US4924515A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Secure management of keys using extended control vectors
Assignee: International Business Machines Corp
•
Filing: 1989-08-24
•
Granted: 1990-05-08
•
Expires: 2009-08-24
Abstract
Abstract A method and apparatus are disclosed for use in a data processing system which executes a program which outputs cryptographic service requests for operations with cryptographic keys which are associated with control vectors defining the functions which each key is allowed by its originator to perform. The improved method and apparatus enable the use of control vectors having an arbitrary length. It includes a control vector register having an arbitrary length, for storing a control vector of arbitrary length associated with an N-bit cryptographic key. It further includes a control vector checking means having an input coupled to the control vector register, for checking that the control vector authorizes the cryptographic function which is requested by the cryptographic service request. It further includes a hash function generator having an input coupled to the control vector register and an N-bit output, for mapping the control vector output from the control vector register, into an N-bit hash value. A key register is included for storing the N-bit cryptographic key. It further includes a logic block having a first input coupled to the N-bit output of the hash function generator, and a second input connected to the key register, for forming at the output thereof a product of the N-bit key and the N-bit hash value. Finally, an encryption device is included having a first input for receiving a cleartext data stream and a key input coupled to the output of the logic block, for forming a ciphertext data stream at the output thereof from the cleartext data stream and the product. A decryption device can be substituted for the encryption device to perform decryption operations in a similar manner.
Inventors
- 👤 Stephen M. Matyas
- 👤 Dennis G. Abraham
- 👤 William C. Arnold
- 👤 Donald B. Johnson
- 👤 Ramesh K. Karne
- 👤 An V. Le
- 👤 Rostislaw Prymak
- 👤 Steve R. White
- 👤 John D. Wilkins
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-06 01:41
CPC Classifications
H; H04; H04L; H04L9/00; H04L9/08; H04L9/088; H04L9/06; H04L9/0643; H04L2209/00; H04L2209/12
Claims Analysis
Total Claims: 45
Claim 1
Independent Claim
286 words
In a data processing system which outputs cryptographic service requests for operations with cryptographic keys which are associated with control vectors defining the functions which each key is allowed by its originator to perform, an improved apparatus to enable the use of control vectors having a given length, comprising: a control vector input for receiving a control vector of a given length associated with an N-bit cryptographic key; a control vector checking means having an input coupled to said control vector input and input for receiving a cryptographic service request, for checking that said control vector authorizes the cryptographic function which is requested by said cryptographic service request, and outputting an enable signal; a hash function generator having an input coupled to said control vector input and an N-bit output, for mapping said control vector into an N-bit hash value; a key input for receiving said N-bit cryptographic key; a logic block having a first input coupled to said N-bit output of said hash function generator, and a second input coupled to said key input, for forming at the output thereof a computed key value which is a product of said N-bit key and said N-bit hash value; a cryptographic transformation device having a first input for receiving input information and a key value input coupled to the output of said logic block, for forming output information which has been cryptographically transformed from said input information using said computed key value; said cryptographic transformation device coupled to said enable signal output from said control vector checking means for inhibiting said formation of said cryptographically transformed output information if said control vector checking means determines that said requested cryptographic function is not authorized by said control vector.
Claim 2
Dependent Claim
286 words
In a data processing system which outputs cryptographic service requests for operations with cryptographic keys which are associated with control vectors defining the functions which each key is allowed by its originator to perform, an improved apparatus to enable the use of control vectors having a given length, comprising: a control vector input for receiving a control vector of a given length associated with an N-bit cryptographic key; a control vector checking means having an input coupled to said control vector input and input for receiving a cryptographic service request, for checking that said control vector authorizes the cryptographic function which is requested by said cryptographic service request, and outputting an enable signal; a hash function generator having an input coupled to said control vector input and an N-bit output, for mapping said control vector into an N-bit hash value; a key input for receiving said N-bit cryptographic key; a logic block having a first input coupled to said N-bit output of said hash function generator, and a second input coupled to said key input, for forming at the output thereof a computed key value which is a product of said N-bit key and said N-bit hash value; a cryptographic transformation device having a first input for receiving input information and a key value input coupled to the output of said logic block, for forming output information which has been cryptographically transformed from said input information using said computed key value; said cryptographic transformation device coupled to said enable signal output from said control vector checking means for inhibiting said formation of said cryptographically transformed output information if said control vector checking means determines that said requested cryptographic function is not authorized by said control vector.
Claim 3
Dependent Claim
15 words
The apparatus of claim 1, wherein said control vector has a length greater than N-bits.
Claim 4
Dependent Claim
16 words
The apparatus of claim 1, wherein said control vector has a length equal to 2 N-bits.
Claim 5
Dependent Claim
22 words
The apparatus of claim 1, wherein said control vector has fields at predetermined locations having bit values therein with a predefined meaning.
Claim 6
Dependent Claim
26 words
The apparatus of claim 1, wherein said control vector has a tag definition field which selectively determines the meaning of other fields in said control vector.
Claim 7
Dependent Claim
33 words
The apparatus of claim 1, wherein said control vector has fields which determine periods during which said N-bit cryptographic key associated therewith can be used and which exclude such use at other times.
Claim 8
Dependent Claim
28 words
The apparatus of claim 1, wherein said control vector has fields which represent a user password which prevents unauthorized users from using said N-bit cryptographic key associated therewith.
Claim 9
Dependent Claim
42 words
The apparatus of claim 1, wherein said control vector includes fields uniquely representing its length-class, to prevent an N-bit hash value formed by said hash function generator from equalling an N-bit hash value for a second control vector having a different length-class.
Claim 10
Dependent Claim
20 words
The apparatus of claim 1, wherein said control vector has a field which specifies selected lengths of associated fields therein.
Claim 11
Dependent Claim
20 words
The apparatus of claim 1, wherein said control vector has a length determined by the location of delimiter fields therein.
Claim 12
Dependent Claim
18 words
The apparatus of claim 1, wherein said control vector has a length determined by a tag field therein.
Claim 13
Dependent Claim
45 words
The apparatus of claim 1, which further comprises: a password input; said control vector having a vacant field reserved for a password received from said password input; said control vector, with said password inserted in said vacant field, being input to said hash function generator.
Claim 14
Dependent Claim
18 words
The apparatus of claim 12, wherein said vacant field of said control vector occupies a fixed position therein.
Claim 15
Dependent Claim
24 words
The apparatus of claim 12, wherein: said vacant field of said control vector is identified by an associated field descriptor in said control vector.
Claim 16
Dependent Claim
27 words
The apparatus of claim 14, wherein said vacant field of said control vector has a selectable length identified by an associated length field in said control vector.
Claim 17
Dependent Claim
25 words
The apparatus of claim 14, wherein said vacant field of said control vector has a length terminated by a delimiter character in said control vector.
Claim 18
Dependent Claim
92 words
The apparatus of claim 1, which further comprises: a real-time clock coupled to said control vector checking unit, for providing a time value; said control vector having a field specifying a time interval, during which said N-bit cryptographic key associated therewith can be used; said control vector checking means accessing said time value from said real-time clock and checking whether said time value is within said time interval specified by said control vector and inhibiting said outputting of said enabling signal therefrom if said time value is not within said time interval.
Claim 19
Dependent Claim
28 words
The apparatus of claim 17, wherein said control vector specifies a time interval during which said associated N-bit cryptographic key can be used with a specified cryptographic instruction.
Claim 20
Dependent Claim
49 words
The apparatus of claim 18, wherein said control vector contains a first time interval during which said cryptographic key can be used with a first cryptographic instruction and said control vector contains a second time interval during which said cryptographic key can be used with a second cryptographic instruction.
Claim 21
Dependent Claim
29 words
The apparatus of claim 17, wherein said control vector specifies a time interval during which said associated N-bit cryptographic key can be used with a specified data processing system.
Claim 22
Dependent Claim
51 words
The apparatus of claim 20, wherein said control vector contains a first-time interval during which said cryptographic key can be used with a first specified data processing system and said control vector contains a second time interval during which said cryptographic key can be used with a second data processing system.
Claim 23
Dependent Claim
27 words
The apparatus of claim 17, wherein said control vector specifies a time interval during which said associated N-bit cryptographic key can be used by a specified user.
Claim 24
Dependent Claim
45 words
The apparatus of claim 22, wherein said control vector contains a first-time interval during which said cryptographic key can be used by a first user and said control vector contains a second-time interval during which said cryptographic key can be used by a second user.
Claim 25
Dependent Claim
24 words
The apparatus of claim 17, wherein said control vector specifies a plurality of time intervals during which said associated cryptographic key can be used.
Claim 26
Dependent Claim
34 words
The apparatus of claim 17, wherein said control vector contains a time interval specified by a start date and start time of day and by a stop date and a stop time of day.
Claim 27
Dependent Claim
23 words
The apparatus of claim 17, wherein said control vector contains a time interval field which occupies a fixed position in said control vector.
Claim 28
Dependent Claim
26 words
The apparatus of claim 17, wherein said control vector contains a time interval field which is identified by an associated tag field in said control vector.
Claim 29
Dependent Claim
20 words
The apparatus of claim 1, wherein said hash function generator performs a one-way public hash function on said control vector.
Claim 30
Dependent Claim
22 words
The apparatus of claim 1, wherein said logic block performs an exclusive-OR function between said N-bit key and said N-bit hash value.
Claim 31
Dependent Claim
14 words
The apparatus of claim 1, wherein said cryptographic transformation device is an encryption device.
Claim 32
Dependent Claim
14 words
The apparatus of claim 1, wherein said cryptographic transformation device is a decryption device.
Claim 33
Dependent Claim
19 words
The apparatus of claim 1, wherein said apparatus is contained within a cryptographic facility characterized by a secure boundary.
Claim 34
Dependent Claim
256 words
In a data processing system which outputs cryptographic service requests for operations with cryptographic keys which are associated with control vectors defining the functions which each key is allowed by its originator to perform, an improved apparatus to enable the use of control vectors having a length of 2N-bits comprising: a control vector input for receiving a control vector of 2N-bits in length, associated with a 2N-bit length cryptographic key; said control vector having a left portion CL of N-bits in length and a right portion CR of N-bits in length; said cryptographic key having a left portion KKL of N-bits in length and a right portion KKR of N-bits in length; a first exclusive-OR logic block coupled to receive CL and KKL to form the exclusive-OR product KKL+CL as a first key value; a second exclusive-OR logic block coupled to receive CR and KKR and to form the exclusive-OR product KKR+CR as a second key value; a first encryption device having a cleartext input and a key input coupled to receive said first key value and having an output; a first decryption device having an input connected to an output of said first encryption device and a key input coupled to receive said second key value, and an output; a second encryption device having an input connected to the output of said decryption device and a key input coupled to receive said first key value, and an output for producing a ciphertext which is a transformation of the cleartext input to said first encryption device.
Claim 35
Dependent Claim
256 words
In a data processing system which outputs cryptographic service requests for operations with cryptographic keys which are associated with control vectors defining the functions which each key is allowed by its originator to perform, an improved apparatus to enable the use of control vectors having a length of 2N-bits comprising: a control vector input for receiving a control vector of 2N-bits in length, associated with a 2N-bit length cryptographic key; said control vector having a left portion CL of N-bits in length and a right portion CR of N-bits in length; said cryptographic key having a left portion KKL of N-bits in length and a right portion KKR of N-bits in length; a first exclusive-OR logic block coupled to receive CL and KKL to form the exclusive-OR product KKL+CL as a first key value; a second exclusive-OR logic block coupled to receive CR and KKR and to form the exclusive-OR product KKR+CR as a second key value; a first encryption device having a cleartext input and a key input coupled to receive said first key value and having an output; a first decryption device having an input connected to an output of said first encryption device and a key input coupled to receive said second key value, and an output; a second encryption device having an input connected to the output of said decryption device and a key input coupled to receive said first key value, and an output for producing a ciphertext which is a transformation of the cleartext input to said first encryption device.
Claim 36
Dependent Claim
297 words
In a data processing system which outputs cryptographic service requests for operations with cryptographic keys which are associated with control vectors defining the functions which each key is allowed by its originator to perform, an improved apparatus to enable the use of control vectors having 2N-bits length, comprising: a control vector input for receiving a control vector having 2N-bits length associated with a 2N-bit cryptographic key; a control vector checking means having an input coupled to said control vector input and an input for receiving a cryptographic service request for checking that said control vector authorizes the cryptographic function which is requested by said cryptographic service request, and outputting an enable signal; said control vector having a left portion CL of N-bits in length and a right portion CR of N-bits in length; said cryptographic key having a left portion KKL of N-bits in length and a right portion KKR of N-bits in length; a first exclusive-OR logic block which is coupled to receive CL and KKL and to produce the exclusive-OR product KKL+CL which is a first key value; a second exclusive-OR logic block which is coupled to receive CR and KKR and to produce the exclusive-OR product KKR+CR which is a second key value; a first decryption device having an input for receiving ciphertext, a key input coupled to receive said first key value and an output; an encryption device having an input connected to the output of said first decryption device, a key input coupled to receive said second key value, and an output; a second decryption device having an input connected to said output of said encryption device, a key input coupled to receive said first key value, and an output for producing cleartext from said ciphertext input to said first decryption device.
Claim 37
Dependent Claim
297 words
In a data processing system which outputs cryptographic service requests for operations with cryptographic keys which are associated with control vectors defining the functions which each key is allowed by its originator to perform, an improved apparatus to enable the use of control vectors having 2N-bits length, comprising: a control vector input for receiving a control vector having 2N-bits length associated with a 2N-bit cryptographic key; a control vector checking means having an input coupled to said control vector input and an input for receiving a cryptographic service request for checking that said control vector authorizes the cryptographic function which is requested by said cryptographic service request, and outputting an enable signal; said control vector having a left portion CL of N-bits in length and a right portion CR of N-bits in length; said cryptographic key having a left portion KKL of N-bits in length and a right portion KKR of N-bits in length; a first exclusive-OR logic block which is coupled to receive CL and KKL and to produce the exclusive-OR product KKL+CL which is a first key value; a second exclusive-OR logic block which is coupled to receive CR and KKR and to produce the exclusive-OR product KKR+CR which is a second key value; a first decryption device having an input for receiving ciphertext, a key input coupled to receive said first key value and an output; an encryption device having an input connected to the output of said first decryption device, a key input coupled to receive said second key value, and an output; a second decryption device having an input connected to said output of said encryption device, a key input coupled to receive said first key value, and an output for producing cleartext from said ciphertext input to said first decryption device.
Claim 38
Dependent Claim
150 words
In a data processing system which outputs cryptographic service requests for operations with cryptographic keys which are associated with control vectors defining the functions which each key is allowed by its originator to perform, an improved method to enable the use of control vectors having a given length, comprising the steps of: receiving a control vector having a given length, associated with an N-bit cryptographic key; checking that said control vector authorizes the cryptographic function which is requested by a cryptographic service request; mapping said control vector into an N-bit hash value; forming a computed key value which is a product of said N-bit key and said N-bit hash value; cryptographically transforming input information using said computed key value, into output information; selectively inhibiting said formation of said cryptographically transformed output information if said control vector checking determines that said requested cryptographic function is not authorized by said control vector.
Claim 39
Dependent Claim
150 words
In a data processing system which outputs cryptographic service requests for operations with cryptographic keys which are associated with control vectors defining the functions which each key is allowed by its originator to perform, an improved method to enable the use of control vectors having a given length, comprising the steps of: receiving a control vector having a given length, associated with an N-bit cryptographic key; checking that said control vector authorizes the cryptographic function which is requested by a cryptographic service request; mapping said control vector into an N-bit hash value; forming a computed key value which is a product of said N-bit key and said N-bit hash value; cryptographically transforming input information using said computed key value, into output information; selectively inhibiting said formation of said cryptographically transformed output information if said control vector checking determines that said requested cryptographic function is not authorized by said control vector.
Claim 40
Dependent Claim
36 words
The method of claim 35 which further comprises the steps of: receiving a password; inserting said password in a vacant field of said control vector prior to mapping said control vector into said N-bit hash value.
Claim 41
Dependent Claim
49 words
The method of claim 35 which further comprises the steps of: checking whether a time-value is within a time interval specified by said control vector; inhibiting said formation of said cryptographically transformed output information if said time value is not within said time interval specified by said control vector.
Claim 42
Dependent Claim
27 words
The apparatus of claim 32, which further comprises: a working key storage within said cryptographic facility, for providing a secure location for the storage of working keys.
Claim 43
Dependent Claim
27 words
The apparatus of claim 38, which further comprises: said working key storage storing a plurality of working keys and their associated control vectors in clear text form.
Claim 44
Dependent Claim
35 words
The apparatus of claim 38, which further comprises: said working keys being stored in said working key storage as the exclusive-OR product of each key with its respective hash value of its associated control vector.
Claim 45
Dependent Claim
33 words
The apparatus of claim 1, wherein said N-bit cryptographic key is a one-half portion of a 2N-bit cryptographic key and said N-bit hash value is a one-half portion of a 2N-bit hash value.
References Cited (Backward Citations)
US4227253A
Cited
US4218738A
Cited
US4223403A
Cited
US4386623A
Cited
US4503287A
Cited
US4500750A
Cited
US4723284A
Cited
US4633037A
Cited
US4755940A
Cited
US4747050A
Cited
US4578536A
Cited
US4713753A
Cited
US4723283A
Cited
US4683968A
Cited
US4850017A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1993-05-07 | 1993-11-06 | 1994-05-08 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 1997-05-07 | 1997-11-06 | 1998-05-08 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2001-05-07 | 2001-11-06 | 2002-05-08 | $7700.00 | Window Closed / Lapsed |