US4924514A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Personal identification number processing using control vectors
Assignee: International Business Machines Corp
•
Filing: 1989-08-24
•
Granted: 1990-05-08
•
Expires: 2009-08-24
Abstract
Abstract Cryptographic PIN processing is achieved in an improved manner by associating control vectors with the PIN generating (verification) keys and PIN encrypting keys which provide authorization for the uses of the keys intended by the originator of the keys. The originator may be the local cryptographic facility (CF) and a utility program under the control of a security administrator, or the originator may be another network node which uses the key management methods described in the above-referenced copending patent applications to distribute said keys. Among the uses specified by the control vector are limitations on the authority to use the associated key with certain PIN processing instructions, such as PIN generation, verification, translation and PIN block creation. Furthermore, the control vector may limit the authority of certain instructions to process clear PIN inputs (such as in PIN verification). The control vector may contain information identifying and, possibly restricting, PIN processing to a particular PIN format or particular processing algorithm. The control vector implementation provides a flexible method for coupling format, usage, and processing authorization to keys. The system administrator can exercise flexibility in changing the implementation of his security policy by selecting appropriate control vectors in accordance with the invention. Furthermore, a method is provided for the security administrator to restrict certain PIN format translations.
Inventors
- 👤 Stephen M. Matyas
- 👤 Dennis G. Abraham
- 👤 Donald B. Johnson
- 👤 Ramesh K. Karne
- 👤 An V. Le
- 👤 Rostislaw Prymak
- 👤 Julian Thomas
- 👤 John D. Wilkins
- 👤 Phil C. Yeh
- 👤 Ronald M. Smith
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-29 16:18
CPC Classifications
G; G06; G06F; G06F9/00; G06F9/06; G06F9/30; G06F9/30003; G06F9/30007; G06F9/30018; G06Q; G06Q20/00; G06Q20/38; G06Q20/382; G06Q20/3829; G06Q20/40; G06Q20/401; G06Q20/4012; G07; G07F; G07F7/00; G07F7/08; G07F7/10; G07F7/1016; H; H04; H04L; H04L9/00; H04L9/08; H04L9/0816; H04L9/0819; H04L9/0822; H04L9/088; H04L9/0894; H04L9/32; H04L9/3226; H04L9/3271; H04L2209/00; H04L2209/56
Claims Analysis
Total Claims: 53
Claim 1
Independent Claim
277 words
In a data processing system which outputs cryptographic service requests for management of cryptographic keys which are associated with control vectors defining the functions which each key is allowed by its originator to perform, an apparatus for validating that PIN processing functions requested for a cryptographic key have been authorized by the originator of the key, comprising: a cryptographic instruction storage coupled to an input path; a cryptographic facility characterized by a secure boundary through which passes said input path for receiving said cryptographic service requests, cryptographic keys and their associated control vectors, and an output path for providing responses thereto, there being included within said boundary a control vector checking means and a cryptographic processing means coupled to said instruction storage, and a master key storage coupled to said processing means, for providing a secure location for executing PIN processing functions in response to said received service requests; said cryptographic instruction storage receiving over said input path a cryptographic service request for performing a PIN processing function with a cryptographic key; said control vector checking means having an input coupled to said input path for receiving a control vector associated with said cryptographic key and an input connected to said cryptographic instruction storage, for receiving control signals to initiate checking that said control vector authorizes the PIN processing function which is requested by said cryptographic service request; said control vector checking means having an authorization output coupled to an input of said cryptographic processing means, for signalling that said PIN processing function is authorized, the receipt of which by said cryptographic processing means initiates the performance of the requested PIN processing function with said cryptographic key.
Claim 2
Dependent Claim
277 words
In a data processing system which outputs cryptographic service requests for management of cryptographic keys which are associated with control vectors defining the functions which each key is allowed by its originator to perform, an apparatus for validating that PIN processing functions requested for a cryptographic key have been authorized by the originator of the key, comprising: a cryptographic instruction storage coupled to an input path; a cryptographic facility characterized by a secure boundary through which passes said input path for receiving said cryptographic service requests, cryptographic keys and their associated control vectors, and an output path for providing responses thereto, there being included within said boundary a control vector checking means and a cryptographic processing means coupled to said instruction storage, and a master key storage coupled to said processing means, for providing a secure location for executing PIN processing functions in response to said received service requests; said cryptographic instruction storage receiving over said input path a cryptographic service request for performing a PIN processing function with a cryptographic key; said control vector checking means having an input coupled to said input path for receiving a control vector associated with said cryptographic key and an input connected to said cryptographic instruction storage, for receiving control signals to initiate checking that said control vector authorizes the PIN processing function which is requested by said cryptographic service request; said control vector checking means having an authorization output coupled to an input of said cryptographic processing means, for signalling that said PIN processing function is authorized, the receipt of which by said cryptographic processing means initiates the performance of the requested PIN processing function with said cryptographic key.
Claim 3
Dependent Claim
64 words
The apparatus of claim 1, which further comprises: a cryptographic key storage means coupled to said cryptographic facility over said input and output paths, for storing said cryptographic key in an encrypted form in which said cryptographic key is encrypted under a storage key which is a logical product of said associated control vector and a master key stored in said master key storage.
Claim 4
Dependent Claim
37 words
The apparatus of claim 1, wherein said PIN processing is achieved by associating said control vector with a PIN generating key, to provide authorization for the use of the key intended by the originator of the key.
Claim 5
Dependent Claim
39 words
The apparatus of claim 1, which further comprises said PIN processing being achieved by associating control vectors with PIN verification keys, said control vectors providing authorization for the uses of the keys intended by the originators of the keys.
Claim 6
Dependent Claim
39 words
The apparatus of claim 1, which further comprises said PIN processing being achieved by associating control vectors with PIN encrypting keys, said control vectors providing authorization for the uses of the keys intended by the originator of the keys.
Claim 7
Dependent Claim
24 words
The apparatus of claim 1, wherein said control vector specifies limitations on the authority to use the associated key with certain PIN processing instructions.
Claim 8
Dependent Claim
23 words
The apparatus of claim 1, wherein said control vector places limitations on the authority to use the associated key for PIN generation functions.
Claim 9
Dependent Claim
25 words
The apparatus of claim 1, which further comprises said control vector placing limitations on the authority to use the associated key in PIN verification functions.
Claim 10
Dependent Claim
23 words
The apparatus of claim 1, wherein said control vector places limitations on the authority to use the associated key in PIN translation functions.
Claim 11
Dependent Claim
24 words
The apparatus of claim 1, wherein said control vector places limitations on the authority to use the associated key in PIN block creation functions.
Claim 12
Dependent Claim
24 words
The apparatus of claim 1, wherein said control vector places limitations on the authority to use the associated key to process clear PIN inputs.
Claim 13
Dependent Claim
28 words
The apparatus of claim 1, wherein said control vector places limitations on the authority to use the associated key for PIN processing functions having a particular PIN format.
Claim 14
Dependent Claim
33 words
The apparatus of claim 1, which further comprises a working key storage within said cryptographic facility coupled to said cryptographic processing means, for providing a secure location for the storage of working keys.
Claim 15
Dependent Claim
27 words
The apparatus of claim 13, which further comprises: said working key storage storing a plurality of working keys and their associated control vectors in clear text form.
Claim 16
Dependent Claim
68 words
The apparatus of claim 14, which further comprises: said cryptographic facility receiving over said input path a cryptographic service request for performing PIN processing function; said control vector checking means checking the associated control vector accessed from said working key storage and outputting an authorization signal to said cryptographic processing means that said cryptographic service request is authorized using the respective key accessed from said working key storage.
Claim 17
Dependent Claim
30 words
The apparatus of claim 14, which further comprises: said working keys being stored in said working key storage as the exclusive-OR product of each key with its respective control vector.
Claim 18
Dependent Claim
96 words
The apparatus of claim 16, which further comprises: said cryptographic facility receiving over said input path a cryptographic service request for performing a PIN processing function and also receiving the corresponding associated control vector which undergoes control vector checking in said control vector checking means; said control vector checking means outputting an authorization signal to said cryptographic processing means that said cryptographic service request is authorized, said corresponding exclusive-OR product of the control vector and its respective key then being exclusive-ORed with said control vector in order to recover the key for the requested cryptographic operation.
Claim 19
Dependent Claim
116 words
The apparatus of claim 1, which further comprises: a working key storage within said cryptographic facility, for storing working keys in clear text form and for storing their respective associated control vectors; said cryptographic instruction storage receiving over said input path a cryptographic service request for performing a PIN processing function which includes accessing said cryptographic key and said associated control vector from said working key storage and said control vector checking means outputting in response thereto, an authorization signal to said cryptographic processing means that the requested PIN processing function is authorized; said cryptographic processing means operating in response to said authorization signal, to complete performing the requested PIN processing function with said cryptographic key.
Claim 20
Dependent Claim
154 words
The apparatus of claim 1, which further comprises: a working key storage within said cryptographic facility coupled to said cryptographic processing means, for storing the exclusive-OR product of working keys and their associated control vectors; said cryptographic instruction storage receiving over said input path a cryptographic service request and the corresponding associated control vector, for performing a PIN processing function; said control vector checking means checking said control vector and outputting in response thereto, an authorization signal to said cryptographic processing means that the requested PIN processing function is authorized; said cryptographic processing means operating in response to said authorization signal, to perform an exclusive-OR operation between said control vector and said product which has been accessed from said working key storage, yielding said working key in clear text form; said cryptographic processing means further operating in response to said authorization signal, to complete performing the requested PIN processing function with said cryptographic key.
Claim 21
Dependent Claim
145 words
In a data processing system which outputs cryptographic service requests for PIN processing using cryptographic keys which are associated with control vectors defining the functions which each key is allowed by its originator to perform, a method for validating that PIN processing functions requested for a cryptographic key have been authorized by the originator of the key, comprising the steps of: receiving a cryptographic service request for performing a PIN processing function on a cryptographic key in a cryptographic facility characterized by a secure boundary through which passes an input path and an output path; receiving a control vector associated with said cryptographic key and checking that said control vector authorizes the PIN processing function which is requested by said cryptographic service request; signalling that said PIN processing function is authorized and initiating the performance of the requested PIN processing function with said cryptographic key.
Claim 22
Dependent Claim
145 words
In a data processing system which outputs cryptographic service requests for PIN processing using cryptographic keys which are associated with control vectors defining the functions which each key is allowed by its originator to perform, a method for validating that PIN processing functions requested for a cryptographic key have been authorized by the originator of the key, comprising the steps of: receiving a cryptographic service request for performing a PIN processing function on a cryptographic key in a cryptographic facility characterized by a secure boundary through which passes an input path and an output path; receiving a control vector associated with said cryptographic key and checking that said control vector authorizes the PIN processing function which is requested by said cryptographic service request; signalling that said PIN processing function is authorized and initiating the performance of the requested PIN processing function with said cryptographic key.
Claim 23
Dependent Claim
48 words
The method of claim 20, which further comprises the steps of: storing in a storage means said cryptographic key in an encrypted form in which said cryptographic key is encrypted under a storage key which is a logical product of said associated control vector and a master key.
Claim 24
Dependent Claim
37 words
The method of claim 20, wherein said PIN processing is achieved by associating said control vector with a PIN generating key, to provide authorization for the use of the key intended by the originator of the key.
Claim 25
Dependent Claim
39 words
The method of claim 20, which further comprises said PIN processing being achieved by associating control vectors with PIN verification keys, said control vectors providing authorization for the uses of the keys intended by the originators of the keys.
Claim 26
Dependent Claim
39 words
The method of claim 20, which further comprises said PIN processing being achieved by associating control vectors with PIN encrypting keys, said control vectors providing authorization for the uses of the keys intended by the originator of the keys.
Claim 27
Dependent Claim
24 words
The method of claim 20, wherein said control vector specifies limitations on the authority to use the associated key with certain PIN processing instructions.
Claim 28
Dependent Claim
23 words
The method of claim 20, wherein said control vector places limitations on the authority to use the associated key for PIN generation functions.
Claim 29
Dependent Claim
25 words
The method of claim 20, which further comprises said control vector placing limitations on the authority to use the associated key in PIN verification functions.
Claim 30
Dependent Claim
23 words
The method of claim 20, wherein said control vector places limitations on the authority to use the associated key in PIN translation functions.
Claim 31
Dependent Claim
24 words
The method of claim 20, wherein said control vector places limitations on the authority to use the associated key in PIN block creation functions.
Claim 32
Dependent Claim
24 words
The method of claim 20, wherein said control vector places limitations on the authority to use the associated key to process clear PIN inputs.
Claim 33
Dependent Claim
28 words
The method of claim 20, wherein said control vector places limitations on the authority to use the associated key for PIN processing functions having a particular PIN format.
Claim 34
Dependent Claim
18 words
The method of claim 20, wherein said control vectors define node linkages to be allowed by said originator.
Claim 35
Dependent Claim
32 words
The method of claim 20, which further comprises: storing a plurality of working keys and their associated control vectors in clear text form in a working key storage within said cryptographic facility.
Claim 36
Dependent Claim
56 words
The method of claim 33, which further comprises: receiving over said input path a cryptographic service request for performing a PIN processing function; checking the associated control vector accessed from said working key storage and outputting an authorization signal that said cryptographic service request is authorized using the respective key accessed from said working key storage.
Claim 37
Dependent Claim
30 words
The method of claim 33, which further comprises: said working keys being stored in said working key storage as the exclusive-OR product of each key with its respective control vector.
Claim 38
Dependent Claim
77 words
The method of claim 35, which further comprises: receiving over said input path a cryptographic service request for performing a PIN processing function and also receiving the corresponding associated control vector which undergoes control vector checking; outputting an authorization signal that said cryptographic service request is authorized, said corresponding exclusive-or product of the control vector and its respective key then being exclusive-ORed with said control vector in order to recover the key for the requested cryptographic operation.
Claim 39
Dependent Claim
94 words
The method of claim 20, which further comprises: storing working keys in clear text form and storing their respective associated control vectors in a working key storage within said cryptographic facility; receiving over said input path a cryptographic service request for performing a PIN processing function which includes accessing said cryptographic key and said associated control vector from said working key storage and outputting in response thereto, an authorization signal that the requested PIN processing function is authorized; performing the requested PIN processing function with said cryptographic key in response to said authorization signal.
Claim 40
Dependent Claim
126 words
The method of claim 20, which further comprises: storing the exclusive-OR product of working keys and their associated control vectors in a working key storage within said cryptographic facility; receiving over said input path a cryptographic service request and the corresponding associated control vector, for performing a PIN processing function; checking said control vector and outputting in response thereto, an authorization signal that the requested PIN processing function is authorized; operating in response to said authorization signal, to perform an exclusive-OR operation between said control vector and said product which has been accessed from said working key storage, yielding said working key in clear text form; further operating in response to said authorization signal, to complete performing the requested PIN processing function with said cryptographic key.
Claim 41
Dependent Claim
23 words
The method of claim 20, wherein said control vector selectively limits the authority of said PIN processing function to process clear PIN inputs.
Claim 42
Dependent Claim
24 words
The method of claim 20, wherein said control vector selectively limits the authority of said PIN processing function to process a predetermined PIN format.
Claim 43
Dependent Claim
25 words
The method of claim 20, wherein said control vector selectively limits the authority of said PIN processing function to use as a predetermined processing algorithm.
Claim 44
Dependent Claim
26 words
The method of claim 20, wherein said control vector selectively limits the authority of said PIN processing function to use said cryptographic key in PIN generation.
Claim 45
Dependent Claim
26 words
The method of claim 20, wherein said control vector selectively limits the authority of said PIN processing function to use said cryptographic key in PIN verification.
Claim 46
Dependent Claim
26 words
The method of claim 20, wherein said control vector selectively limits the authority of said PIN processing function to use said cryptographic key in PIN translation.
Claim 47
Dependent Claim
26 words
The method of claim 20, wherein said control vector selectively limits the authority of said PIN processing function to use cryptographic key in PIN block creation.
Claim 48
Dependent Claim
34 words
The apparatus of claim 14, which further comprises: said working keys being stored in said working key storage as a product of a combining function F of each key with its respective control vector.
Claim 49
Dependent Claim
103 words
The apparatus of claim 46, which further comprises: said cryptographic facility receiving over said input path a cryptographic service request for performing a PIN processing function and also receiving the corresponding associated control vector which undergoes control vector checking in said control vector checking means; said control vector checking means outputting an authorization signal to said cryptographic processing means that said cryptographic service request is authorized, said corresponding product of the control vector and its respective key then being operated upon by an inverse combining function F -1 with said control vector in order to recover the key for the requested cryptographic operation.
Claim 50
Dependent Claim
164 words
The apparatus of claim 1, which further comprises: a working key storage within said cryptographic facility coupled to said cryptographic processing means, for storing a product of a combining function F of working keys and their associated control vectors; said cryptographic instruction storage receiving over said input path a cryptographic service request and the corresponding associated control vector, for performing a PIN processing function; said control vector checking means checking said control vector and outputting in response thereto, an authorization signal to said cryptographic processing means that the requested PIN processing function is authorized; said cryptographic processing means operating in response to said authorization signal, to perform an operation with an inverse combining function F -1 between said control vector and said product which has been accessed from said working key storage, yielding said working key in clear text form; said cryptographic processing means further operating in response to said authorization signal, to complete performing the requested PIN processing function with said cryptographic key.
Claim 51
Dependent Claim
40 words
The method of claim 20, which further comprises: storing a plurality of working keys and their associated control vectors in a working key storage as a product of each key and its respective control vector, using a combining function F.
Claim 52
Dependent Claim
84 words
The method of claim 49, which further comprises: receiving over said input path a cryptographic service request for performing a PIN processing function and also receiving the corresponding associated control vector which undergoes control vector checking; outputting an authorization signal that said cryptographic service request is authorized, said corresponding product of the control vector and its respective key then being operated upon by an inverse combining function F -1 with said control vector in order to recover the key for the requested cryptographic operation.
Claim 53
Dependent Claim
136 words
The method of claim 20, which further comprises: storing a product of a combining function F of working keys and their associated control vectors in a working key storage within said cryptographic facility; receiving over said input path a cryptographic service request and the corresponding associated control vector, for performing a PIN processing function; checking said control vector and outputting in response thereto, an authorization signal that the requested PIN processing function is authorized; operating in response to said authorization signal, to perform an operation with an inverse combining function F -1 between said control vector and said product which has been accessed from said working key storage, yielding said working key in clear text form; further operating in response to said authorization signal, to complete performing the requested PIN processing function with said cryptographic key.
References Cited (Backward Citations)
US4227253A
Cited
US4218738A
Cited
US4223403A
Cited
US4386233A
Cited
US4578530A
Cited
US4503287A
Cited
US4500750A
Cited
US4723284A
Cited
US4633037A
Cited
US4747050A
Cited
US4755940A
Cited
US4713753A
Cited
US4723283A
Cited
US4683968A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1993-05-07 | 1993-11-06 | 1994-05-08 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 1997-05-07 | 1997-11-06 | 1998-05-08 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2001-05-07 | 2001-11-06 | 2002-05-08 | $7700.00 | Window Closed / Lapsed |