EP0268141A2
Expired / Lapsed
EP
⏱️ 0.0 years remaining
Remote access terminal security
Assignee: International Business Machines Corp
•
Filing: 1987-11-03
•
Granted: —
•
Expires: 2007-11-03
Abstract
Abstract A terminal (10) is equipped with a physically and logically secure privileged co-processor PCP (15). An encrypted decryption key is transferred from an authorization disk (20) supplied by a computer center to the PCP. The terminal or PC then writes an encrypted file onto the authorization disk to identify itself as the correct terminal to be given authorization. This disk is then returned to the computer center to verify that the correct PCP has received authorization. The decryption key is needed to use the host computer. After the user of the terminal passes his identification to the host computer, all subsequent communication between the terminal and the host computer are encrypted and can only be decrypted by a key stored in the PCP. The decryption key can be dynamically changed for further transactions. The decryption key can also be transferred to the PCP at the computer center without using the authorization disk. In such case, a special program included in the PCP can be used to make sure the correct terminal is authorized.
Inventors
- 👤 Akhileshwari Narain Chandra
- 👤 Liam David Comerford
- 👤 Steve Richard White
Bibliographic Details
Application Number
—
Jurisdiction
EP
Data Source
google_patents
Last Synchronized
2026-10-27 08:29
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/34
Claims Analysis
Total Claims: 15
Claim 1
Independent Claim
92 words
A method of remote terminal access comprising the steps of: (a) transferring a encrypted decryption key from a central computer to a physically secure coprocessor, (b) coupling said physically secure coprocessor to said terminal, (c) transferring an encrypted file from said coprocessor to said central computer to allow the central computer to identify the coprocessor which generated the encrypted file, and (d) examining said encrypted file at said central computer to verify that a specific coprocessor has created said encrypted file before authorizing access to said central computer by said remote terminal.
Claim 2
Independent Claim
92 words
A method of remote terminal access comprising the steps of: (a) transferring a encrypted decryption key from a central computer to a physically secure coprocessor, (b) coupling said physically secure coprocessor to said terminal, (c) transferring an encrypted file from said coprocessor to said central computer to allow the central computer to identify the coprocessor which generated the encrypted file, and (d) examining said encrypted file at said central computer to verify that a specific coprocessor has created said encrypted file before authorizing access to said central computer by said remote terminal.
Claim 3
Dependent Claim
48 words
A method as recited in claim 1 in which said step (a) includes obtaining said encrypted decryption key from a magnetic disk by said secure coprocessor and in which said obtaining step includes performing a query/response protocol between said coprocessor and a token before accepting said decryption key.
Claim 4
Dependent Claim
23 words
A method as recited in claim 1 or 2 in which said step (c) includes writing said encrypted file onto a magnetic disk.
Claim 5
Dependent Claim
41 words
A method as recited in claim 1 or 2 which includes the further si:ep of encrypting and decrypting at least some messages between said central computer and said remote terminal with a key identical or related to said encrypted decryption key.
Claim 6
Dependent Claim
42 words
A method as recited in claim 4 in which at least some messages exchanged between said remote terminal and said central computer include a replacement key for said coprocessor to be substituted for said encrypted decryption key or an earlier replacement key.
Claim 7
Dependent Claim
31 words
A method as recited in claim 1-5 in which said step (a) is implemented at a time when said physically secure coprocessor and said central computer are located adjacent each other.
Claim 8
Dependent Claim
143 words
A method as recited in claim 1-6 in which said step (a) includes: a1) preparing a secure, read once hardware cartridge and storing therein token data, a2) coupling to said coprocessor a file of encrypted token data, encrypted under said decryption key, a3) decrypting said encrypted decryption key using a hardware key secured within said coprocessor, a4) decrypting said file of token data to produce computed token data, a5) generating a random number query and coupling said random number query to read said hardware cartridge to generate an actual cartridge response and thereby destroying the token data previously stored therein, a6) computing a cartridge response in said coprocessor with said random number and said computed token data, a7) comparing said actual cartridge response with said computed cartridge response, and a8) discarding said decryption key unless said actual and computed cartridge responses compare favorably.
Claim 9
Dependent Claim
52 words
A method as recited in claim 7 in which said file of encrypted token data is stored on a magnetic disk along with application software at least a portion of which is encrypted under said decryption key and which includes a further step of decrypting said encrypted software under said decryption key.
Claim 10
Independent Claim
27 words
A method as recited in claim1-8 in which said step (c) includes: cl) generating a coprocessor unique number, and c2) encrypting said number under said decryption key.
Claim 11
Dependent Claim
32 words
A method as recited in claim 9 which includes the further steps of: c3) writing said encrypted number onto a magnetic medium, and c4) transporting said magnetic medium to said central computer.
Claim 12
Dependent Claim
32 words
A method as recited in claim 9 which includes the further steps of: c3) writing said encrypted number to a hardware cartridge, and c4) transporting said hardware cartridge to said central computer.
Claim 13
Dependent Claim
60 words
A method as recited in claim 10 which includes the further steps of: c5) reading said encrypted number by said central computer, c6) decrypting said encrypted number under a copy of a decryption key stored in said central computer, and c7) comparing a result produced by said step c6) with data stored by said central computer identifying an authorized coprocessor.
Claim 14
Dependent Claim
49 words
A method as recited in claim 12 which includes the further steps of: c8) storing an authorization status for said coprocessor if said step c7) produces a first result, or c9) not storing an authorization status for said coprocessor if said step c7) does not produce said first result.
Claim 15
Dependent Claim
46 words
A method a recited in claim 13 which includes a further step of allowing subsequent communication with any terminal having access to any coprocessor which has said authorization status and refusing communication with any terminal not having access to a coprocessor with such an authorization status.
References Cited (Backward Citations)
No citation records indexed.
USPTO Annuity & Maintenance Windows
Maintenance schedule is calculated for granted US utility patents.