US4933969A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Data authentication and protection system
Assignee: HP Inc
•
Filing: 1988-03-01
•
Granted: 1990-06-12
•
Expires: 2008-03-01
Abstract
Abstract A secure information storage system in which a directory stores identifying titles and pointers to areas of a memory storing respective messages. To protect the messages against unauthorized changes, a MAC (message authentication code) is calculated for them in known manner and stored in a register in a secure unit. This involves processing the whole of each message every time the MAC is checked or, if a message has been changed, a fresh MAC has to be calculated. To avoid this, a separate MAC is calculated for each message and stored in the directory, and a global MAC is calculated for the individual MAC's (treating them as if they were a message) and stored in a secure register. To check a stored message, the global MAC is recalculated (thus verifying the MAC of the message), and the MAC of the message is recalculated (thus verifying the message). If the message is changed, its new MAC and a new global MAC are calculated. The system can be extended to a hierarchy of sub-global MAC's.
Inventors
- 👤 Alan D. Marshall
- 👤 Christopher J. Mitchell
- 👤 Graeme J. Proudler
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-24 21:43
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/64; G06F21/70; G06F21/71; G06F21/72; G06F21/78; G06F21/79; H; H04; H04L; H04L9/00; H04L9/08; H04L9/0816; H04L9/0819; H04L9/083; H04L9/0833; H04L9/0836; H04L9/0891; H04L9/32; H04L9/3236; H04L9/3242; G06F2221/00; G06F2221/21; G06F2221/2153; H04L2209/00; H04L2209/60
Claims Analysis
Total Claims: 22
Claim 1
Independent Claim
54 words
A data authentication system comprising: means for storing a body of data which consists of a plurality of individual messages; and means, responsive to the plurality of messages in the means for storing, or producing an individual message authentication code (MAC) for each message and for producing a global MAC from the individual MACs.
Claim 2
Dependent Claim
54 words
A data authentication system comprising: means for storing a body of data which consists of a plurality of individual messages; and means, responsive to the plurality of messages in the means for storing, or producing an individual message authentication code (MAC) for each message and for producing a global MAC from the individual MACs.
Claim 3
Dependent Claim
62 words
A data authentication system according to claim 1, further comprising means for comparing a previously created global MAC with a newly created global MAC to produce a global authentication signal indication whether the MACs are identical, an affirmative indication of such identity serving to indicate that the body of data has not been altered and thereby to authenticate the body of data.
Claim 4
Dependent Claim
77 words
A data authentication system according to claim 2, further comprising means, operative if the authentication signal does not indicate identity between the global MACs, for comparing a previously created individual MAC which corresponds with a given individual message with the newly created individual MAC which corresponds with said message to determine whether they are identical, an affirmative indication of such identity serving to indicate that said message has not been altered and thereby to authenticate said message.
Claim 5
Dependent Claim
53 words
A data authentication system according to claim 1 wherein: the individual messages are grouped into blocks; the means for producing a MAC is operative to produce a block MAC for the individual MACs of the messages in a block; and the global MAC is produced in from block MACs of all the blocks.
Claim 6
Dependent Claim
31 words
A data authentication system according to claim 1, further comprising means for storing a plurality of keys in a security module, one of which keys is used for producing the MACs.
Claim 7
Dependent Claim
34 words
A data authentication system according to claim 5, further comprising means responsive to the key used for producing the MACs for encrypting a message prior to storage and for decrypting the message upon retrieval.
Claim 8
Dependent Claim
114 words
A data authentication system comprising: means for storing a body of data which consists of a plurality of individual messages; means, responsive to the plurality of messages in the storage means, for producing an individual message authentication code (MAC) for each message and for producing a global MAC from the individual MACs; means for storing a plurality of keys in a security module, one of which keys is used for producing the MACs; and means for producing a hierarchy of two or more keys, with the lowest key being produced randomly for each messages and stored in the message, and being combined with the next key up the hierarchy to yield an encryption key.
Claim 9
Dependent Claim
114 words
A data authentication system comprising: means for storing a body of data which consists of a plurality of individual messages; means, responsive to the plurality of messages in the storage means, for producing an individual message authentication code (MAC) for each message and for producing a global MAC from the individual MACs; means for storing a plurality of keys in a security module, one of which keys is used for producing the MACs; and means for producing a hierarchy of two or more keys, with the lowest key being produced randomly for each messages and stored in the message, and being combined with the next key up the hierarchy to yield an encryption key.
Claim 10
Dependent Claim
53 words
A data authentication system according to claim 7 wherein the hierarchy of keys has more than two levels and a key of any level up to but not including the highest is appended to the body of a message under encryption by means of a key of the next level up the hierarchy.
Claim 11
Dependent Claim
91 words
A data authentication system according to claim 8, further comprising: means for receiving and storing an encrypted message from a terminal remote from the system; means for appending to the message a key of any level up to but not including the highest used for encrypting the message at the remote terminal under encryption by means of a key of the next level up the hierarchy; and means for calculating an individual MAC corresponding with the message and any appendices and including that MAC in the calculation of the global MAC.
Claim 12
Dependent Claim
52 words
A data authentication system according to claim 7, wherein the means for producing a hierarchy of two or more keys comprises: means for counting the number of times each key is used; and means responsive to the means for counting for changing a key when its usage count reaches a predetermined value.
Claim 13
Dependent Claim
99 words
A data authentication system comprising: means for storing a body of data including a plurality of individual messages; means for producing a unique message key for each message; means for producing a key having an hierarchical level above the message keys; means for combining a key having an hierarchical level above the message keys with a message key for one of the messages to produce an encryption key for said message; and means for encrypting a message, producing an individual message authentication code (MAC) for a message, and producing a global MAC from individual MACs for all the messages.
Claim 14
Dependent Claim
99 words
A data authentication system comprising: means for storing a body of data including a plurality of individual messages; means for producing a unique message key for each message; means for producing a key having an hierarchical level above the message keys; means for combining a key having an hierarchical level above the message keys with a message key for one of the messages to produce an encryption key for said message; and means for encrypting a message, producing an individual message authentication code (MAC) for a message, and producing a global MAC from individual MACs for all the messages.
Claim 15
Dependent Claim
21 words
A data authentication system according to claim 11 wherein the means for producing a message keys comprises a random number generator.
Claim 16
Dependent Claim
25 words
A data authentication system according to claim 11 and further comprising a security module for storing any keys an hierarchical level above the message keys.
Claim 17
Dependent Claim
51 words
A data authentication system according to claim 11 wherein the hierarchy of keys has more than two levels and a key of any level up to but not including the highest is encrypted by means of a key of the next level up the hierarchy and appended to an encrypted message.
Claim 18
Dependent Claim
53 words
A data authentication system according to claim 11 wherein the means for producing a key having a hierarchy above the message keys comprises a counter for counting the number of times a key is used and means responsive to the counter for changing said key when its usage count reaches a predetermined value.
Claim 19
Dependent Claim
26 words
A data authentication system according to claim 11 wherein the means for encrypting a message and producing a MAC is comprised in a single encryption unit.
Claim 20
Dependent Claim
31 words
A data authentication system according to claim 11 wherein the means for producing a MAC uses a message key for a given message to produce the MAC corresponding with that message.
Claim 21
Dependent Claim
27 words
A data authentication system according to claim 11 wherein the means for producing a MAC uses a single key to produce all of the individual message MACs.
Claim 22
Dependent Claim
23 words
A data authentication system according to claim 18 wherein said key is also used by the combining means to produce the encryption keys.
References Cited (Backward Citations)
US4423287A
Cited
US4578530A
Cited
US4747050A
Cited
US4755940A
Cited
US4783798A
Cited
US4688250A
Cited
US4866707A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1993-06-11 | 1993-12-11 | 1994-06-12 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 1997-06-11 | 1997-12-11 | 1998-06-12 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2001-06-11 | 2001-12-11 | 2002-06-12 | $7700.00 | Window Closed / Lapsed |