Cryptographic key management apparatus and methods

Claim 1

Cryptographic key management apparatus for a communication domain enabling secure communication among a plurality of domain members comprising: a plurality of Keys for use in said apparatus comprising Master Keys and Working Keys; said Master Keys comprising a Domain Master Key shared by all domain members and a Member Master Key unique to each said domain member; said Working Keys comprising Domain Vector Keys and Member Vector Keys; said Domain Vector Keys being public keys for use by said domain members and having control information therein defining said Domain Vector Keys for encryption and verification; each said Member Vector Key being a private key for use by an associated domain member and having control information therein defining said Member Vector Key for decryption and message sealing; each said Member Vector Key having a cryptographic key value encrypted therein using the associated Member Master Key; said Domain Master Key being a public key shared by all domain members and used for protecting said Domain Vector Keys; each said Domain Vector Key having a cryptographic key value encrypted therein using the Domain Master Key; each said Member Master Key being a private key for use by an associated domain member; each said Member Vector Key having a cryptographic key value encrypted therein using the associated Member Master Key; a directory accessible by all domain members, with at least one Domain Vector Key and one Member Vector Key being provided for each said domain member to provide a Pair of Vector Keys, with each said Pair of Vector Keys having the same said cryptographic key value therein; each said domain member including: a vector key processor and a cryptographic processor; said vector key processor receiving said Working Keys for controlling said data encryption and data decryption; and said cryptographic processor performing said encryption and decryption.

Claim 5

A method of managing a plurality of cryptographic Keys by domain members in a communication domain, with said Keys including Master Keys and Working Keys, with said Master Keys including Domain Master Keys and Member Master Keys, and with said Wording Keys including Domain Vector Keys and Member Vector Keys, said method comprising the steps of: (a) providing the Domain Master Key and the Domain Vector Key as public keys; (b) keeping the Member Master Key and the Domain Vector Key as private keys for use by an associated domain member; (c) performing data encryption and data seal verification on a vector key processor for said public keys; and performing data decryption and seal generation on a cryptographic processor for said private keys (d) grouping a Domain Vector Key and a Member Vector Key as a Key Pair and sharing the same cryptographic key value, with at least one Key Pair being associated with each domain member; (e) storing said Key Pairs in a directory, and (f) sealing said Key Pairs with associated Master Keys to provide protection against vector substitution.

Claim 6

A method of managing a plurality of cryptographic Keys by domain members in a communication domain, with said Keys including Master Keys and Working Keys, with said Master Keys including Domain Master Keys and Member Master Keys, and with said Wording Keys including Domain Vector Keys and Member Vector Keys, said method comprising the steps of: (a) providing the Domain Master Key and the Domain Vector Key as public keys; (b) keeping the Member Master Key and the Domain Vector Key as private keys for use by an associated domain member; (c) performing data encryption and data seal verification on a vector key processor for said public keys; and performing data decryption and seal generation on a cryptographic processor for said private keys (d) grouping a Domain Vector Key and a Member Vector Key as a Key Pair and sharing the same cryptographic key value, with at least one Key Pair being associated with each domain member; (e) storing said Key Pairs in a directory, and (f) sealing said Key Pairs with associated Master Keys to provide protection against vector substitution.

Claim 7

A method of managing a plurality of cryptographic Keys by domain members in a communication domain, with said Keys including Master Keys and Working Keys, with said Master Keys including Domain Master Keys and Member Master Keys, and with said Working Keys including Domain Vector Keys and Member Vector Keys, said method comprising the steps of: (a) providing the Domain Master Key and the Domain Vector Key as public keys; (b) keeping the Member Master Key and the Domain Vector Key as private keys for use by an associated domain member; (c) performing data encryption and data seal verification on a vector key processor for said public keys; and performing data decryption and seal generation on a cryptographic processor for said private keys (d) grouping a Domain Vector Key and a Member Vector Key as a Key Pair and sharing the same cryptographic key value, with at least one Key Pair being associated with each domain member; (e) storing said Key Pairs in a directory; (f) sealing said Key Pairs with associated Master Keys to provide protection against vector substitution; and (g) carrying out message encryption and decryption in said cryptographic processor into which the Key Pairs are loaded from said vector key processor.

Claim 8

A method of managing a plurality of cryptographic Keys by domain members in a communication domain, with said Keys including Master Keys and Working Keys, with said Master Keys including Domain Master Keys and Member Master Keys, and with said Working Keys including Domain Vector Keys and Member Vector Keys, said method comprising the steps of: (a) providing the Domain Master Key and the Domain Vector Key as public keys; (b) keeping the Member Master Key and the Domain Vector Key as private keys for use by an associated domain member; (c) performing data encryption and data seal verification on a vector key processor for said public keys; and performing data decryption and seal generation on a cryptographic processor for said private keys (d) grouping a Domain Vector Key and a Member Vector Key as a Key Pair and sharing the same cryptographic key value, with at least one Key Pair being associated with each domain member; (e) storing said Key Pairs in a directory; (f) sealing said Key Pairs with associated Master Keys to provide protection against vector substitution; and (g) carrying out message encryption and decryption in said cryptographic processor into which the Key Pairs are loaded from said vector key processor.