Process and apparatus for the protection of secret elements in a network of encrypting devices with open key management

Claim 2

A process for the protection of secret elements in a network of encryption devices using key management and keys of different hierarchical levels, comprising the steps of: encryting information in a first encryption device under at least one key of a first hierarchical level; and, encrypting said at least one key of said first hierarchical level under a key of a second hierarchical level, wherein the encryption of the key of the first hierarchical level is effected in a security module which is separable from said first encryption device, and in which predetermined keys of the second hierarchical level are stored in an encrypted form.

Claim 3

The process according to claim 1, wherein the encryption under the key of a second hierarchical level in the security module is secured by a password system.

Claim 4

An encryption device for a network using key management with keys of different hierarchical levels, comprising: means for encrypting information under at least one key of a first hierarchical level; means for removably connecting said encryption device with a security module which is structurally and electrically separable from the encryption device and in which functional stages and keys of a second hierarchical level are located and stored, at least one key of said second hierarchical level being used to encrypt said at least one key of said first hierarchical level such that the encryption device does not contain all keys necessary for decrypting said information.

Claim 5

An encryption device for a network using key management with keys of different hierarchical levels, comprising: means for encrypting information under at least one key of a first hierarchical level; means for removably connecting said encryption device with a security module which is structurally and electrically separable from the encryption device and in which functional stages and keys of a second hierarchical level are located and stored, at least one key of said second hierarchical level being used to encrypt said at least one key of said first hierarchical level such that the encryption device does not contain all keys necessary for decrypting said information.

Claim 6

The device according to claim 3, wherein the security module contains a protecting password system.

Claim 7

The device according to claim 3, wherein the security module has a configuration similar to that of a credit card.

Claim 8

The device according to claim 4, wherein the security module has a configuration similar to that of a credit card.

Claim 9

The device according to claim 3, wherein information stored in the security module is stored at least partially in an encrypted form.

Claim 10

The device according to claim 3, wherein in the security module, a counter means is provided for the production of an offset value and a modification stage for key modification in keeping with said offset value.

Claim 11

A security module, in particular for an encryption device of a network using key management with keys of different hierarchical levels, said security module being a portable independent unit structurally and electrically interconnectable with an information encryption device, and containing functional stages and memories for encryption/decryption to information encrypting/decrypting keys fed thereinto from said information encryption device and for storing key encryption/decryption keys used therefore.

Claim 12

A security module, in particular for an encryption device of a network using key management with keys of different hierarchical levels, said security module being a portable independent unit structurally and electrically interconnectable with an information encryption device, and containing functional stages and memories for encryption/decryption to information encrypting/decrypting keys fed thereinto from said information encryption device and for storing key encryption/decryption keys used therefore.

Claim 13

The security module according to claim 9, wherein the security module contains a protecting password system.

Claim 14

The security module according to claim 9, wherein the security module has a configuration similar to that of a credit card.

Claim 15

The security module according to claim 10, wherein the security module has a configuration similar to that of a credit card.

Claim 16

The security module according to claim 9, wherein information stored in the security module is stored at least partially in a an encrypted form.

Claim 17

The security module according to claim 9, wherein in the security module, a counter means is provided for the production of an offset value and a modification stage for key modification in keeping with said offset value.

Claim 18

The security module according to claim 9, wherein the security module provides for user identification.

Claim 19

The security module according to claim 9, wherein the security module provides for the storage and output of encryption keys to an encryption device and optionally to another security module.

Claim 20

A portable, independent security module for an encryption device of a network using key management with keys of different hierarchical levels, comprising: means for enabling physical and electrical disengagement of the security module from an encryption device, said encryption device using an information encrypting/decrypting key having a first key level to encrypt/decrypt information; means for storing a key encrypting/decrypting key having a second key level higher than said first key level; means for offsetting said key encrypting/decrypting key to create a modified key encrypting key; means for receiving said information encrypting/decrypting key from said encryption device; and, means for encrypting and decrypting said information encrypting/decrypting key using said modified key encrypting/decrypting key.

Claim 21

A portable, independent security module for an encryption device of a network using key management with keys of different hierarchical levels, comprising: means for enabling physical and electrical disengagement of the security module from an encryption device, said encryption device using an information encrypting/decrypting key having a first key level to encrypt/decrypt information; means for storing a key encrypting/decrypting key having a second key level higher than said first key level; means for offsetting said key encrypting/decrypting key to create a modified key encrypting key; means for receiving said information encrypting/decrypting key from said encryption device; and, means for encrypting and decrypting said information encrypting/decrypting key using said modified key encrypting/decrypting key.