Patent US2790144A successfully refreshed from Google Patents.
Patent US5675649A successfully refreshed from Google Patents.
US5675649A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Process for cryptographic key generation and safekeeping
Assignee: Hewlett Packard Enterprise Development LP
•
Filing: 1995-11-30
•
Granted: 1997-10-07
•
Expires: 2015-11-30
Abstract
Abstract A process for cryptographic key generation and safekeeping is provided. A plurality of key agents are selected, each having a copy of the source code. One copy of the source code is loaded onto a secure computer system and is compared with at least one other copy of the source code to validate the loaded copy of the source code. Master key information and locking key information are generated by executing compiled source code. The master key information is then separated into a plurality of master key shares which are distributed to master key agents such that each master key agent possesses one master key share. The locking key information is separated into a plurality of locking key shares which are distributed to locking key agents such that each locking key agent possesses one locking key share. Then, the plurality of locking key shares and the plurality of master key shares are validated, and the secure computer system is securely shut down.
Inventors
- 👤 J. J. Brennan
- 👤 Bruce K. Geist
- 👤 Jeffrey A. Van Eeuwen
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-29 15:23
CPC Classifications
H; H04; H04L; H04L9/00; H04L9/08; H04L9/0816; H04L9/085; H04L9/0894
Claims Analysis
Total Claims: 24
Claim 1
Independent Claim
190 words
A process for cryptographic key generation and safekeeping, comprising: selecting a plurality of key agents each having a copy of source code; loading one copy of the source code onto a secure computer system; comparing the loaded copy of the source code with each other copy of the source code to validate the loaded copy of the source code; generating master key information and locking key information by executing compiled source code; separating the master key information into a plurality of master key shares; distributing the plurality of master key shares to key agents designated to be master key agents such that each master key agent possesses one master key share; separating the locking key information into a plurality of locking key shares; distributing the plurality of locking key shares to key agents designated to be locking key agents such that each locking key agent possesses one locking key share; validating the plurality of locking key shares and the plurality of master key shares; and shutting down the secure computer system such that the master key information and locking key information can not be reconstructed from the secure computer system.
Claim 2
Dependent Claim
190 words
A process for cryptographic key generation and safekeeping, comprising: selecting a plurality of key agents each having a copy of source code; loading one copy of the source code onto a secure computer system; comparing the loaded copy of the source code with each other copy of the source code to validate the loaded copy of the source code; generating master key information and locking key information by executing compiled source code; separating the master key information into a plurality of master key shares; distributing the plurality of master key shares to key agents designated to be master key agents such that each master key agent possesses one master key share; separating the locking key information into a plurality of locking key shares; distributing the plurality of locking key shares to key agents designated to be locking key agents such that each locking key agent possesses one locking key share; validating the plurality of locking key shares and the plurality of master key shares; and shutting down the secure computer system such that the master key information and locking key information can not be reconstructed from the secure computer system.
Claim 3
Dependent Claim
45 words
The process of claim 1, further comprising: selecting parameters with respect to a cryptographic key including a minimum number of master key agents, a total number of master key agents, a minimum number of locking key agents, and a total number of locking key agents.
Claim 4
Dependent Claim
129 words
The process of claim 1, wherein generating, separating, distributing, and validating comprises: sampling environmental noise for a random collection of bits; testing the collection of bits for randomness; repeating the Sampling if the collection of bits are not sufficiently random; initializing a secure random number generator using the collection of bits; building the master key information; issuing a self signed certificate for the master key information; generating the locking key information; generating master key shares and encrypting the master key shares using the locking key information; generating locking key shares; writing the master key shares and the locking key shares to portable storage devices; reading the master key shares and the locking key shares from the portable storage devices; validating the master key information and the locking key information.
Claim 5
Dependent Claim
26 words
The process of claim 1, further comprising: rebuilding the locking key information and the master key information; and reissuing master key shares and locking key shares.
Claim 6
Dependent Claim
148 words
The process of claim 4, wherein rebuilding and reissuing comprises: gathering a minimum number of master key shares and a minimum number of locking key shares; reconstructing master key information from master key shares and locking key shares; sampling environmental noise for random collection of bits; testing the collection of bits for randomness; repeating the sampling if the collection of bits are not sufficiently random; initializing a secure random number generator using the collection of bits; generating locking key information; generating master key shares and encrypting the master key shares using the locking key information; writing the master key shares and the locking key shares to portable storage devices; reading the master key shares and the locking key shares from the portable storage devices; validating the master key information and the locking key information destroying old portable storage devices storing master key shares and storing locking key shares.
Claim 7
Dependent Claim
18 words
The process of claim 1, wherein the key generation source code implements an RSA-based public key encryption system.
Claim 8
Dependent Claim
22 words
The process of claim 3, wherein sampling comprises sampling input received from a microphone connected to an audio port of a computer.
Claim 9
Dependent Claim
14 words
The process of claim 3, wherein generating comprises using a Blum-Blum-Shub random number generator.
Claim 10
Dependent Claim
190 words
A process for cryptographic key generation and safekeeping, comprising: selecting a plurality of key agents each having a copy of source code; loading one copy of the source code onto a secure computer system; comparing the loaded copy of the source code with each other copy of the source code to validate the loaded copy of the source code; generating master key information by executing compiled source code including: sampling environmental noise for random collection of bits; testing the collection of bits for randomness; repeating the sampling if the collection of bits are not sufficiently random; initializing a secure random number generator using the collection of bits; building the master key information using a random number produced by the random number generator; separating the master key information into a plurality of master key shares; distributing the plurality of master key shares to key agents designated to be master key agents such that each master key agent possesses one master key share; validating the plurality of master key shares; and shutting down the secure computer system such that the master key information can not be reconstructed from the secure computer system.
Claim 11
Dependent Claim
190 words
A process for cryptographic key generation and safekeeping, comprising: selecting a plurality of key agents each having a copy of source code; loading one copy of the source code onto a secure computer system; comparing the loaded copy of the source code with each other copy of the source code to validate the loaded copy of the source code; generating master key information by executing compiled source code including: sampling environmental noise for random collection of bits; testing the collection of bits for randomness; repeating the sampling if the collection of bits are not sufficiently random; initializing a secure random number generator using the collection of bits; building the master key information using a random number produced by the random number generator; separating the master key information into a plurality of master key shares; distributing the plurality of master key shares to key agents designated to be master key agents such that each master key agent possesses one master key share; validating the plurality of master key shares; and shutting down the secure computer system such that the master key information can not be reconstructed from the secure computer system.
Claim 12
Dependent Claim
31 words
The process of claim 9, further comprising: selecting parameters with respect to a cryptographic key including a minimum number of master key shares and a total number of master key shares.
Claim 13
Dependent Claim
24 words
The process of claim 9, wherein sampling environmental noise comprises sampling input received from a microphone connected to an audio port of a computer.
Claim 14
Dependent Claim
14 words
The process of claim 9, wherein initializing comprises initializing a Blum-Blum-Shub random number generator.
Claim 15
Dependent Claim
18 words
The process of claim 9, wherein the key generation source code implements an RSA-based public key encryption system.
Claim 16
Dependent Claim
129 words
A process for generating and providing a plurality of random collections of bits for use as a source of randomness, comprising: sampling an unpredictable source to create a collection of bits; testing the collection of bits using a plurality of statistical tests of randomness; rejecting the collection of bits if the collection of bits fails any of the plurality of statistical tests of randomness in order to avoid providing the collection of bits when the unpredictable source experiences a failure; providing the collection of bits for use as a source of randomness if the collection of bits passes the plurality of statistical tests of randomness; and repeating sampling, testing, rejecting, and providing such that a plurality of collections of bits are provided for use as a source of randomness.
Claim 17
Dependent Claim
129 words
A process for generating and providing a plurality of random collections of bits for use as a source of randomness, comprising: sampling an unpredictable source to create a collection of bits; testing the collection of bits using a plurality of statistical tests of randomness; rejecting the collection of bits if the collection of bits fails any of the plurality of statistical tests of randomness in order to avoid providing the collection of bits when the unpredictable source experiences a failure; providing the collection of bits for use as a source of randomness if the collection of bits passes the plurality of statistical tests of randomness; and repeating sampling, testing, rejecting, and providing such that a plurality of collections of bits are provided for use as a source of randomness.
Claim 18
Dependent Claim
25 words
The process of claim 14, wherein sampling an unpredictable source comprises sampling input received from a microphone connected to an audio port of a computer.
Claim 19
Dependent Claim
100 words
A process for locking master key shares, comprising: generating master key information wherein the master key information can be used in a selected encryption process to encrypt and decipher information; generating locking key information wherein the locking key information can be used in the selected encryption process to encrypt and decipher information; separating the master key information into a plurality of master key shares; and encrypting each master key shares using the locking key information in the selected encryption method such that each master key share is encrypted using an encryption method selected for use with the master key information.
Claim 20
Dependent Claim
100 words
A process for locking master key shares, comprising: generating master key information wherein the master key information can be used in a selected encryption process to encrypt and decipher information; generating locking key information wherein the locking key information can be used in the selected encryption process to encrypt and decipher information; separating the master key information into a plurality of master key shares; and encrypting each master key shares using the locking key information in the selected encryption method such that each master key share is encrypted using an encryption method selected for use with the master key information.
Claim 21
Dependent Claim
17 words
The process of claim 16, wherein the selected encryption process comprises an RSA-based public key encryption process.
Claim 22
Dependent Claim
230 words
A process for cryptographic key generation and safekeeping using a key sharing scheme, comprising: selecting initial values for a minimum number of master key agents, a total number of master key agents, a minimum number of locking key agents, and a total number of locking key agents; determining a risk of loss and a risk of compromise of a master key based upon the initial values; selecting new values for the minimum number of master key agents, the total number of master key agents, the minimum number of locking key agents, and the total number of locking key agents; determining a risk of loss and a risk of compromise of a master key based upon the new values; repeating selecting new values and determining risk to adjust the risk of loss and the risk of compromise; identifying final values for the minimum number of master key agents, the total number of master key agents, the minimum number of locking key agents, and the total number of locking key agents based upon the risk of loss and the risk of compromise such that a desired risk of compromise and loss is set; and generating master key shares equal in number to the final value for the total number of master key agents and locking key shares equal in number to the final value for the total number of locking key agents.
Claim 23
Dependent Claim
230 words
A process for cryptographic key generation and safekeeping using a key sharing scheme, comprising: selecting initial values for a minimum number of master key agents, a total number of master key agents, a minimum number of locking key agents, and a total number of locking key agents; determining a risk of loss and a risk of compromise of a master key based upon the initial values; selecting new values for the minimum number of master key agents, the total number of master key agents, the minimum number of locking key agents, and the total number of locking key agents; determining a risk of loss and a risk of compromise of a master key based upon the new values; repeating selecting new values and determining risk to adjust the risk of loss and the risk of compromise; identifying final values for the minimum number of master key agents, the total number of master key agents, the minimum number of locking key agents, and the total number of locking key agents based upon the risk of loss and the risk of compromise such that a desired risk of compromise and loss is set; and generating master key shares equal in number to the final value for the total number of master key agents and locking key shares equal in number to the final value for the total number of locking key agents.
Claim 24
Dependent Claim
31 words
The process of claim 18, wherein identifying final values comprises setting a desired risk of compromise and loss such that the risk of loss is greater than the risk of compromise.
References Cited (Backward Citations)
US4032763A
Cited
US4200770A
Cited
US4218582A
Cited
US4151404A
Cited
US4405829A
Cited
US4424414A
Cited
US4395703A
Cited
US4673871A
Cited
US4944009A
Cited
US4995082A
Cited
US5057795A
Cited
US5146497A
Cited
US5220603A
Cited
US5515307A
Cited
US5602917A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2000-10-06 | 2001-04-07 | 2001-10-07 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2004-10-06 | 2005-04-07 | 2005-10-07 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2008-10-06 | 2009-04-07 | 2009-10-07 | $7700.00 | Window Closed / Lapsed |