-
51.发明专利
公开(公告)号：CA2068488C
公开(公告)日：1998-05-19
申请号：CA2068488
申请日：1992-05-12
Applicant: IBM
Inventor： PRYMAK ROSTISLAW , JOHNSON DONALD B , WILKINS JOHN D , MATYAS STEPHEN M , LE AN V
Abstract: The patent describes a method and apparatus for securely distributing an initial Data Encryption Algorithm (DEA) key-encrypting key by encrypting a key record (consisting of the key-encrypting key and control information associated with that key-encrypting key) using a public key algorithm and a public key belonging to the intended recipient of the key record. The patent further describes a method and apparatus for securely recovering the distributed key-encrypting key by the recipient by decrypting the received key record using the same public key algorithm and private key associated with the public key and re-encrypting the key-encrypting key under a key formed by arithmetically combining the recipient's master key with a control vector contained in the control information of the received key record. Thus the type and usage attributes assigned by the originator of the key-encrypting key in the form of a control vector are cryptographically coupled to the key-encrypting key such that the recipient may only use the received key-encrypting key in a manner defined by the key originator. The patent further describes a method and apparatus to improve the integrity of the key distribution process by applying a digital signature to the key record and by including identifying information (i.e., an originator identifier) in the control information of the key record. The integrity of the distribution process is enhanced by verifying the digital signature and originator identifier at the recipient node.
-
公开(公告)号：DE68926005T2
公开(公告)日：1996-10-17
申请号：DE68926005
申请日：1989-08-09
Applicant: IBM
Inventor： MATYAS STEPHEN M , ABRAHAM DENNIS G , JOHNSON DONALD B , KARNE RAMESH K , LE AN V , PRYMAK ROSTISLAW , THOMAS JULIAN , WILKINS JOHN D , YEH PHIL C , SMITH RONALD M , WHITE STEVE R , ARNOLD WILLIAM C
Abstract: Arrangements are disclosed for validating that key management functions requested for a cryptographic key by the program have been authorised by the originator of the key. The invention includes a cryptographic facility characterised by a secure boundary through which passes an input path for receiving the cryptographic service requests, cryptographic keys and their associated control vectors, and an output path for providing responses thereto. There can be included within the boundary a cryptographic instruction storage coupled to the input path, a control vector checking unit and a cryptographic processing unit coupled to the instruction storage, and a master key storage coupled to the processing means, for providing a secure location for executing key management functions in response to the received service requests. The cryptographic instruction storage receives over the input path a cryptographic service request for performing a key management function on a cryptographic key. The control vector checking unit has an input coupled to the input path for receiving a control vector associated with the cryptographic key and an input connected to the cryptographic instruction storage, for receiving control signals to initiate checking that the control vector authorises the key management function which is requested by the cryptographic service request. The control vector checking unit has an authorisation output connected to an input of the cryptographic processing means, for signalling that the key management function is authorised, the receipt of which by the cryptographic processing unit initiates the performance of the requested key management function with the cryptographic key. The invention enables the flexible control of many cryptographic key management functions in the generation, distribution and use of cryptographic keys, while maintaining a high security standard.
-
公开(公告)号：DE69111556T2
公开(公告)日：1996-03-07
申请号：DE69111556
申请日：1991-09-25
Applicant: IBM
Inventor： MATYAS STEPHEN M , JOHNSON DONALD B , LE AN V , MARTIN WILLIAM C , ROHLAND WILLIAM S , WILKINS JOHN D
Abstract: A method and apparatus in a public cryptographic system, control the use of a public key, based on the level of integrity for the public key. The method and apparatus generate a control vector associated with the public key, having a first field. The public key and the control vector are transmitted from the location of generation over a communications link to a receiving location, using the selected one of a plurality of levels of integrity for the transmission. At the receiving location, the public key and the control vector are tested to determine the received level of integrity for the transmission. Then, a value is written into the first field of the control vector which characterizes the received level of integrity. Thereafter, cryptographic applications for the public key are limited by control vector checking, to only those applications which have a required level of integrity which is not greater than the received level of integrity characterized by the first field in the control vector.
-
公开(公告)号：DE69111556D1
公开(公告)日：1995-08-31
申请号：DE69111556
申请日：1991-09-25
Applicant: IBM
Inventor： MATYAS STEPHEN M , JOHNSON DONALD B , LE AN V , MARTIN WILLIAM C , ROHLAND WILLIAM S , WILKINS JOHN D
Abstract: A method and apparatus in a public cryptographic system, control the use of a public key, based on the level of integrity for the public key. The method and apparatus generate a control vector associated with the public key, having a first field. The public key and the control vector are transmitted from the location of generation over a communications link to a receiving location, using the selected one of a plurality of levels of integrity for the transmission. At the receiving location, the public key and the control vector are tested to determine the received level of integrity for the transmission. Then, a value is written into the first field of the control vector which characterizes the received level of integrity. Thereafter, cryptographic applications for the public key are limited by control vector checking, to only those applications which have a required level of integrity which is not greater than the received level of integrity characterized by the first field in the control vector.
-
公开(公告)号：DE68922884D1
公开(公告)日：1995-07-06
申请号：DE68922884
申请日：1989-08-09
Applicant: IBM
Inventor： MATYAS STEPHEN M , JOHNSON DONALD B , ABRAHAM DENNIS G , KARNE RAMESH K , LE AN V , PRYMAK ROSTISLAW , THOMAS JULIAN , WILKINS JOHN D , YEH PHIL C , SMITH RONALD M
-
Patent Agency Ranking
公开(公告)号：DE69019593D1
公开(公告)日：1995-06-29
申请号：DE69019593
申请日：1990-03-28
Applicant: IBM
Inventor： MATYAS STEPHEN M , ABRAHAM DENNIS G , JOHNSON DONALD B , KARNE RAMESH K , LE AN V , MCCORMACK PATRICK J , PRYMAK ROSTISLAW , WILKINS JOHN D
-
公开(公告)号：CA2036858C
公开(公告)日：1994-03-01
申请号：CA2036858
申请日：1991-02-21
Applicant: IBM
Inventor： MATYAS STEPHEN M , JOHNSON DONALD B , LE AN V , MARTIN WILLIAM C , PRYMAK ROSTISLAW , WILKINS JOHN D
Abstract: SECURE KEY MANAGEMENT USING PROGRAMMABLE CONTROL VECTOR CHECKING The invention includes a control vector checking code repository located either within the same system as the cryptographic facility or alternately remotely from the system containing the cryptographic facility. The control vector checking code repository will be linked to the cryptographic facility by one of several means. A first means for linking the repository to the cryptographic facility would include a physically secure data communications link. A second means for connecting the repository to the cryptographic facility would be by using an insecure channel with authentication, wherein either a modification detection code or alternately a message authentication code would be transmitted to the cryptographic facility and then the desired control vector checking code would be transmitted over the link. The cryptographic facility will include a code authorization mechanism to compare the transmitted MAC or MDC with a corresponding value computed from the received control vector checking code. If the two values of the MDC or the MAC compare, then the control vector checking code is authenticated and loaded into the control vector checking unit for carrying out the control vector checking operations desired. The control vector checking code repository can be located in a remote system connected by means of the communications link to the crypto facility, or alternately the repository can reside in the same system as the crypto facility. This provides for the dynamic updating of control vector checking code, where improvements or alterations are made to the control vector checking sequence. This also provides for a reduced memory size in the crypto facility, being sufficiently large to accommodate subsidiary control vector checking applications, with alternate control vector checking applications requiring the reloading of the control vector checking unit from the repository.
-
公开(公告)号：CA1238427A
公开(公告)日：1988-06-21
申请号：CA492225
申请日：1985-10-03
Applicant: IBM
Inventor： MATYAS STEPHEN M , OSEAS JONATHAN
IPC: H04L9/00 , G06F1/00 , G06F12/14 , G06F21/00 , G06F21/22 , G06F21/24 , G07F7/00 , G07F7/10 , H04L9/32 , G06F9/06
Abstract: A cryptographic method for discouraging the copying and sharing of purchased software programs allows an encrypted program to be run on only a designated computer or, alternatively, to be run on any computer but only by the user possessing a designated smart card. Each program offering sold by the software vendor is encrypted with a unique file key and then written on a diskette. A user who purchases a diskette having written thereon an encrypted program must first obtain a secret password from the software vendor. This password will allow the encrypted program to be recovered at a prescribed, designated computer having a properly implemented and initialized encryption feature. The encryption feature decrypts the file key of the program from the password, and when the encrypted program is loaded at the proper computer, the program or a portion of it is automatically decrypted and written into a protected memory from which it can only be executed and not accessed for non-execution purposes. In alternative embodiments, the user is not confined to a prescribed, designated computer but may use the program on other, different computers with a smart card provided the computers have a properly implemented and initialized encryption feature that accepts the smart card. As a further modification, the cryptographic facility may support operations that enable the user to encrypt and decrypt user generated files and/or user generated programs.
-
公开(公告)号：CA1149483A
公开(公告)日：1983-07-05
申请号：CA316965
申请日：1978-11-28
Applicant: IBM
Inventor： EHRSAM WILLIAM F , ELANDER ROBERT C , MATYAS STEPHEN M , MEYER CARL H W , POWERS ROBERT L , PRENTICE PAUL N , SMITH JOHN L , TUCHMAN WALTER L
Abstract: A data security device which includes storage means for storing a master cipher key, cryptographic apparatus for performing cryptographic operations and control means for controlling the writing of a master cipher key into the storage means, controlling the transfer of the master cipher key to the cryptographic apparatus and controlling the cryptoghraphic apparatus to perform cryptographic operations. When a new master cipher key is written into the storage means, the old master cipher key is automatically overwritten with an arbitrary value, after which the new master key may be written into the storage means. The cryptographic apparatus of the data security device includes storage means, a cipher key register and cipher means for performing a cipher function on data stored in the cryptographic apparatus storage means under control of a working cipher key stored in the cipher key register with the resulting ciphered data being stored in the cryptographic apparatus storage means. A load cipher key direct function can be performed whereby a working cipher key may be loaded directly into the cipher key register for use as a working cipher key in performing a cipher function. A decipher key function can be performed whereby the master cipher key is transferred to the cipher key register as a working cipher key after which an operational key enciphored under the master cipher key is transferred to the cryptographic apparatus storage means and the ?ontrol means causes the enciphered operational key to be deciphered to obtain the operational key in clear form as a working cipher key for subsequent encipher/decipher data functions.
-
公开(公告)号：CA1127258A
公开(公告)日：1982-07-06
申请号：CA338886
申请日：1979-10-31
Applicant: IBM
Inventor： MATYAS STEPHEN M , MEYER CARL H W , TUCKERMANN LOUIS B III
Abstract: METHOD AND APPARATUS FOR ENCIPHERING BLOCKS WHICH SUCCEED SHORT BLOCKS IN A KEY-CONTROLLED BLOCK-CIPHER CRYPTOGRAPHIC SYSTEM A method and apparatus for providing improved error-recovery and cryptographic strength when enciphering blocks which succeed short blocks in a Key-Controlled Block-Cipher Cryptographic System with chaining. Beginning with a pre-existing current chaining value (Y), the system determines whether a current input block (X) of data to be encrypted is a full block or a short block. Both in the previous system and in proposed improvement, if the block is a full block, the system first combines the chaining value (V) with said full block (X) by a reversible operation such as exclusive-or and then block-enciphers the result of said exclusive-or under control of the user's cryptographic key (K) to produce an output cipher full block (Y); but if the block is a short block, of length Ls then the system first block-enciphers the current chaining value (V) under control of the user's key(K), producing a result W, and then combines the short block(X) 9 in a reversible operation, with the left-most portion, of length Ls, of W to produce an output cipher short block (Y), of length L . In either case, in the proposed improvement, the system then sets a new chaining value (V') for the system, as being equal to the terminal full block's length of the concatenation of the current chaining-value (V) with the Y0978-009
-
-
-
-
-
-
-
-
-
Search Results
61
records
(took 0.021 seconds)
