US5689565A — Cryptography system and method for providing cryp…

Claim 1

Independent Claim 118 words

A cryptography system to support an application requiring cryptographic functions, the cryptography system comprising: a cryptographic application program interface (CAPI) to interface with the application and handle its requests for a cryptographic function; at least one cryptography service provider (CSP) independent from, but dynamically accessible by, the CAPI; the CSP providing the cryptographic function requested by the application, the CSP also managing and protecting at least one encryption key used in the cryptographic function to prevent exposure of the encryption key in a non-encrypted form to the CAPI and application; and a private application program interface (PAPI) to interface the CSP with a user, the PAPI enabling the user to observe, confirm, or reject the requested cryptographic function.

Claim 2

Dependent Claim 118 words

A cryptography system to support an application requiring cryptographic functions, the cryptography system comprising: a cryptographic application program interface (CAPI) to interface with the application and handle its requests for a cryptographic function; at least one cryptography service provider (CSP) independent from, but dynamically accessible by, the CAPI; the CSP providing the cryptographic function requested by the application, the CSP also managing and protecting at least one encryption key used in the cryptographic function to prevent exposure of the encryption key in a non-encrypted form to the CAPI and application; and a private application program interface (PAPI) to interface the CSP with a user, the PAPI enabling the user to observe, confirm, or reject the requested cryptographic function.

Claim 3

Dependent Claim 23 words

A cryptography system as recited in claim 1 wherein the CSP is digitally signed with a digital signature of a certified trusted authority.

Claim 4

Dependent Claim 27 words

A cryptography system as recited in claim 2 wherein the CAPI verifies an authenticity of the CSP by validating the digital signature of the certified trusted authority.

Claim 5

Dependent Claim 19 words

A cryptography system as recited in claim 1 wherein the CSP computes a digital signature of the cryptography system.

Claim 6

Dependent Claim 17 words

A cryptography system as recited in claim 1 wherein the CSP stores at least one encryption key.

Claim 7

Dependent Claim 15 words

A cryptography system as recited in claim 1 wherein the CSP generates the encryption key.

Claim 8

Dependent Claim 18 words

A cryptography system as recited in claim 1 wherein the CSP destroys the encryption key following its use.

Claim 9

Dependent Claim 41 words

A cryptography system as recited in claim 1 wherein the CSP assigns a handle to the encryption key, the handle being made available to the application through the CAPI while the encryption key remains unavailable to the application and the CAPI.

Claim 10

Dependent Claim 28 words

A cryptography system as recited in claim 1 wherein, when the application requests encryption of a message, the CSP hashes at least some data contained in the message.

Claim 11

Dependent Claim 19 words

A cryptography system as recited in claim 1 wherein the CSP is implemented in software as dynamically linked libraries.

Claim 12

Dependent Claim 20 words

A cryptography system as recited in claim 1 wherein the CSP exports the encryption key only in an encrypted form.

Claim 13

Dependent Claim 48 words

A cryptography system as recited in claim 1 wherein, when the application requests encryption of a message, the CSP encrypts the message using a symmetric encryption key and then encrypts the symmetric encryption key using a public key from an asymmetric pair of private and public encryption keys.

Claim 14

Dependent Claim 33 words

A cryptography system as recited in claim 1 wherein the CSP manages at least one asymmetric pair of private and public encryption keys and permanently retains the asymmetric private encryption key in confidence.

Claim 15

Dependent Claim 29 words

A cryptography system as recited in claim 1 further comprising multiple CSPs to perform various ones of the cryptographic functions, said cryptographic functions including encryption, decryption, signing, and verification.

Claim 16

Dependent Claim 26 words

A cryptography system as recited in claim 1 wherein the PAPI presents, to the user, an explanation of the cryptographic function being requested by the application.

Claim 17

Dependent Claim 42 words

A cryptography system as recited in claim 1 wherein, when the application requests a digital signature on a message, the PAPI presents an opportunity for the user to confirm or deny attaching a digital signature before the CSP digitally signs the message.

Claim 18

Dependent Claim 27 words

A cryptography system as recited in claim 1 wherein the PAPI verifies the user's authenticity prior to enabling the user access to the application through the CSP.

Claim 19

Dependent Claim 17 words

A cryptography system as recited in claim 1 wherein the PAPI enables data entry from the user.

Claim 20

Dependent Claim 38 words

A cryptography system as recited in claim 1 wherein, when the application requests use or exportation of a particular encryption key, the PAPI selectively notifies the user when the particular encryption key is to be used or exported.

Claim 21

Dependent Claim 160 words

In a computer system having a processing unit and a computer-readable medium, a computer-implemented cryptography service provider stored on the computer-readable medium for execution on the processing unit as part of a cryptography system used to support a computer executable application requiring encryption or decryption of electronic messages to be sent or received by a user, the cryptography service provider comprising: a key manager to manage encryption keys used to encrypt messages and to prevent the encryption keys from being exported in a non-encrypted form from the cryptography service provider; an encryption/decryption device to encrypt or decrypt messages using the encryption keys; and the cryptography service provider being configured as a dynamic linked library, software module which is dynamically accessible as needed by the application to receive a plaintext message and to return an encrypted message, or to receive an encrypted message and to return a plaintext message, without exposing the encryption keys in their non-encrypted form to the application.

Claim 22

Dependent Claim 160 words

In a computer system having a processing unit and a computer-readable medium, a computer-implemented cryptography service provider stored on the computer-readable medium for execution on the processing unit as part of a cryptography system used to support a computer executable application requiring encryption or decryption of electronic messages to be sent or received by a user, the cryptography service provider comprising: a key manager to manage encryption keys used to encrypt messages and to prevent the encryption keys from being exported in a non-encrypted form from the cryptography service provider; an encryption/decryption device to encrypt or decrypt messages using the encryption keys; and the cryptography service provider being configured as a dynamic linked library, software module which is dynamically accessible as needed by the application to receive a plaintext message and to return an encrypted message, or to receive an encrypted message and to return a plaintext message, without exposing the encryption keys in their non-encrypted form to the application.

Claim 23

Dependent Claim 42 words

A cryptography service provider as recited in claim 20 wherein the encryption/decryption device encrypts individual messages using a symmetric encryption key and then encrypts the symmetric encryption key using a public key from an asymmetric pair of private and public cryptographic keys.

Claim 24

Dependent Claim 23 words

A cryptography service provider as recited in claim 21 wherein the key manager exports the symmetric encryption key only in an encrypted form.

Claim 25

Dependent Claim 35 words

A cryptography service provider as recited in claim 20 wherein the key manager manages at least one asymmetric pair of private and public cryptographic keys and permanently retains the asymmetric private cryptographic key in confidence.

Claim 26

Dependent Claim 21 words

A cryptography service provider as recited in claim 20 where in the key manager stores at least one unique encryption key.

Claim 27

Dependent Claim 24 words

A cryptography service provider as recited in claim 20 further comprising a key generator to produce the encryption keys used to encrypt the message.

Claim 28

Dependent Claim 36 words

A cryptography service provider as recited in claim 20 wherein the key manager assigns handles to the encryption keys which are made available to the application, while maintaining the encryption keys themselves unavailable to the application.

Claim 29

Dependent Claim 24 words

A cryptography service provider as recited in claim 20 further comprising a hashing calculator to hash at least some data contained in the messages.

Claim 30

Independent Claim 85 words

A method for supporting cryptographic functions requested by an application, the method comprising the following steps: supplying a request for a cryptographic function to a cryptographic application program interface (CAPI); selecting a cryptography service provider (CSP) to perform the desired cryptographic function; establishing communication between the CAPI and the CSP; verifying an authenticity of the CSP; performing the cryptographic function at the CSP using at least one cryptographic key; and preventing exposure of the encryption key in a non-encrypted form to the CAPI or application.

Claim 31

Independent Claim 85 words

A method for supporting cryptographic functions requested by an application, the method comprising the following steps: supplying a request for a cryptographic function to a cryptographic application program interface (CAPI); selecting a cryptography service provider (CSP) to perform the desired cryptographic function; establishing communication between the CAPI and the CSP; verifying an authenticity of the CSP; performing the cryptographic function at the CSP using at least one cryptographic key; and preventing exposure of the encryption key in a non-encrypted form to the CAPI or application.

Claim 32

Dependent Claim 27 words

A method as recited in claim 28 wherein the performing step comprises performing a cryptographic function selected from a group comprising encryption, decryption, digital signing, and verification.

Claim 33

Dependent Claim 41 words

A method as recited in claim 28 further comprising presenting information concerning the requested cryptographic from the CSP through a private application program interface (PAPI) to a user to enable the user to observe, confirm, or reject the requested cryptographic function.

Claim 34

Independent Claim 95 words

A method for encrypting a message comprising the following steps: supplying a plaintext message to a cryptographic application program interface (CAPI); selecting a cryptography service provider (CSP) for encrypting the message; establishing communication between the CAPI and the CSP; verifying an authenticity of the CSP; passing the plaintext message from the CAPI to the CSP; encrypting the message at the CSP using an encryption key maintained by the CSP to produce an encrypted message; and passing the encrypted message from the CSP back to the CAPI without exposing the encryption key in its non-encrypted form.

Claim 35

Independent Claim 95 words

A method for encrypting a message comprising the following steps: supplying a plaintext message to a cryptographic application program interface (CAPI); selecting a cryptography service provider (CSP) for encrypting the message; establishing communication between the CAPI and the CSP; verifying an authenticity of the CSP; passing the plaintext message from the CAPI to the CSP; encrypting the message at the CSP using an encryption key maintained by the CSP to produce an encrypted message; and passing the encrypted message from the CSP back to the CAPI without exposing the encryption key in its non-encrypted form.

Claim 36

Dependent Claim 43 words

A method as recited in claim 31 wherein the encrypting step comprises the following steps: encrypting the message with a symmetric encryption key; and encrypting the symmetric encryption key with a public key from an asymmetric pair of private and public cryptographic keys.

Claim 37

Dependent Claim 28 words

A method as recited in claim 32 wherein the encrypting step comprises the step of passing the encrypted symmetric encryption key to the CAPI along with the message.

Claim 38

Dependent Claim 36 words

A method as recited in claim 31 wherein the verifying step comprises the following steps: attaching a digital signature of a certified trusted authority to the CSP; and validating the digital signature to authenticate the CSP.

Claim 39

Dependent Claim 23 words

A method as recited in claim 31 further comprising the step of attaching a digital signature of the cryptography system to the message.

Claim 40

Dependent Claim 22 words

A method as recited in claim 31 further comprising the step of storing within the CSP at least one unique encryption key.

Claim 41

Dependent Claim 24 words

A method as recited in claim 31 further comprising the step of generating within the CSP the encryption key used to encrypt the message.

Claim 42

Dependent Claim 19 words

A method as recited in claim 31 further comprising the step of destroying the encryption key following its use.

Claim 43

Dependent Claim 37 words

A method as recited in claim 31 further comprising the following steps: assigning a handle to the encryption key; and making the handle available to the CAPI while maintaining the encryption key in confidence within the CSP.

Claim 44

Dependent Claim 24 words

A method as recited in claim 31 further comprising the step of hashing within the CSP at least some data contained in the message.

Claim 45

Dependent Claim 40 words

A method as recited in claim 31 further comprising the following steps: passing an explanation of the message to a private application program interface (PAPI) used to interface the CSP with a user; and presenting the explanation to the user.

Claim 46

Dependent Claim 29 words

A method as recited in claim 41 further comprising the step of verifying at the PAPI an authenticity of the user prior to presenting the explanation of the message.

Claim 47

Dependent Claim 21 words

A method as recited in claim 41 further comprising the step of enabling data entry from the user through the PAPI.

Claim 48

Dependent Claim 28 words

A method as recited in claim 41 further comprising the step of selectively notifying the user via the PAPI when a particular encryption key is to be used.

Claim 49

Dependent Claim 17 words

A computer-readable medium having computer-executable instructions for performing the steps in the method recited in claim 28.

Claim 50

Dependent Claim 17 words

A computer-readable medium having computer-executable instructions for performing the steps in the method recited in claim 31.

Claim 51

Dependent Claim 105 words

A computer-readable medium having a computer-executable instructions for implementing a cryptography system, comprising: a cryptographic application program interface (CAPI) configured as a software module to interface with a computer-implemented application and to handle requests from the application for a cryptographic function; at least one cryptography service provider (CSP) configured as a software module independent from, but dynamically accessible by, the CAPI; the CSP providing the cryptographic function requested by the software application, the CSP also managing and protecting at least one encryption key used in the cryptographic function to prevent exposure of the encryption key in a non-encrypted form to the CAPI and software application.

Claim 52

Dependent Claim 105 words

A computer-readable medium having a computer-executable instructions for implementing a cryptography system, comprising: a cryptographic application program interface (CAPI) configured as a software module to interface with a computer-implemented application and to handle requests from the application for a cryptographic function; at least one cryptography service provider (CSP) configured as a software module independent from, but dynamically accessible by, the CAPI; the CSP providing the cryptographic function requested by the software application, the CSP also managing and protecting at least one encryption key used in the cryptographic function to prevent exposure of the encryption key in a non-encrypted form to the CAPI and software application.

Claim 53

Dependent Claim 51 words

A computer-readable medium as recited in claim 47, further comprising a private application program interface (PAPI) configured as a software module independent from the CAPI and CSP, the PAPI being configured to interface the CSP with a user and enable the user to observe, confirm, or reject the requested cryptographic function.

Claim 54

Dependent Claim 48 words

A computer-readable medium as recited in claim 47, wherein: the CSP module is digitally signed with a digital signature of a certified trusted authority; and the CAPI module verifies an authenticity of the CSP when accessing the CSP by validating the digital signature of the certified trusted authority.

Annuity Stage	Window Opens	Payment Deadline	Surcharge Period Until	Estimated Fee	Status
3.5 Years (Year 4)	2000-11-17	2001-05-19	2001-11-18	$2000.00	Window Closed / Lapsed
7.5 Years (Year 8)	2004-11-17	2005-05-19	2005-11-18	$3760.00	Window Closed / Lapsed
11.5 Years (Year 12)	2008-11-17	2009-05-19	2009-11-18	$7700.00	Window Closed / Lapsed

Cryptography system and method for providing cryptographic services for a computer application

Abstract

Inventors

Bibliographic Details

Claims Analysis

References Cited (Backward Citations)

USPTO Annuity & Maintenance Windows

Assigned Categories & Tags

Assign Category Tag