-
公开(公告)号：DE69230429T2
公开(公告)日：2000-06-08
申请号：DE69230429
申请日：1992-09-11
Applicant: IBM
Inventor： MATYAS STEPHEN M , JOHNSON DONALD B , LE AN V , PRYMAK ROSTISLAW , MARTIN WILLIAM C , ROHLAND WILLIAM S , WILKINS JOHN D
Abstract: A computer apparatus, program and method function in a data processing system to replicate a cryptographic facility. The system includes a first cryptographic facility containing a portable part which personalizes the first cryptographic facility. The system also includes a second cryptographic facility which is linked to the first cryptographic facility by a public key cryptographic system. The portable part of the first cryptographic facility is encrypted and transferred to the second cryptographic facility, where it is decrypted and used to personalize the second cryptographic facility to enable replication of the first cryptographic facility. In one application, personalization of the second cryptographic facility can be in response to the detection of a failure in the first cryptographic facility. In another application, multiple cryptographic facilities can be brought on-line for parallel operation in the data processing system.
-
公开(公告)号：DE68926200T2
公开(公告)日：1996-10-17
申请号：DE68926200
申请日：1989-08-09
Applicant: IBM
Inventor： MATYAS STEPHEN M , ABRAHAM DENNIS G , JOHNSON DONALD B , KARNE RAMESH K , LE AN V , PRYMAK ROSTISLAW , THOMAS JULIAN , WILKINS JOHN D , YEH PHIL C
-
公开(公告)号：DE68926005D1
公开(公告)日：1996-04-25
申请号：DE68926005
申请日：1989-08-09
Applicant: IBM
Inventor： MATYAS STEPHEN M , ABRAHAM DENNIS G , JOHNSON DONALD B , KARNE RAMESH K , LE AN V , PRYMAK ROSTISLAW , THOMAS JULIAN , WILKINS JOHN D , YEH PHIL C , SMITH RONALD M , WHITE STEVE R , ARNOLD WILLIAM C
Abstract: Arrangements are disclosed for validating that key management functions requested for a cryptographic key by the program have been authorised by the originator of the key. The invention includes a cryptographic facility characterised by a secure boundary through which passes an input path for receiving the cryptographic service requests, cryptographic keys and their associated control vectors, and an output path for providing responses thereto. There can be included within the boundary a cryptographic instruction storage coupled to the input path, a control vector checking unit and a cryptographic processing unit coupled to the instruction storage, and a master key storage coupled to the processing means, for providing a secure location for executing key management functions in response to the received service requests. The cryptographic instruction storage receives over the input path a cryptographic service request for performing a key management function on a cryptographic key. The control vector checking unit has an input coupled to the input path for receiving a control vector associated with the cryptographic key and an input connected to the cryptographic instruction storage, for receiving control signals to initiate checking that the control vector authorises the key management function which is requested by the cryptographic service request. The control vector checking unit has an authorisation output connected to an input of the cryptographic processing means, for signalling that the key management function is authorised, the receipt of which by the cryptographic processing unit initiates the performance of the requested key management function with the cryptographic key. The invention enables the flexible control of many cryptographic key management functions in the generation, distribution and use of cryptographic keys, while maintaining a high security standard.
-
公开(公告)号：CA1317677C
公开(公告)日：1993-05-11
申请号：CA602904
申请日：1989-06-15
Applicant: IBM
Inventor： MATYAS STEPHEN M , ABRAHAM DENNIS G , JOHNSON DONALD B , KARNE RAMESH K , LE AN V , PRYMAK ROSTISLAW , THOMAS JULIAN , WILKINS JOHN D , YEH PHIL C
Abstract: MA988-011 of the Invention SECURE MANAGEMENT OF KEYS USING CONTROL VECTORS The invention is an apparatus and method for validating that key management functions requested for a cryptographic key by the program have been authorized by the originator of the key. The invention includes a cryptographic facility characterized by a secure boundary through which passes an input path for receiving the cryptographic service requests, cryptographic keys and their associated control vectors, and an output path for providing responses thereto. There can be included within the boundary a cryptographic instruction storage coupled to the input path, a control vector checking unit and a cryptographic processing unit coupled to the instruction storage, and a master key storage coupled to the processing means, for providing a secure location for executing key management functions in response to the received service requests. The cryptographic instruction storage receives over the input path a cryptographic service request for performing a key management function on a cryptographic key. The control vector checking unit has an input coupled to the input path for receiving a control vector associated with the cryptographic key and an input connected to the cryptographic instruction storage, for receiving control signals to initiate checking that the control vector authorizes the key management function which is requested by the cryptographic service request. The control vector checking unit has an authorization output connected to an input of the cryptographic processing means, for signalling that the key management function is authorized, the receipt of which by the cryptographic processing unit initiates the performance of the requested key management function with the cryptographic key. The invention enables the flexible control of many cryptographic key management functions in the generation, distribution and use of cryptographic keys, while maintaining a high security standard.
-
公开(公告)号：CA2075254A1
公开(公告)日：1993-03-28
申请号：CA2075254
申请日：1992-08-05
Applicant: IBM
Inventor： MATYAS STEPHEN M , JOHNSON DONALD B , LE AN V , PRYMAK ROSTISLAW , WILKINS JOHN D
Abstract: BT9-91-027 A data processing system, program and method are disclosed for managing a public key cryptographic system which includes a public key, private key pair generator. The method includes the step of generating a first public key, private key pair using a first seed value known to a user, the first seed value being generated from a passphrase. A first random number is generated using the first seed value and applied to generating the first key pair. The method then generates a first control vector defining a first use of the first public key, private key pair. The method then continues with the step of generating a second public key, private key pair using a second seed value unknown to the user, the second seed value being a true random number. The second random number is generated using the second seed value in a pseudorandom number generator and applied to generating the second key pair. The method generates a second control vector defining a second use of the second public key, private key pair. The method then controls the use of the first public key, private key pair using the first control vector and controls the use of the second public key, private key pair with the second control vector.
-
Patent Agency Ranking
公开(公告)号：CA2068488A1
公开(公告)日：1993-02-23
申请号：CA2068488
申请日：1992-05-12
Applicant: IBM
Inventor： MATYAS STEPHEN M , JOHNSON DONALD B , LE AN V , PRYMAK ROSTISLAW , WILKINS JOHN D
Abstract: The patent describes a method and apparatus for securely distributing an initial Data Encryption Algorithm (DEA) key-encrypting key by encrypting a key record (consisting of the key-encrypting key and control information associated with that key-encrypting key) using a public key algorithm and a public key belonging to the intended recipient of the key record. The patent further describes a method and apparatus for securely recovering the distributed key-encrypting key by the recipient by decrypting the received key record using the same public key algorithm and private key associated with the public key and re-encrypting the key-encrypting key under a key formed by arithmetically combining the recipient's master key with a control vector contained in the control information of the received key record. Thus the type and usage attributes assigned by the originator of the key-encrypting key in the form of a control vector are cryptographically coupled to the key-encrypting key such that the recipient may only use the received key-encrypting key in a manner defined by the key originator. The patent further describes a method and apparatus to improve the integrity of the key distribution process by applying a digital signature to the key record and by including identifying information (i.e., an originator identifier) in the control information of the key record. The integrity of the distribution process is enhanced by verifying the digital signature and originator identifier at the recipient node.
-
公开(公告)号：DE69130658T2
公开(公告)日：1999-07-22
申请号：DE69130658
申请日：1991-06-18
Applicant: IBM
Inventor： JOHNSON DONALD B , LE AN V , MATYAS STEPHEN M , PRYMAK ROSTISLAW , WILKINS JOHN D
-
公开(公告)号：CA2007409C
公开(公告)日：1998-10-06
申请号：CA2007409
申请日：1990-01-09
Applicant: IBM
Inventor： MATYAS STEPHEN M , ABRAHAM DENNIS G , JOHNSON DONALD B , KARNE RAMESH K , PRYMAK ROSTISLAW , WILKINS JOHN D , MCCORMACK PATRICK J , LE AN V
Abstract: An apparatus and method are disclosed for validating that a cryptographic function requested to be performed with a cryptographic key has been authorized by the originator of the key. The invention is used in a data processing system which processes cryptographic service requests for the performance of cryptographic functions with cryptographic keys which are associated with control vectors defining the functions which each key is allowed by its originator to perform. The invention includes a cryptographic facility characterized by a secure boundary through which passes an I/O path for receiving a cryptographic key and its associated control vector, and for providing a response thereto, there being included within the boundary a cryptographic processing means coupled to the I/O path and a master key storage coupled to the processing means, for providing a secure location to execute a cryptographic function with the cryptographic key. In accordance with the invention, a first control vector checking means has an input to receive at least a first portion of the associated control vector and to receive a cryptographic service request to perform the cryptographic function with the cryptographic key, for performing a first check of the first portion of the associated control vector to determine if the cryptographic function is authorized to be performed by the cryptographic key. The first control vector checking means has a first authorization output coupled to the cryptographic processing means, for outputting a first authorization signal that the cryptographic function is authorized to be performed by the cryptographic key. Further in accordance with the invention, a second control vector checking means has an input to receive at least a second portion of the associated control vector and to receive a cryptographic service request to perform the cryptographic function with the cryptographic key, for performing a second check of the second portion of the associated control vector to determine if the cryptographic function is authorized to be performed by the cryptographic key. The second control vector checking means has a second authorization output coupled to the cryptographic processing means, for outputting a second authorization signal that the cryptographic function is authorized to be performed by the cryptographic key. The cryptographic processing means initiates the execution of the cryptographic function with the cryptographic key in response to receiving the first and second authorization signals. In this manner, distributed control vector checking operations are enabled for multiprocessing, remote terminal, smart card and multiprogramming applications.
-
公开(公告)号：DE69026034T2
公开(公告)日：1996-10-02
申请号：DE69026034
申请日：1990-10-15
Applicant: IBM
Inventor： MATYAS STEPHEN M , ABRAHAM DENNIS G , JOHNSON DONALD B , LE AN V , PRYMAK ROSTISLAW , WILKINS JOHN D , YEH PHIL C
-
公开(公告)号：DE69119290D1
公开(公告)日：1996-06-13
申请号：DE69119290
申请日：1991-02-26
Applicant: IBM
Inventor： MATYAS STEPHEN M , JOHNSON DONALD B , LE AN V , MARTIN WILLIAM CARL , PRYMAK ROSTISLAW , WILKINS JOHN D
-
-
-
-
-
-
-
-
-
Search Results
37
records
(took 0.018 seconds)
