EP0326699A2
Expired / Lapsed
EP
⏱️ 0.0 years remaining
A remote trusted path mechanism for telnet
Assignee: International Business Machines Corp
•
Filing: 1988-12-20
•
Granted: —
•
Expires: 2008-12-20
Abstract
Abstract In the remote trusted path, secure systems may provide a mechanism for the user to establish a trusted path for direct communication with the system's trusted computing base for security-critical operations. This invention allows users to request such a trusted path from remote systems using a new TELNET option and command, in a system-independent, confirmed, backward-compatible manner. It also describes how to implement remote support for such a trusted path in systems which use a Secure Attention Key mechanism such as Secure AIX.
Inventors
- 👤 William Franz Burger
- 👤 Mark Erwin Carson
- 👤 Abhai Johri
- 👤 Ellen Jean Stokes
Bibliographic Details
Application Number
—
Jurisdiction
EP
Data Source
google_patents
Last Synchronized
2026-10-28 19:00
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06F2211/00; G06F2211/009
Claims Analysis
Total Claims: 9
Claim 1
Independent Claim
234 words
In a data processing network including a first node having a first data processor connected over a data communications network to a second node having a second data processor, said first data processor having connected thereto a terminal which includes a local Secure Attention Key means and a network Secure Attention Key means, a mechanism for establishing a trusted path from said terminal through said first data processor and over said network to a trusted process in said second data processor comprising: means in said first data processor coupled to said terminal, for establishing a trusted process in said first data processor in response to said local Secure Attention Key means, said trusted process having a trusted path to said terminal; said trusted process establishing a communications link between said terminal and said data processing network, and outputting a network Secure Attention Key signal over said network to said second data processor in response to said network Secure Attention Key means; means in said second data processor coupled to said communications network for receiving said network Secure Attention Key signal and in response thereto, establishing a second trusted process in said second data processor having a trusted path in said second processor to said communications network; whereby a trusted path is established from said terminal through said first processor and over said communications network and through said second processor to said second trusted process.
Claim 2
Dependent Claim
234 words
In a data processing network including a first node having a first data processor connected over a data communications network to a second node having a second data processor, said first data processor having connected thereto a terminal which includes a local Secure Attention Key means and a network Secure Attention Key means, a mechanism for establishing a trusted path from said terminal through said first data processor and over said network to a trusted process in said second data processor comprising: means in said first data processor coupled to said terminal, for establishing a trusted process in said first data processor in response to said local Secure Attention Key means, said trusted process having a trusted path to said terminal; said trusted process establishing a communications link between said terminal and said data processing network, and outputting a network Secure Attention Key signal over said network to said second data processor in response to said network Secure Attention Key means; means in said second data processor coupled to said communications network for receiving said network Secure Attention Key signal and in response thereto, establishing a second trusted process in said second data processor having a trusted path in said second processor to said communications network; whereby a trusted path is established from said terminal through said first processor and over said communications network and through said second processor to said second trusted process.
Claim 3
Dependent Claim
68 words
The system of claim 1 wherein said means in said second data processor further comprises: a daemon process running under a UNIX-type operating system connected between said communications network and a pseudo terminal interface which outputs in response to the receipt of said network Secure Attention Key signal, a signal to a SIGSAK generator, for initiating the establishment of said second trusted process in said second data processor.
Claim 4
Independent Claim
156 words
A method in a UNIX-like operating system for creating, in response to a network secure attention request, a trusted path between a communications network connected to a data processor running a trusted init process under said operating system and a trusted shell portion of a trusted computing base in said data processor, comprising the steps of: waiting for the receipt of a network Secure Attention Key message from said communications network; outputting in response to the receipt of said network Secure Attention Key message, a SIGSAK Secure Attention Key signal; terminating active processes under an init parent process in response to said production of said SIGSAK signal; limiting the access of processes in said data processor to said communications network to only said init process; establishing a trusted shell process under said init process, having exclusive access to said communications network; whereby a trusted path is established between said communications network and said trusted shell process.
Claim 5
Independent Claim
156 words
A method in a UNIX-like operating system for creating, in response to a network secure attention request, a trusted path between a communications network connected to a data processor running a trusted init process under said operating system and a trusted shell portion of a trusted computing base in said data processor, comprising the steps of: waiting for the receipt of a network Secure Attention Key message from said communications network; outputting in response to the receipt of said network Secure Attention Key message, a SIGSAK Secure Attention Key signal; terminating active processes under an init parent process in response to said production of said SIGSAK signal; limiting the access of processes in said data processor to said communications network to only said init process; establishing a trusted shell process under said init process, having exclusive access to said communications network; whereby a trusted path is established between said communications network and said trusted shell process.
Claim 6
Dependent Claim
234 words
In a data processing network including a first node having a first data processor connected over a data communications network to a second node having a second data processor, said first data processor having connected thereto a terminal which includes a local Secure Attention Key means and a network Secure Attention Key means, a mechanism for establishing a trusted path from said terminal through said first data processor and over said network to a trusted process in said second data processor comprising the steps of: establishing a trusted process in said first data processor in response to a signal from said local Secure Attention Key means, said trusted process having a trusted path to said terminal; establishing a communications link between said terminal and said data processing network with said trusted process, and outputting a network Secure Attention Key signal over said network to said second data processor in response to a signal from said network Secure Attention Key means; receiving said network Secure Attention Key signal in said second data processor and in response thereto, establishing a second trusted process in said second data processor having a trusted path in said second processor having a trusted path in said second processor to said communications network; whereby a trusted path is established from said terminal through said first processor and over said communications network and through said second processor to said second trusted process.
Claim 7
Dependent Claim
234 words
In a data processing network including a first node having a first data processor connected over a data communications network to a second node having a second data processor, said first data processor having connected thereto a terminal which includes a local Secure Attention Key means and a network Secure Attention Key means, a mechanism for establishing a trusted path from said terminal through said first data processor and over said network to a trusted process in said second data processor comprising the steps of: establishing a trusted process in said first data processor in response to a signal from said local Secure Attention Key means, said trusted process having a trusted path to said terminal; establishing a communications link between said terminal and said data processing network with said trusted process, and outputting a network Secure Attention Key signal over said network to said second data processor in response to a signal from said network Secure Attention Key means; receiving said network Secure Attention Key signal in said second data processor and in response thereto, establishing a second trusted process in said second data processor having a trusted path in said second processor having a trusted path in said second processor to said communications network; whereby a trusted path is established from said terminal through said first processor and over said communications network and through said second processor to said second trusted process.
Claim 8
Dependent Claim
82 words
The method of claim 4 wherein said step of establishing said second trusted processor, further comprises the steps of: running under a UNIX-type operating system connected between said communications network and a pseudo terminal interface in said second data processor; outputting a signal from said pseudo terminal interface to a SIGSAK generator in response to the receipt of said network Secure Attention Key signal by said daemon process, for initiating the establishment of said second trusted process in said second data processor.
Claim 9
Dependent Claim
109 words
The method of claim 5, wherein said step of establishing said second trusted process, further comprises the steps of: outputting a SIGSAK Secure Attention Key signal from said SIGSAK generator in response to said signal from said pseudo terminal interface; terminating active processes under an init parent process in response to said production of said SIGSAK signal; limiting the access of processes in said second data processor to said communications network to only said init process; establishing said second trusted shell process under said init process, having exclusive access to said communications network; whereby a trusted path is established between said communications network and said second trusted shell process.
References Cited (Backward Citations)
No citation records indexed.
USPTO Annuity & Maintenance Windows
Maintenance schedule is calculated for granted US utility patents.