US5604801A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Public key data communications system under control of a portable security device
Assignee: International Business Machines Corp
•
Filing: 1995-02-03
•
Granted: 1997-02-18
•
Expires: 2015-02-03
Abstract
Abstract A data communications system is described in which messages are processed using public key cryptography with a private key unique to one or more users (150) under the control of a portable security device (120), such as a smart card, held by each user, the system comprising: a server (130) for performing public key processing using the private key. The server (130) stores, or has access to, the private key for the, or each, user in encrypted form only. The private key is encrypted with a key encrypting key and each security device (120) comprises means for storing or generating the key encrypting key and providing the key encrypting key to the server (130). The server comprises secure means (360) to retrieve the encrypted private key for the user, decrypt the private key using the key encrypting key, perform the public key processing using the decrypted private key, and delete the decrypted private key after use.
Inventors
- 👤 George M. Dolan
- 👤 Christopher J. Holloway
- 👤 Stephen M. Matyas, Jr.
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-29 19:46
CPC Classifications
H; H04; H04L; H04L9/00; H04L9/08; H04L9/0816; H04L9/0819; H04L9/0822
Claims Analysis
Total Claims: 13
Claim 1
Independent Claim
245 words
A communications system in which messages are processed using public key cryptography with a private key unique to one or more users (130) under the control of a portable security device (120) held by the, or each, user, the system comprising: a server (130) for performing public key processing using the private key; the server (130) being adapted for data communication with the portable security device (120); characterised in that the server (130) comprises, or has access to, data storage means in which is stored in a secure manner the private key for the, or each, user in encrypted form only, the private key being encrypted with a key encrypting key, the server comprising secure processing means (360) to receive a message to be processed from the user, retrieve the encrypted private key for the user, decrypt the private key using the key encrypting key, perform the public key processing for the message using the decrypted private key, and delete the key encrypting key and decrypted private key after use, and in that each security device (120) comprises means for storing or generating the key encrypting key and providing the key encrypting key to the server (130) and means for specifying a message to be processed, the system being arranged so that communication of at least the key encrypting key to the server is secure and so that the server can only use the key encrypting key to process the message specified by the user.
Claim 2
Dependent Claim
245 words
A communications system in which messages are processed using public key cryptography with a private key unique to one or more users (130) under the control of a portable security device (120) held by the, or each, user, the system comprising: a server (130) for performing public key processing using the private key; the server (130) being adapted for data communication with the portable security device (120); characterised in that the server (130) comprises, or has access to, data storage means in which is stored in a secure manner the private key for the, or each, user in encrypted form only, the private key being encrypted with a key encrypting key, the server comprising secure processing means (360) to receive a message to be processed from the user, retrieve the encrypted private key for the user, decrypt the private key using the key encrypting key, perform the public key processing for the message using the decrypted private key, and delete the key encrypting key and decrypted private key after use, and in that each security device (120) comprises means for storing or generating the key encrypting key and providing the key encrypting key to the server (130) and means for specifying a message to be processed, the system being arranged so that communication of at least the key encrypting key to the server is secure and so that the server can only use the key encrypting key to process the message specified by the user.
Claim 3
Dependent Claim
76 words
A system as claimed in claim 1 wherein the key encrypting key is encrypted using a key derived from a second key encrypting key stored in the security device (120), for transmission between the security device and the server, the server (130) comprising, or having access to, data storage means in which the second key encrypting key is stored in a secure manner, whereby communication of the first key encrypting key to the server is secure.
Claim 4
Dependent Claim
55 words
A system as claimed in claim 1 wherein the key encrypting key is cryptographically associated with a message to be processed, the secure processing means comprising means to verify the association of the key encrypting key with the message and being arranged only to make use of the key encrypting key to process that message.
Claim 5
Dependent Claim
54 words
A system as claimed in claim 3 wherein the security device comprises means to encrypt the key encrypting key for transmission to the server using a key derived from the message to be signed, the server comprising secure means (360) for generating the key derived from the message and decrypting the key encrypting key.
Claim 6
Dependent Claim
58 words
A system as claimed in claim 1 wherein the key encrypting key is stored in the security device as a reversible function of a password, the system comprising means to receive from the user (150), and provide to the security device, the password, the security device comprising means to recover the key encrypting key using the reversible function.
Claim 7
Dependent Claim
53 words
A system as claimed in claim 1 wherein the key encrypting key is a one-way function of the private key, the server comprising means to check the recovered value of the private key by deriving therefrom the key-encrypting key and comparing the derived value thereof with the value received from the security device.
Claim 8
Dependent Claim
89 words
A system as claimed in claim 1 wherein the key encrypting key is a reversible function of a key stored in the security device and a random number, the server (130) comprising means to provide the random number to the security device (120), wherein the server (130) is arranged to reencrypt the private key each time it is used using a new random number, and to provide the new random number to the security device the next time it is required to perform public key processing for a user.
Claim 9
Dependent Claim
43 words
A communications system as claimed in claim 1 wherein, the portable security device (120) is adapted to communicate data to a server and comprises means for storing or generating the key encrypting key and providing the key encrypting key to the server (130).
Claim 10
Dependent Claim
20 words
A system as claimed in claim 8, wherein the portable security device is in the form of a smart card.
Claim 11
Dependent Claim
107 words
A communications system as claimed in claim 1 wherein, the server (130) is adapted for data communications with a portable security device and comprises, or has means to access, secure storage means (350) in which the private key for the, or each, user is stored in encrypted form only, the private key being encrypted with a key encrypting key, the server further comprising secure means (360) to retrieve the encrypted private key for the user, decrypt the private key using the key encrypting key, perform the public key processing using the decrypted private key, and delete the decrypted private key and the key encrypting key after use.
Claim 12
Independent Claim
225 words
A method for processing messages using public key cryptography with a private key unique to one or more users (150) under the control of a portable security device (120) held by the, or each, user, in a system comprising: a server (130) for performing public key processing using the private key, in which system the server (130) is adapted for data communication with the portable security device (120); characterised by the steps of (a) storing in the server, or providing the server with access to, the private key for the, or each, user in encrypted form only, the private key being encrypted with a key encrypting key; (b) storing or generating in the security device the key encrypting key and providing the key encrypting key to the server (130) in a manner such that at least the key encrypting key is secure in communication to the server; and, in a secure environment in the server (130): (c) receiving a message to be processed specified by the user; (d) retrieving the encrypted private key for the user; (e) verifying that the message was that specified by the user; (f) decrypting the private key using the key encrypting key; (g) performing the public key processing for the message using the decrypted private key; and (h) deleting the decrypted private key and the key encrypting key after use.
Claim 13
Independent Claim
225 words
A method for processing messages using public key cryptography with a private key unique to one or more users (150) under the control of a portable security device (120) held by the, or each, user, in a system comprising: a server (130) for performing public key processing using the private key, in which system the server (130) is adapted for data communication with the portable security device (120); characterised by the steps of (a) storing in the server, or providing the server with access to, the private key for the, or each, user in encrypted form only, the private key being encrypted with a key encrypting key; (b) storing or generating in the security device the key encrypting key and providing the key encrypting key to the server (130) in a manner such that at least the key encrypting key is secure in communication to the server; and, in a secure environment in the server (130): (c) receiving a message to be processed specified by the user; (d) retrieving the encrypted private key for the user; (e) verifying that the message was that specified by the user; (f) decrypting the private key using the key encrypting key; (g) performing the public key processing for the message using the decrypted private key; and (h) deleting the decrypted private key and the key encrypting key after use.
References Cited (Backward Citations)
US4969188A
Cited
US5111504A
Cited
US5142578A
Cited
US5200999A
Cited
US5265164A
Cited
US5237611A
Cited
US5412721A
Cited
US5513261A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2000-02-18 | 2000-08-19 | 2001-02-18 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2004-02-18 | 2004-08-19 | 2005-02-18 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2008-02-18 | 2008-08-19 | 2009-02-18 | $7700.00 | Window Closed / Lapsed |