US5483596A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Apparatus and method for controlling access to and interconnection of computer system resources
Assignee: PARALON TECHNOLOGIES Inc
•
Filing: 1994-01-24
•
Granted: 1996-01-09
•
Expires: 2014-01-24
Abstract
Abstract A compact, physically secure, high-performance access controller (16, 18) is electrically connected to each access-managed resource (12, 14) or group of resources (10) in a computer system. Whenever access managed resources attempt to establish communications, their associated access controllers exchange sets of internally generated access authorization codes (106, 112, 120, 132, 202, 208, 216, 270, 272) utilizing protocols characterized by multiple random numbers, resource authorization keys, serial number (48, 72) verification, and session authorization keys. Each new session employs different encryption keys derived from multiple random numbers and multiple hidden algorithms. Tables of authorized requesting and responding resources are maintained in a protected memory (34, 38) in each access controller. An authorization table building procedure is augmented by an optional central access control system (56) that employs a parallel control network (62, 64, 66) to centrally manage the access control tables in an access-controlled system of resources.
Inventors
- 👤 Peter D. Rosenow
- 👤 Roger M. Trafton
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-27 07:13
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/04; H04L63/0428; G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/60; G06F21/62; G06F21/6218; G06F21/6236; G06F21/70; G06F21/86; H04L63/10; H04L63/101; H04L9/00; H04L9/40; G06F2211/00; G06F2211/007; G06F2221/00; G06F2221/21; G06F2221/2107; G06F2221/2141; G06F2221/2143
Claims Analysis
Total Claims: 39
Claim 1
Independent Claim
183 words
A system for transferring secure data across a data communication medium between first and second computer system resources, comprising: first and second access controllers electrically connected to the data communication medium and to respective ones of the first and second resources, for transferring the secure data during a data transfer session after verifying that the first and second resources are both associated with at least one authorized access code; the access controllers each including: a memory storing a table of encryption keys, a table of algorithms, and a table of authorized resources that associates pairs of resources with authorized access control codes, the encryption keys and algorithms being identical in each access controller; a processor randomly generating for the data transfer session, plural numbers and utilizing an access controller identifying number, the randomly generated numbers, selected ones of the stored algorithms, and a predetermined one of the stored encryption keys to generate in cooperation with the other access controller a unique session key; and an encryption/decryption processor using the unique session key to encrypt the secure data transferred across the data communication medium.
Claim 2
Independent Claim
183 words
A system for transferring secure data across a data communication medium between first and second computer system resources, comprising: first and second access controllers electrically connected to the data communication medium and to respective ones of the first and second resources, for transferring the secure data during a data transfer session after verifying that the first and second resources are both associated with at least one authorized access code; the access controllers each including: a memory storing a table of encryption keys, a table of algorithms, and a table of authorized resources that associates pairs of resources with authorized access control codes, the encryption keys and algorithms being identical in each access controller; a processor randomly generating for the data transfer session, plural numbers and utilizing an access controller identifying number, the randomly generated numbers, selected ones of the stored algorithms, and a predetermined one of the stored encryption keys to generate in cooperation with the other access controller a unique session key; and an encryption/decryption processor using the unique session key to encrypt the secure data transferred across the data communication medium.
Claim 3
Dependent Claim
33 words
The system of claim 1 in which the resources are selected from a group consisting of: computers, software, servers, networks, data bases, communications switches, communication controllers, mass memory devices, printers, and disk drives.
Claim 4
Dependent Claim
49 words
The system of claim 1 in which the communication medium is selected from a group consisting of: a modem, a network, a radio frequency transmission, a SCSI bus, an IEEE-488 bus, an RS-232 interconnection, a cellular radio, a CATV cable, an optical fiber, a switched network, and electrical wiring.
Claim 5
Dependent Claim
36 words
The system of claim 1 in which the access controllers verify an access level of authorization and a resource privilege level of authorization before connecting their respective first and second resources to the data communication medium.
Claim 6
Dependent Claim
22 words
The system of claim 1 in which the access controllers generate a new unique session key for each subsequent data transfer session.
Claim 7
Dependent Claim
39 words
The system of claim 1 further including a communication pathway that interconnects at least one of the access controllers to a central access control system that communicates access control code information to the access controllers through the communication pathway.
Claim 8
Dependent Claim
56 words
The system of claim 6 in which the communication pathway is selected from a group consisting of: the communication medium, a modem, a network, tan Ethernet,]a radio frequency transmission, a SCSI bus, an IEEE-488 bus, a computer bus, an RS-232 interconnection, a cellular radio, a CATV cable, an optical fiber, a switched network, and electrical wiring.
Claim 9
Dependent Claim
46 words
The system of claim 1 in which a major portion of at least one of the access controllers is encapsulated in a potting compound and the access controller further includes a self-destruct mechanism that erases the memory in response to detecting tampering with the potting compound.
Claim 10
Dependent Claim
27 words
The system of claim 8 in which the self-destruct mechanism includes an electret material oriented in the potting compound in proximity to an electric field detecting device.
Claim 11
Independent Claim
135 words
A method for generating a table of authorized resources entry for use in a secure access control system, comprising: establishing a secure data communication dialog between first and second access controllers; storing in each access controller, a table of encryption keys, a table of algorithms, and a table of authorized resources that associates pairs of access controllers with authorized access control codes, the tables of encryption keys and algorithms being identical in each access controller; generating a unique base key associated with the first and second access controllers by using the secure data communication dialog to exchange data derived from predetermined ones of the encryption keys and the algorithms; and associating the first and second access controllers with the unique base key in the table of authorized resources of the first and second access controllers.
Claim 12
Independent Claim
135 words
A method for generating a table of authorized resources entry for use in a secure access control system, comprising: establishing a secure data communication dialog between first and second access controllers; storing in each access controller, a table of encryption keys, a table of algorithms, and a table of authorized resources that associates pairs of access controllers with authorized access control codes, the tables of encryption keys and algorithms being identical in each access controller; generating a unique base key associated with the first and second access controllers by using the secure data communication dialog to exchange data derived from predetermined ones of the encryption keys and the algorithms; and associating the first and second access controllers with the unique base key in the table of authorized resources of the first and second access controllers.
Claim 13
Dependent Claim
44 words
The method of claim 10 in which the first access controller is associated with a resource access control system that stores an ID number in the first access controller, the ID number being related to a production serial number of the first access controller.
Claim 14
Independent Claim
198 words
A method for generating and using encryption keys to authorize and encrypt data exchanged between first and second computer system resources, comprising: providing a master access controller and a slave access controller each including a processor and a memory; storing in the memories tables of authorized resources and identical base key tables, encryption key tables, and algorithm tables; randomly generating in the master access controller a number alpha1; selecting a predetermined base key "a" from the master access controller base key table; calculating "a" alpha1; randomly generating in the slave access controller a number beta1; selecting the predetermined base key "a" from the slave access controller base key table; determining a key A in the slave access controller by calculating "a" alpha1) beta1; calculating "a" beta1; determining key A in the master access controller by calculating ("a" beta1) alpha1; selecting a base key x at random from the master access controller base key table; determining a key B by calculating (x) alpha1*beta1; determining base key x in the slave access controller by calculating (key B) (1/beta1*alpha1); and determining that base key x exists in the slave access controller base key table to verify the validity of key B.
Claim 15
Independent Claim
198 words
A method for generating and using encryption keys to authorize and encrypt data exchanged between first and second computer system resources, comprising: providing a master access controller and a slave access controller each including a processor and a memory; storing in the memories tables of authorized resources and identical base key tables, encryption key tables, and algorithm tables; randomly generating in the master access controller a number alpha1; selecting a predetermined base key "a" from the master access controller base key table; calculating "a" alpha1; randomly generating in the slave access controller a number beta1; selecting the predetermined base key "a" from the slave access controller base key table; determining a key A in the slave access controller by calculating "a" alpha1) beta1; calculating "a" beta1; determining key A in the master access controller by calculating ("a" beta1) alpha1; selecting a base key x at random from the master access controller base key table; determining a key B by calculating (x) alpha1*beta1; determining base key x in the slave access controller by calculating (key B) (1/beta1*alpha1); and determining that base key x exists in the slave access controller base key table to verify the validity of key B.
Claim 16
Dependent Claim
120 words
The method of claim 12 further including: mapping into a record A, a master access controller ID number, and an encryption key selected from the master access controller encryption key table; unmapping record A in the slave access controller; generating from record A a unique base key; entering the master access controller ID number, the encryption key and the unique base key into the slave access controller table of authorized resources; mapping a slave access controller serial number and the unique base key into a record B; unmapping record B in the master access controller; and entering the slave access controller serial number, the encryption key and the unique base key into the master access controller table of authorized resources.
Claim 17
Dependent Claim
338 words
The method of claim 12 in which predetermined base key "a" is replaced by a predetermined base key "b" and the method further comprises: randomly generating in the master access controller a number alpha2; mapping the master access controller ID number and alpha2 into a record C; unmapping record C in the slave access controller; randomly generating in the slave access controller a number beta2; searching the slave access controller table of authorized resources for a match to the master access controller ID number; mapping into a record D if a match to the master access controller ID number is found a slave access controller ID number and beta2; unmapping record D in the master access controller; searching the master access controller table of authorized resources for an existing entry including the slave access controller ID number; storing in the master access controller table of authorized resources if the slave access controller ID number is found, the encryption key and the unique base key associated with the slave access controller ID number; searching the slave access controller table of authorized resources for an existing entry including the master access controller ID number; storing in the slave access controller table of authorized resources if the slave master controller ID number is found, the encryption key and unique base key associated with the master access controller ID number; randomly generating in the slave access controller a number beta3, calculating unique base key beta3 and sending unique base key beta3 to the master access controller; randomly generating in the master access controller a number alpha3; calculating unique base key alpha3 and sending unique base key alpha3 to the slave access controller; determining a session key in the master access controller by calculating (the unique base key beta3) alpha3; determining the session key in the slave access controller by calculating (the unique base key alpha3) beta3; and transferring data between the first and second computer system resources by encrypting and decrypting the data in the associated access controllers using the session key.
Claim 18
Independent Claim
159 words
A system for transferring secure data across a data communication medium between first and second computers comprising: first and second access control means in communication with the data communication medium and with associated ones of the first and second computers, for transferring the secure data after verifying that the first and second computers are both associated with the authorized access control code; the first and second access control means each having an associated memory for storing a table of predetermined encryption keys and a table of authorized resources for associating the first and second computers with an authorized access control code, and an associated processor for randomly generating numbers and using the randomly generated numbers in cooperation with a predetermined one of the stored encryption keys to generate in data communication with the other access control means a session key; and an encryption/decryption processor using the session key to encrypt the secure data transferred across the data communication medium.
Claim 19
Independent Claim
159 words
A system for transferring secure data across a data communication medium between first and second computers comprising: first and second access control means in communication with the data communication medium and with associated ones of the first and second computers, for transferring the secure data after verifying that the first and second computers are both associated with the authorized access control code; the first and second access control means each having an associated memory for storing a table of predetermined encryption keys and a table of authorized resources for associating the first and second computers with an authorized access control code, and an associated processor for randomly generating numbers and using the randomly generated numbers in cooperation with a predetermined one of the stored encryption keys to generate in data communication with the other access control means a session key; and an encryption/decryption processor using the session key to encrypt the secure data transferred across the data communication medium.
Claim 20
Dependent Claim
25 words
The system of claim 15 further including a self-destruct means that erases the associated memory in response to detecting tampering with the access control means.
Claim 21
Dependent Claim
30 words
The system of claim 16 in which the self-destruct means detects tampering with an electromechanical means coupled to at least one of the associated memory and a data communication connection.
Claim 22
Dependent Claim
24 words
The system of claim 15 in which at least a portion of one of the access control means is integral with its associated computer.
Claim 23
Dependent Claim
30 words
The system of claim 18 in which the communication medium is a switched network and each of the access control means is connected to the switched network through a modem.
Claim 24
Dependent Claim
17 words
The system of claim 19 in which the modem is integral with its associated access control means.
Claim 25
Dependent Claim
33 words
The system of claim 15 further including a communication pathway that interconnects the first access control means to a central access control system that includes at least a portion of the associated memory.
Claim 26
Dependent Claim
50 words
The system of claim 21 in which the communication pathway is selected from a group consisting of: the communication medium, a network, a radio frequency transmission, a SCSI bus, an IEEE-488 bus, an RS-232 interconnection, a cellular radio, a CATV cable, an optical fiber, a switched network, and electrical wiring.
Claim 27
Independent Claim
175 words
A method for generating and using encryption keys to authorize and encrypt data transferred between first and second computer system resources, comprising: providing a master access controller and a slave access controller each including a processor and a memory; storing in the memories tables of authorized resources and identical encryption key tables; randomly generating in the master access controller and the slave access controller respective first and second numbers; selecting from the master access controller encryption key table and the slave access controller encryption key table a first predetermined encryption key; determining in the master access controller and the slave access controller a key A by processing the first predetermined encryption key with the first and second randomly generated numbers; selecting at random from the master access controller encryption key table a second encryption key; determining a key B in the master access controller by processing the second encryption key with the first and second randomly generated numbers; and encrypting key B with key A and sending encrypted key B to the slave access controller,
Claim 28
Independent Claim
175 words
A method for generating and using encryption keys to authorize and encrypt data transferred between first and second computer system resources, comprising: providing a master access controller and a slave access controller each including a processor and a memory; storing in the memories tables of authorized resources and identical encryption key tables; randomly generating in the master access controller and the slave access controller respective first and second numbers; selecting from the master access controller encryption key table and the slave access controller encryption key table a first predetermined encryption key; determining in the master access controller and the slave access controller a key A by processing the first predetermined encryption key with the first and second randomly generated numbers; selecting at random from the master access controller encryption key table a second encryption key; determining a key B in the master access controller by processing the second encryption key with the first and second randomly generated numbers; and encrypting key B with key A and sending encrypted key B to the slave access controller,
Claim 29
Dependent Claim
51 words
The method of claim 23 further including: determining in the slave access controller the second encryption key by processing key B with the first and second randomly generated numbers; and verifying that key B exists by determining whether the second encryption key exists in the slave access controller encryption key table.
Claim 30
Dependent Claim
135 words
The method of claim 23 further including: providing the master access controller with a master access controller ID number and the slave access controller with a slave access controller ID number; encrypting the master access controller ID number and sending the master access controller ID number to the slave access controller; determining in the slave access controller a unique code by processing the master access controller ID number and the slave access controller ID number; entering the master access controller ID number and the unique code into the slave access controller table of authorized resources; encrypting the slave access controller ID number and the unique code and sending them to the master access controller; and entering the slave access controller ID number and the unique code into the master access controller table of authorized resources.
Claim 31
Dependent Claim
172 words
The method of claim 25 further comprising: encrypting the master access controller ID number and sending the master access controller ID number to the slave access controller; encrypting the slave access controller ID number and sending the slave access controller ID number to the master access controller if the master access controller ID number is an existing entry in the slave access controller table of authorized resources; registering the unique code associated with the slave access controller ID number if the slave access controller ID number is an existing entry in the master access controller table of authorized resources; registering the unique code associated with the master access controller ID number if the master access controller ID number is an existing entry in the slave access controller table of authorized resources; determining a session key in the master access controller and the slave access controller by processing the unique code registered in each access controller; and decrypting with the session key the data transferred between the first and second computer system resources.
Claim 32
Independent Claim
155 words
A method for authorizing access to and encrypting data transferred between first and second computer system resources, comprising: connecting together through a first data communication medium first and second access controllers each associated with a table of authorized resources; generating in the table of authorized resources an authorized resource pair entry associating the first and second access controllers; detaching the first and second access controllers; attaching the first and second access controllers to respective ones of the first and second computer system resources; connecting the first and second access controllers through a second data communication medium; exchanging data between the first and second access controllers to verify that both access controllers are associated by the authorized resource pair entry in the associated table of authorized resources; establishing a session encryption key; and encrypting and decrypting with the session key data transferred across the second data communication medium between the first and second computer system resources.
Claim 33
Independent Claim
155 words
A method for authorizing access to and encrypting data transferred between first and second computer system resources, comprising: connecting together through a first data communication medium first and second access controllers each associated with a table of authorized resources; generating in the table of authorized resources an authorized resource pair entry associating the first and second access controllers; detaching the first and second access controllers; attaching the first and second access controllers to respective ones of the first and second computer system resources; connecting the first and second access controllers through a second data communication medium; exchanging data between the first and second access controllers to verify that both access controllers are associated by the authorized resource pair entry in the associated table of authorized resources; establishing a session encryption key; and encrypting and decrypting with the session key data transferred across the second data communication medium between the first and second computer system resources.
Claim 34
Dependent Claim
32 words
The method of claim 27 further including the step of providing each of the first and second access controllers with a memory and storing the table of authorized resources in the memory.
Claim 35
Dependent Claim
43 words
The method of claim 27 in which the connecting together and generating steps are carried out in data communication with a resource access control system that provides the table of authorized resources with identifying data unique to the first and second access controllers.
Claim 36
Dependent Claim
42 words
The method of claim 27 further including the steps of providing a central access control system in data communication with at least one of the access controllers and exchanging authorized resource data between the central access control system and the access controller.
Claim 37
Dependent Claim
22 words
The method of claim 30 further including the step of storing the table of authorized resources in the central access control system.
Claim 38
Dependent Claim
40 words
The method of claim 30 further including the step of providing a parallel control network that provides the authorized resource data through a third data communication medium interconnecting the central access control system and the first and second access controllers.
Claim 39
Dependent Claim
56 words
The method of claim 32 in which the first, second, and third data communication media are selected from a group consisting of: a modem, a network, a radio frequency,transmission, a SCSI bus, an IEEE-488 bus, a computer bus, an RS-232 interconnection, a cellular radio, a CATV cable, an optical fiber, a switched network, and electrical wiring.
References Cited (Backward Citations)
US4546213A
Cited
US4679226A
Cited
US5131025A
Cited
US4905281A
Cited
US4956769A
Cited
US4995112A
Cited
US5003595A
Cited
US5018190A
Cited
US5204961A
Cited
US5173939A
Cited
US5315657A
Cited
US5153918A
Cited
US5253295A
Cited
US5297208A
Cited
US5297207A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1999-01-08 | 1999-07-10 | 2000-01-09 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2003-01-08 | 2003-07-10 | 2004-01-09 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2007-01-08 | 2007-07-10 | 2008-01-09 | $7700.00 | Window Closed / Lapsed |