereafter, if device A attempts to change its configuration vector, device A's privacy key PRMa corresponding to the certified public key PUMa, will automatically become unavailable for use in communicating in the network.
-
公开(公告)号：CA2075329C
公开(公告)日：1998-03-31
申请号：CA2075329
申请日：1992-08-05
Applicant: IBM
Inventor： WILKINS JOHN D , MARTIN WILLIAM C , ROHLAND WILLIAM S , JOHNSON DONALD B , MATYAS STEPHEN M , LE AN V , PRYMAK ROSTISLAW
Abstract: A data processing system, method and program are disclosed, for managing a public key cryptographic system. The method includes the steps of generating a first public key and a first private key as a first pair in the data processing system, for use with a first public key algorithm and further generating a second public key and a second private key as a second pair in the data processing system, for use with a second public key algorithm. The method then continues by assigning a private control vector for the first private key and the second private key in the data processing system, for defining permitted uses for the first and second private keys. Then the method continues by forming a private key record which includes the first private key and the second private key in the data processing system, and encrypting the private key record under a first master key expression which is a function of the private control vector. The method then forms a private key token which includes the private control vector and the private key record, and stores the private key token in the data processing system. At a later time, the method receives a first key use request in the data processing system, requiring the first public key algorithm. In response to this, the method continues by accessing the private key token in the data processing system and checking the private control vector to determine if the private key record contains a key having permitted uses which will satisfy the first request. The method then decrypts the private key record under the first master key expression in the data processing system and extracts the first private key from the private key record. The method selects the first public key algorithm in the data processing system for the first key use request and executes the first public key algorithm in the data processing system using the first private key to perform a cryptographic operation to satisfy the first key use request.
-
公开(公告)号：DE69217428T2
公开(公告)日：1997-07-17
申请号：DE69217428
申请日：1992-07-10
Applicant: IBM
Inventor： MATYAS STEPHEN M , JOHNSON DONALD B , LE AN V , MARTIN WILLIAM C , PRYMAK ROSTISLAW , ROHLAND WILLIAM S , WILKINS JOHN D
Abstract: The patent describes a method and apparatus for securely distributing an initial Data Encryption Algorithm (DEA) key-encrypting key by encrypting a key record (consisting of the key-encrypting key and control information associated with that key-encrypting key) using a public key algorithm and a public key belonging to the intended recipient of the key record. The patent further describes a method and apparatus for securely recovering the distributed key-encrypting key by the recipient by decrypting the received key record using the same public key algorithm and private key associated with the public key and re-encrypting the key-encrypting key under a key formed by arithmetically combining the recipient's master key with a control vector contained in the control information of the received key record. Thus the type and usage attributes assigned by the originator of the key-encrypting key in the form of a control vector are cryptographically coupled to the key-encrypting key such that the recipient may only use the received key-encrypting key in a manner defined by the key originator. The patent further describes a method and apparatus to improve the integrity of the key distribution process by applying a digital signature to the key record and by including identifying information (i.e., an originator identifier) in the control information of the key record. The integrity of the distribution process is enhanced by verifying the digital signature and originator identifier at the recipient node.
-
公开(公告)号：DE68926200D1
公开(公告)日：1996-05-15
申请号：DE68926200
申请日：1989-08-09
Applicant: IBM
Inventor： MATYAS STEPHEN M , ABRAHAM DENNIS G , JOHNSON DONALD B , KARNE RAMESH K , LE AN V , PRYMAK ROSTISLAW , THOMAS JULIAN , WILKINS JOHN D , YEH PHIL C
-
公开(公告)号：DE69026034D1
公开(公告)日：1996-04-25
申请号：DE69026034
申请日：1990-10-15
Applicant: IBM
Inventor： MATYAS STEPHEN M , ABRAHAM DENNIS G , JOHNSON DONALD B , LE AN V , PRYMAK ROSTISLAW , WILKINS JOHN D , YEH PHIL C
-
-
-
-
-
-
-
-
-
Search Results
61
records
(took 0.018 seconds)
