EP0421409A2
Expired / Lapsed
EP
⏱️ 0.0 years remaining
Transaction system security method and apparatus
Assignee: International Business Machines Corp
•
Filing: 1990-10-04
•
Granted: —
•
Expires: 2010-10-04
Abstract
Abstract An improved security system is disclosed which uses especially an IC card to enhance the security functions involving component authentication, user verification, user authorization and access control, protection of message secrecy and integrity, management of cryptographic keys, and auditablity. Both the security method and the apparatus for embodying these functions across a total system or network using a common cryptographic architecture are disclosed. Authorization to perform these functions in the various security component device nodes in the network can be distributed to the various nodes at which they will be executed in order to personalize the use of the components.
Inventors
- 👤 Dennis George Abraham
- 👤 Steven George Aden
- 👤 Todd Weston Arnold
- 👤 Steven William Neckyfarow
- 👤 William Stanley Rohland
Bibliographic Details
Application Number
—
Jurisdiction
EP
Data Source
google_patents
Last Synchronized
2026-10-31 03:53
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/04; G; G06; G06F; G06F12/00; G06F12/02; G06F12/08; G06F12/12; G06F12/121; G06F21/00; G06F21/30; G06F21/31; G06F21/34; G06Q; G06Q20/00; G06Q20/30; G06Q20/34; G06Q20/341; G06Q20/36; G06Q20/367; G06Q20/38; G06Q20/40; G06Q20/409; G06Q20/4097; G06Q20/40975; G07; G07F; G07F7/00; G07F7/08; G07F7/10; G07F7/1008; H04L63/10; H04L63/102; H04L63/105; H04L9/00; H04L9/32; H04L9/3226; H04L9/3247; H04L2209/00; H04L2209/56; H04L2209/60
Claims Analysis
Total Claims: 20
Claim 1
Independent Claim
105 words
A security device comprising: a data processor; memory connected to said processor; data input and output means connected to said processor; secure session establishing means programmed into said security device for controlling said processor to establish a secure session with another device; an authorization profile stored in said memory, said profile defining the authority of a user of said security device to cause said processor to execute programmed commands; transfer means for transferring at least part of said authorization profile from said security device to said another device for controlling said device in accordance with said authority of said user defined in said authorization profile.
Claim 2
Dependent Claim
105 words
A security device comprising: a data processor; memory connected to said processor; data input and output means connected to said processor; secure session establishing means programmed into said security device for controlling said processor to establish a secure session with another device; an authorization profile stored in said memory, said profile defining the authority of a user of said security device to cause said processor to execute programmed commands; transfer means for transferring at least part of said authorization profile from said security device to said another device for controlling said device in accordance with said authority of said user defined in said authorization profile.
Claim 3
Dependent Claim
76 words
A security device comprising: a data processor; memory connected to said processor; data input and output means connected to said processor; secure session establishing means programmed into said security device for controlling said processor to establish a secure session with another device; means for receiving at least part of an authorization profile stored in a memory of said another device, said profile defining the authority of a user to cause said processor to execute programmed commands.
Claim 4
Dependent Claim
76 words
A security device comprising: a data processor; memory connected to said processor; data input and output means connected to said processor; secure session establishing means programmed into said security device for controlling said processor to establish a secure session with another device; means for receiving at least part of an authorization profile stored in a memory of said another device, said profile defining the authority of a user to cause said processor to execute programmed commands.
Claim 5
Dependent Claim
34 words
The security device of claim 1 or 2, wherein said security device is an IC card, or a host computer, and said another device is an IC card reader, or a computer work station.
Claim 6
Dependent Claim
35 words
The security device of claim 1, 2, or 3, wherein said authorization profile defines the authority of said user to execute a command at a particular time, and/or day and/or between particular times of day.
Claim 7
Dependent Claim
33 words
The security device of claim 1, 2, 3, or 4, wherein said authorization profile contains a plurality of command flags, each command flag defining the authority of said user to execute a command.
Claim 8
Dependent Claim
35 words
The security device of claim 1, 2, 3, 4, or 5, wherein said authorization profile contains a plurality of access flags, each access flag defining the authority of said user to access a data file.
Claim 9
Dependent Claim
35 words
The security device of claim 1, 2, 3, 4, 5, or 6, wherein said authorization profile contains a plurality of program flags, each program flag defining the authority of said user to execute a program.
Claim 10
Dependent Claim
19 words
The security device of anyone of claims 1 to 7, wherein said authorization profile contains a user authorization level.
Claim 11
Dependent Claim
28 words
The security device of anyone of claims 1 to 8, wherein said authorization profile contains a user ID, a personal identification number, and an identity verification method identifier.
Claim 12
Dependent Claim
87 words
A security device, especially an IC card, comprising: a data processor; protected programmable memory connected to said processor; data input and output means connected to said processor; an authorization profile stored in said memory, said profile defining the authority of a user of said security device, especially said card to cause said processor to execute programmed commands; means for receiving an authorization profile created by an authorized person and storing said received authorization profile into said memory to be used in place of said stored authorization profile.
Claim 13
Dependent Claim
87 words
A security device, especially an IC card, comprising: a data processor; protected programmable memory connected to said processor; data input and output means connected to said processor; an authorization profile stored in said memory, said profile defining the authority of a user of said security device, especially said card to cause said processor to execute programmed commands; means for receiving an authorization profile created by an authorized person and storing said received authorization profile into said memory to be used in place of said stored authorization profile.
Claim 14
Dependent Claim
39 words
The IC card of claim 10 further comprising: data blocks in said memory, each data block having a header, said header containing memory access prerequisites; and means for comparing said access prerequisites with the authorization profile of said user.
Claim 15
Dependent Claim
128 words
The IC card of claim 11 wherein one of said access prerequisites is an authority level and further comprising: means for comparing said authority level with an authorization level stored in said users authorization profile, and/or wherein one of said access prerequisites comprise a read flag and a write flag for each user and further comprising: means for allowing read access to said memory only if said read flag is set and allowing write access to said memory only if said write flag is set, and/or wherein one of said access prerequisites is a secure session required flag and further comprising: means for allowing access to said memory only if said IC card is in a secure session with another device which is requesting access to said memory.
Claim 16
Dependent Claim
48 words
A security device comprising: a data processor; protected programmable memory connected to said processor; data input and output means connected to said processor; a plurality of commands for controlling said processor stored in said memory, each command having a plurality of programmable execution prerequisites stored in said memory.
Claim 17
Dependent Claim
48 words
A security device comprising: a data processor; protected programmable memory connected to said processor; data input and output means connected to said processor; a plurality of commands for controlling said processor stored in said memory, each command having a plurality of programmable execution prerequisites stored in said memory.
Claim 18
Dependent Claim
220 words
The security device of claim 13 wherein one of said execution prerequisites is an established secure session between the devices affected by the command, whereby the command to which it relates will not be executed unless a secure session has previously been established, and/or wherein one of said execution prerequisites is an initial user verification whereby the command to which it relates will not be executed unless the identity of the user requesting the execution of the command has previously been verified during a current session, and/or wherein one of said execution prerequisites is a pre-execution user verification whereby the command to which it relates will not be executed unless the identity of the user requesting the execution of the command has been verified specifically for each execution of said command to which it relates, and/or wherein one of said execution prerequisites is time, whereby a command to which it relates will not be executed unless the time and date are within the limits authorized during which a user requesting execution of said command is authorized to execute said command, and/or wherein one of said execution prerequisites is an authorization level, whereby a command to which it relates will not be executed unless a user requesting execution of said command has an authorization level at or above a specified level.
Claim 19
Dependent Claim
136 words
Method of communicating a secure boolean response, especially for use in a device of anyone of the claims 1 to 14, comprising the steps of: a) generating a random number in a security device; b) encrypting said random number under a key; c) sending said encrypted random number to another security device; d) decrypting said encrypted random number in said another security device; e) modifying said random number by a first function if said response is true; f) modifying said random number by a second function if said response is false; g) encrypting said modified random number; h) sending said encrypted modified random number to said first security device; i) decrypting said encrypted modified random number at said first security device; and j) comparing said modified random number with said random number to determine the response.
Claim 20
Dependent Claim
69 words
Method of changing a value used in the generation of a random number, especially for use in a device of anyone of the claims 1 to 14, comprising the steps of: a) generate a first random number; b) using a portion of said random number to select a bit of said value; c) inverting said bit; d) repeat steps a, b, and c to generate a second random number.
References Cited (Backward Citations)
No citation records indexed.
USPTO Annuity & Maintenance Windows
Maintenance schedule is calculated for granted US utility patents.