US5588060A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for a key-management scheme for internet protocols
Assignee: Oracle America Inc
•
Filing: 1994-06-10
•
Granted: 1996-12-24
•
Expires: 2014-06-10
Abstract
Abstract A first data processing device (node I) is coupled to a private network which is in turn coupled to the Internet. A second data processing device (node J) is coupled to the same, or to a different network, which is also coupled to the Internet, such that node I communicates to node J using the Internet protocol. Node I is provided with a secret value i, and a public value ∝ i mod p. Node J is provided with a secret value j, and a public value ∝ j mod p. Data packets (referred to as "datagrams") are encrypted using the teachings of the present invention to enhance network security. A source node I obtains a Diffie-Helman (DH) certificate for node J, (either from a local cache, from a directory service, or directly from node J), and obtains node J's public value ∝ j mod p from the DH certificate. Node I then computes the value of ∝ ij mod p, and derives a key K ij from the value ∝ ij mod p. A transient key K p is then generated at random, and K p is used to encrypt the datagram to be sent by node I. K p is then encrypted with key K ij . Upon receipt of the encrypted datagram by the receiving node J, the node J obtains a DH certificate for node I, (either from a local cache, from a directory service, or directly from node J), and obtains the public value ∝ i mod p. Node J then computes the value of ∝ ij mod p and derives the key K ij . Node J utilizes the key K ij to decrypt the transient key K p , and using the decrypted transient key K p , node J decrypts the datagram packet, thereby resulting in the original data in unencrypted form.
Inventors
- 👤 Ashar Aziz
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-24 03:27
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0272; H04L12/00; H04L12/28; H04L12/46; H04L12/4604; H04L63/04; H04L63/0428; H04L63/0435; H04L63/0442; H04L63/06; H04L63/061; H04L63/08; H04L63/0823; H04L9/00; H04L9/08; H04L9/0816; H04L9/0838; H04L9/0841; H04L9/40
Claims Analysis
Total Claims: 22
Claim 1
Independent Claim
189 words
An improved method for a first data processing device (node I) to send data to a second data processing device (node J), comprising the steps of: providing an element for performing the step of providing a secret value i, and a public value ∝ i mod p to said node I; providing an element for performing the step of providing a secret value j, and a public value ∝ j mod p to said node J; said node I including an element for performing the steps of: obtaining a Diffie-Helman (DH) certificate for node J and determining said public value ∝ i mod p from said DH certificate; computing the value of ∝ ij mod p, said node I further deriving a key K ij from said value ∝ ij mod p; utilizing said key K ij to encrypt a randomly generated transient key K p , and encrypting a data packet to be transmitted to node J using said key K p ; providing an element for performing the step of said node I sending said data packet encrypted using said key K p to said node J.
Claim 2
Dependent Claim
189 words
An improved method for a first data processing device (node I) to send data to a second data processing device (node J), comprising the steps of: providing an element for performing the step of providing a secret value i, and a public value ∝ i mod p to said node I; providing an element for performing the step of providing a secret value j, and a public value ∝ j mod p to said node J; said node I including an element for performing the steps of: obtaining a Diffie-Helman (DH) certificate for node J and determining said public value ∝ i mod p from said DH certificate; computing the value of ∝ ij mod p, said node I further deriving a key K ij from said value ∝ ij mod p; utilizing said key K ij to encrypt a randomly generated transient key K p , and encrypting a data packet to be transmitted to node J using said key K p ; providing an element for performing the step of said node I sending said data packet encrypted using said key K p to said node J.
Claim 3
Dependent Claim
138 words
The method as defined by claim 1, further comprising the steps by said node J of: providing an element for performing the step of receiving said data packet from node I; providing an element for performing the step of obtaining a DH certificate for said node I and determining said public value ∝ i mod p from said DH certificate; providing an element for performing the step of computing the value of ∝ ij mod p, said node J further deriving said key K ij from said value ∝ ij mod p; providing an element for performing the step of utilizing said key K ij to decrypt the transient key K p , and decrypting said received data packet using said transient key K p ; whereby node J decrypts data received and previously encrypted by node I.
Claim 4
Dependent Claim
29 words
The method as defined by claim 2, wherein said key K ij is derived from ∝ ij mod p using low order key-size bits of ∝ ij mod p.
Claim 5
Dependent Claim
28 words
The method as defined by claim 3, wherein the key K ij is an implicit pair-wise shared secret used as a key for a shared key cryptosystem (SKCS).
Claim 6
Dependent Claim
12 words
The method as defined by claim 4, wherein said SKCS is DES.
Claim 7
Dependent Claim
12 words
The method as defined by claim 5, wherein said SKCS is RC2.
Claim 8
Dependent Claim
23 words
The method as defined by claim 4, wherein said data packet includes a source address, a destination address and an SKCS identifier field.
Claim 9
Dependent Claim
17 words
The method as defined by claim 7, wherein said data packet further includes a message indicator field.
Claim 10
Dependent Claim
21 words
The method as defined by claim 4, wherein ∝ and p are system parameters, and where p is a prime number.
Claim 11
Independent Claim
175 words
An apparatus for encrypting data for transmission from a first data processing device (node I) to a second data processing device (node J), comprising: node I including a first storage device for storing a secret value i, and a public value ∝ i mod p; node J including a second storage device for storing a secret value j, and a public value ∝ j mod p; node I including an encrypting device for encrypting a data packet to be transmitted to node J, said data packet being encrypted using a first Diffie-Helman (DH) certificate for node J to determine said public value ∝ j mod p; said encrypting device further computing the value of ∝ ij mod p and deriving a key K ij from said value ∝ ij mod p; said encrypting device encrypting a randomly generated transient key K p from K ij , and encrypting said data packet using said transient key K p ; node I further including an interface circuit for transmitting said encrypted data packet to said node J.
Claim 12
Independent Claim
175 words
An apparatus for encrypting data for transmission from a first data processing device (node I) to a second data processing device (node J), comprising: node I including a first storage device for storing a secret value i, and a public value ∝ i mod p; node J including a second storage device for storing a secret value j, and a public value ∝ j mod p; node I including an encrypting device for encrypting a data packet to be transmitted to node J, said data packet being encrypted using a first Diffie-Helman (DH) certificate for node J to determine said public value ∝ j mod p; said encrypting device further computing the value of ∝ ij mod p and deriving a key K ij from said value ∝ ij mod p; said encrypting device encrypting a randomly generated transient key K p from K ij , and encrypting said data packet using said transient key K p ; node I further including an interface circuit for transmitting said encrypted data packet to said node J.
Claim 13
Dependent Claim
39 words
The apparatus as defined by claim 10, wherein said node J further includes: a receiver for receiving said encrypted data packet from node I; a decrypting device coupled to said receiver for decrypting said data packet from node I.
Claim 14
Dependent Claim
52 words
The apparatus as defined by claim 11, wherein said decrypting device obtains a second DH certificate for said node I and determines said public value ∝ i mod p, and computes the value of ∝ ij mod p, said decrypting device further deriving said key K ij from ∝ ij mod p.
Claim 15
Dependent Claim
37 words
The apparatus as defined by claim 12, wherein said decrypting device utilizes said key K ij to decrypt said transient key K p , and decrypts said received data packet using said transient key K p .
Claim 16
Dependent Claim
29 words
The apparatus as defined by claim 13, wherein said key K ij is derived from ∝ ij mod p using low order key-size bits of ∝ ij mod p.
Claim 17
Dependent Claim
28 words
The apparatus as defined by claim 14, wherein said key K ij is an implicit pair-wise shared secret used as a key for a shared key cryptosystem (SKCS).
Claim 18
Dependent Claim
23 words
The apparatus as defined by claim 15, wherein said data packet includes a source address, a destination address and an SKCS identifier field.
Claim 19
Dependent Claim
17 words
The apparatus as defined by claim 16, wherein said data packet further includes a message indicator field.
Claim 20
Dependent Claim
21 words
The apparatus as defined by claim 17, wherein ∝ and p are system parameters, and where p is a prime number.
Claim 21
Dependent Claim
12 words
The apparatus as defined by claim 15, wherein said SKCS is DES.
Claim 22
Dependent Claim
12 words
The apparatus as defined by claim 15, where said SKCS is RC2.
References Cited (Backward Citations)
US4916704A
Cited
US5001752A
Cited
US5136642A
Cited
WO1993003562A1
Cited
US5201000A
Cited
WO1993015581A1
Cited
WO1993016538A1
Cited
US5418854A
Cited
US5237611A
Cited
US5341426A
Cited
US5406628A
Cited
US5371794A
Cited
US5416842A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1999-12-24 | 2000-06-24 | 2000-12-24 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2003-12-24 | 2004-06-24 | 2004-12-24 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2007-12-24 | 2008-06-24 | 2008-12-24 | $7700.00 | Window Closed / Lapsed |