Patent EP0534419A2 successfully refreshed from Google Patents.
EP0534419A2
Expired / Lapsed
EP
⏱️ 0.0 years remaining
Public key cryptosystem key management based on control vectors
Assignee: International Business Machines Corp
•
Filing: 1992-09-11
•
Granted: —
•
Expires: 2012-09-11
Abstract
Abstract A data processing system, method and program are disclosed, for managing a public key cryptographic system. The method includes the steps of generating a first public key and a first private key as a first pair in the data processing system, for use with a first public key algorithm and further generating a second public key and a second private key as a second pair in the data processing system, for use with a second public key algorithm. The method then continues by assigning a private control vector for the first private key and the second private key in the data processing system, for defining permitted uses for the first and second private keys. Then the method continues by forming a private key record which includes the first private key and the second private key in the data processing system, and encrypting the private key record under a first master key expression which is a function of the private control vector. The method then forms a private key token which includes the private control vector and the private key record, and stores the private key token in the data processing system. At a later time, the method receives a first key use request in the data processing system, requiring the first public key algorithm. In response to this, the method continues by accessing the private key token in the data processing system and checking the private control vector to determine if the private key record contains a key having permitted uses which will satisfy the first request. The method then decrypts the private key record under the first master key expression in the data processing system and extracts the first private key from the private key record. The method selects the first public key algorithm in the data processing system for the first key use request and executes the first public key algorithm in the data processing system using the first private key to perform a cryptographic operation to satisfy the first key use request.
Inventors
- 👤 Stephen M. Matyas
- 👤 Donald B. Johnson
- 👤 An V. Le
- 👤 Rostislaw Prymak
- 👤 William C. Martin
- 👤 William S. Rohland
- 👤 John D. Wilkins
Bibliographic Details
Application Number
—
Jurisdiction
EP
Data Source
google_patents
Last Synchronized
2026-11-09 21:27
CPC Classifications
H; H04; H04L; H04L9/00; H04L9/08; H04L9/0816; H04L9/0838; H04L9/0841; H04L9/0844; G; G06; G06F; G06F9/00; G06F9/06; G06F9/30; G06F9/30003; G06F9/30007; H04L9/088; H04L9/50; H04L2209/00; H04L2209/12
Claims Analysis
Total Claims: 32
Claim 1
Independent Claim
296 words
In a data processing system, a method for managing a public key cryptographic system, comprising the steps of: generating a first public key and a first private key as a first pair in said data processing system, for use with a first public key algorithm; generating a second public key and a second private key as a second pair in said data processing system, for use with a second public key algorithm; assigning a private control vector for said first private key and said second private key in said data processing system, for defining permitted uses for said first and second private keys; forming a private key record which includes said first private key and said second private key in said data processing system, and encrypting said private key record under a first master key expression which is a function of said private control vector; forming a private key token which includes said private control vector and said private key record, and storing said private key token in said data processing system; receiving a first key use request in said data processing system, requiring said first public key algorithm; accessing said private key token in said data processing system and checking said private control vector to determine if said private key record contains a key having permitted uses which will satisfy said first request; decrypting said private key record under said first master key expression in said data processing system and extracting said first private key from said private key record; selecting said first public key algorithm in said data processing system for said first key use request; executing said first public key algorithm in said data processing system using said first private key to perform a cryptographic operation to satisfy said first key use request.
Claim 2
Dependent Claim
50 words
The method of claim 1, which further comprises: said private key record including first parse data to locate said first private key and said second private key in said key record; said extracting step including using said parse data for extracting said first private key from said private key record.
Claim 3
Dependent Claim
70 words
The method of claim 1 or 2, which further comprises: forming a first private key authentication record in said data processing system, by computing a hash value using a hashing function on said private key record and encrypting said first private key authentication record under a second master key expression which is a function of said private control vector; said private key token including said first private key authentication record.
Claim 4
Dependent Claim
87 words
The method of claim 3, which further comprises: after said decrypting step, computing a second private key authentication record in said data processing system, by computing a second hash value using said hashing function on said decrypted private key record and comparing said second a private key authentication record with said first private key authentication record; aborting further processing of said first key use request in said data processing system, if said second private key authentication record is not equal to said first private key authentication record.
Claim 5
Dependent Claim
55 words
The method of claim 4, which further comprises: said private key token including first header data to locate said control vector, said private key record and said private key authentication record in said private key token; said accessing step including using said header data to locate said private key record in said private key token.
Claim 6
Dependent Claim
240 words
The method of claim 1 or anyone of the claims 2 to 5, which further comprises: assigning a public control vector for said first public key and said second public key in said data processing system, for defining permitted uses for said first and second public keys; forming a public key record which includes said first public key and said second public key in said data processing system, and encrypting said public key record under a third master key expression which is a function of said public control vector; forming a public key token which includes said public control vector and said public key record, and storing said public key token in said data processing system; receiving a second key use request in said data processing system, requiring said second public key algorithm; accessing said public key token in said data processing system and checking said public control vector to determine if said public key record contains a key having permitted uses which will satisfy said second request; decrypting said public key record under said third master key expression in said data processing system and extracting said first public key from said public key record; selecting said second public key algorithm in said data processing system for said second key use request; executing said second public key algorithm in said data processing system using said first public key to perform a cryptographic operation to satisfy said second key use request.
Claim 7
Dependent Claim
55 words
The method of claim 6, which further comprises: said public key record including second parse data to locate said first public key and said second public key in said key record; said extracting step for said first public key including using said parse data for extracting said first public key from said public key record.
Claim 8
Dependent Claim
70 words
The method of claim 6 or 7, which further comprises: forming a second public key authentication record in said data processing system, by computing a hash value using said hashing function on said public key record and encrypting said second public key authentication record under a fourth master key expression which is a function of said public control vector; said public key token including said second public key authentication record.
Claim 9
Dependent Claim
92 words
The method of claim 8, which further comprises: after said decrypting step for said public key record, computing a second public key authentication record in said data processing system, by computing a second hash value using said hashing function on said decrypted public key record and comparing said second a public key authentication record with said second public key authentication record; aborting further processing of said second key use request in said data processing system, if said second public key authentication record is not equal to said second public key authentication record.
Claim 10
Dependent Claim
60 words
The method of claim 9, which further comprises: said public key token including second header data to locate said control vector, said public key record and said public key authentication record in said public key token; said accessing step for said public key token including using said header data to locate said public key record in said public key token.
Claim 11
Dependent Claim
236 words
In a data processing system, a method for managing a public key cryptographic system, comprising the steps of: generating a public key and a private key as a pair in said data processing system, for use with a public key algorithm; assigning a private control vector for said private key in said data processing system, for defining permitted uses for said private key; forming a private key record which includes said private key in said data processing system, and encrypting said private key record under a first master key expression which is a function of said private control vector; forming a private key token which includes said private control vector and said encrypted private key record and storing said private key token in said data processing system; receiving a first key use request in said data processing system, requiring execution of said public key algorithm with a private key; accessing said private key token in said data processing system and checking said private control vector to determine if said private key record contains a key having permitted uses which will satisfy said first request; decrypting said private key record under said first master key expression in said data processing system and extracting said private key from said private key record; executing said public key algorithm in said data processing system using said private key to perform a cryptographic operation to satisfy said first key use request.
Claim 12
Dependent Claim
202 words
The method of claim 11, which further comprises: assigning a public control vector for said public key in said data processing system, for defining permitted uses for said public key; forming a public key record which includes said public key in said data processing system, and encrypting said public key record under a second master key expression which is a function of said public control vector; forming a public key token which includes said public control vector and said public key record and storing said public key token in said data processing system; receiving a second key use request in said data processing system, requiring execution of said public key algorithm with a public key; accessing said public key token in said data processing system and checking said public control vector to determine if said public key record contains a key having permitted uses which will satisfy said second request; decrypting said public key record under said second master key expression in said data processing system and extracting said public key from said public key record; executing said public key algorithm in said data processing system using said public key to perform a cryptographic operation to satisfy said second key use request.
Claim 13
Dependent Claim
47 words
The method of claim 11 or 12, which further comprises: forming a first private key authentication record in said data processing system, by computing a hash value using a hashing function on said private key record; said private key token including said first private key authentication record.
Claim 14
Dependent Claim
92 words
The method of claim 13, which further comprises: after said decryption step for said private key record, computing a second private key authentication record in said data processing system, by computing a second hash value using said hashing function on said decrypted private key record and comparing said second a private key authentication record with said first private key authentication record; aborting further processing of said first key use request in said data processing system, if said second private key authentication record is not equal to said first private key authentication record.
Claim 15
Dependent Claim
45 words
The method of claim 14, which further comprises: forming a second public key authentication record in said data processing system, by computing a hash value using said hashing function on said public key record; said public key token including said second public key authentication record.
Claim 16
Dependent Claim
92 words
The method of claim 15, which further comprises: after said decrypting step for said public key record, computing a second public key authentication record in said data processing system, by computing a second hash value using said hashing function on said decrypted public key record and comparing said second a public key authentication record with said second public key authentication record; aborting further processing of said second key use request in said data processing system, if said second public key authentication record is not equal to said second public key authentication record.
Claim 17
Dependent Claim
249 words
In a data processing system, a method for managing a public key cryptographic system, comprising the steps of: generating a public key and a private key in said cryptographic system; assigning a public key control vector to said public key in accordance with intended uses for said public key; assigning a private key control vector to said private key in accordance with intended uses for said private key; storing said public key in a public key record and storing said private key in a private key record; encrypting said public key record under a master key and encrypting said private key under said master key; forming a modification detection code on a concatenated expression of said public key control vector and said public key record as a public key authentication record; forming a modification detection code on a concatenated expression of said private control vector and said private key record to produce a private key authentication record; encrypting said public key authentication record under said master key and encrypting said private key authentication record under said master key; forming a public key token which includes said public key control vector in a first field, said encrypted public key record in a second field, and said encrypted public key authentication record in a third field; forming a private key token including said private key control vector in a first field, said encrypted private key record in a second field, and said encrypted private key authentication record in a third field.
Claim 18
Dependent Claim
25 words
The method of claim 17 wherein said master key is a secret key, preferably a data encryption algorithm key belonging to a symmetric key algorithm.
Claim 19
Dependent Claim
308 words
In a data processing system, a computer program for managing a public key cryptographic system, which when executed on said data processing system, performs a method comprising the steps of: generating a first public key and a first private key as a first pair in said data processing system, for use with a first public key algorithm; generating a second public key and a second private key as a second pair in said data processing system, for use with a second public key algorithm; assigning a private control vector for said first private key and said second private key in said data processing system, for defining permitted uses for said first and second private keys; forming a private key record which includes said first private key and said second private key in said data processing system, and encrypting said private key record under a first master key expression which is a function of said private control vector; forming a private key token which includes said private control vector and said private key record, and storing said private key token in said data processing system; receiving a first key use request in said data processing system, requiring said first public key algorithm; accessing said private key token in said data processing system and checking said private control vector to determine if said private key record contains a key having permitted uses which will satisfy said first request; decrypting said private key record under said first master key expression in said data processing system and extracting said first private key from said private key record; selecting said first public key algorithm in said data processing system for said first key use request; executing said first public key algorithm in said data processing system using said first private key to perform a cryptographic operation to satisfy said first key use request.
Claim 20
Dependent Claim
51 words
The computer program of claim 19, which further comprises: said private key record including first parse data to locate said first private key and said second private key in said key record; said extracting step including using said parse data for extracting said first private key from said private key record.
Claim 21
Dependent Claim
81 words
The computer program of claim 19 or 20, which when executed on said data processing system, performs the further steps, comprising: forming a first private key authentication record in said data processing system, by computing a hash value using a hashing function on said private key record and encrypting said first private key authentication record under a second master key expression which is a function of said private control vector; said private key token including said first private key authentication record.
Claim 22
Dependent Claim
98 words
The computer program of claim 21, which when executed on said data processing system, performs the further steps, comprising: after said decrypting step, computing a second private key authentication record in said data processing system, by computing a second hash value using said hashing function on said decrypted private key record and comparing said second a private key authentication record with said first private key authentication record; aborting further processing of said first key use request in said data processing system, if said second private key authentication record is not equal to said first private key authentication record.
Claim 23
Dependent Claim
56 words
The computer program of claim 22, which further comprises: said private key token including first header data to locate said control vector, said private key record and said private key authentication record in said private key token; said accessing step including using said header data to locate said private key record in said private key token.
Claim 24
Dependent Claim
248 words
In a data processing system, a computer program for managing a public key cryptographic system, which when executed on said data processing system, performs a method comprising the steps of: generating a public key and a private key as a pair in said data processing system, for use with a public key algorithm; assigning a private control vector for said private key in said data processing system, for defining permitted uses for said private key; forming a private key record which includes said private key in said data processing system, and encrypting said private key record under a first master key expression which is a function of said private control vector; forming a private key token which includes said private control vector and said encrypted private key record and storing said private key token in said data processing system; receiving a first key use request in said data processing system, requiring execution of said public key algorithm with a private key; accessing said private key token in said data processing system and checking said private control vector to determine if said private key record contains a key having permitted uses which will satisfy said first request; decrypting said private key record under said first master key expression in said data processing system and extracting said private key from said private key record; executing said public key algorithm in said data processing system using said private key to perform a cryptographic operation to satisfy said first key use request.
Claim 25
Dependent Claim
213 words
The computer program of claim 24, which when executed on said data processing system, performs the further steps, comprising: assigning a public control vector for said public key in said data processing system, for defining permitted uses for said public key; forming a public key record which includes said public key in said data processing system, and encrypting said public key record under a second master key expression which is a function of said public control vector; forming a public key token which includes said public control vector and said public key record and storing said public key token in said data processing system; receiving a second key use request in said data processing system, requiring execution of said public key algorithm with a public key; accessing said public key token in said data processing system and checking said public control vector to determine if said public key record contains a key having permitted uses which will satisfy said second request; decrypting said public key record under said second master key expression in said data processing system and extracting said public key from said public key record; executing said public key algorithm in said data processing system using said public key to perform a cryptographic operation to satisfy said second key use request.
Claim 26
Dependent Claim
58 words
The computer program of claim 24 or 25, which when executed on said data processing system, performs the further steps, comprising: forming a first private key authentication record in said data processing system, by computing a hash value using a hashing function on said private key record; said private key token including said first private key authentication record.
Claim 27
Dependent Claim
103 words
The computer program of claim 26, which when executed on said data processing system, performs the further steps, comprising: after said decryption step for said private key record, computing a second private key authentication record in said data processing system, by computing a second hash value using said hashing function on said decrypted private key record and comparing said second a private key authentication record with said first private key authentication record; aborting further processing of said first key use request in said data processing system, if said second private key authentication record is not equal to said first private key authentication record.
Claim 28
Dependent Claim
56 words
The computer program of claim 27, which when executed on said data processing system, performs the further steps, comprising: forming a second public key authentication record in said data processing system, by computing a hash value using said hashing function on said public key record; said public key token including said second public key authentication record.
Claim 29
Dependent Claim
103 words
The computer program of claim 28, which when executed on said data processing system, performs the further steps, comprising: after said decrypting step for said public key record, computing a second public key authentication record in said data processing system, by computing a second hash value using said hashing function on said decrypted public key record and comparing said second a public key authentication record with said second public key authentication record; aborting further processing of said second key use request in said data processing system, if said second public key authentication record is not equal to said second public key authentication record.
Claim 30
Dependent Claim
403 words
A data processing system for managing a public key cryptographic system, comprising: first generating means for generating a first public key and a first private key as a first pair in said data processing system, for use with a first public key algorithm; second generating means for generating a second public key and a second private key as a second pair in said data processing system, for use with a second public key algorithm; assigning means for assigning a private control vector for said first private key and said second private key in said data processing system, for defining permitted uses for said first and second private keys; key record forming means coupled to said first and second generating means, for forming a private key record which includes said first private key and said second private key in said data processing system, encrypting means coupled to said key record forming means and said assigning means, for encrypting said private key record under a first master key expression which is a function of said private control vector; key token forming means coupled to said assigning means and to said key record forming means, for forming a private key token which includes said private control vector and said private key record; storing means coupled to said key token forming means, for storing said private key token in said data processing system; receiving means coupled to a user input, for receiving a first key use request in said data processing system, requiring said first public key algorithm; accessing means coupled to said receiving means and to said storing means, for accessing said private key token in said data processing system and checking said private control vector to determine if said private key record contains a key having permitted uses which will satisfy said first request; decrypting means coupled to said accessing means, for decrypting said private key record under said first master key expression in said data processing system and extracting said first private key from said private key record; selecting means coupled to said receiving means, for selecting said first public key algorithm in said data processing system for said first key use request; execution means coupled to said selecting means and to said decrypting means, for executing said first public key algorithm in said data processing system using said first private key to perform a cryptographic operation to satisfy said first key use request.
Claim 31
Dependent Claim
80 words
The system of claim 30, which further comprises: authentication record forming means coupled to said key record forming means, for forming a first private key authentication record in said data processing system, by computing a hash value using a hashing function on said private key record and encrypting said first private key authentication record under a second master key expression which is a function of said private control vector; said private key token including said first private key authentication record.
Claim 32
Dependent Claim
101 words
The system of claim 30 or 31, which further comprises: computing means coupled to said decryption means, for computing a second private key authentication record in said data processing system, by computing a second hash value using said hashing function on said decrypted private key record and comparing said second a private key authentication record with said first private key authentication record; terminating means coupled to said computing means, for aborting further processing of said first key use request in said data processing system, if said second private key authentication record is not equal to said first private key authentication record.
References Cited (Backward Citations)
No citation records indexed.
USPTO Annuity & Maintenance Windows
Maintenance schedule is calculated for granted US utility patents.