US5721777A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Escrow key management system for accessing encrypted data with portable cryptographic modules
Assignee: Nokia of America Corp
•
Filing: 1994-12-29
•
Granted: 1998-02-24
•
Expires: 2014-12-29
Abstract
Abstract A cryptographic module, such as a smartcard, is designed to a) store decrypting software programs, and information indicative of predetermined conditions under which an escrow agent is enabled to use the software programs stored on the module to decrypt encrypted data files, and b) records for audit purposes, information indicating every time the software programs are used for decryption.
Inventors
- 👤 Matthew A. Blaze
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-05 12:02
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/34; G06Q; G06Q20/00; G06Q20/30; G06Q20/34; G06Q20/341; G06Q20/38; G06Q20/40; G06Q20/409; G06Q20/4093; G06Q20/4097; G06Q20/40975; G07; G07F; G07F7/00; G07F7/08; G07F7/10; G07F7/1008; H; H04; H04L; H04L9/00; H04L9/08; H04L9/0894; H04L9/0897; G06F2211/00; G06F2211/007; G06F2221/00; G06F2221/21; G06F2221/2101
Claims Analysis
Total Claims: 22
Claim 1
Independent Claim
125 words
A cryptographic module for accessing encrypted data stored on a computer system, said cryptographic module comprising a memory which stores a first cryptographic key; and scheduling information for use of said cryptographic module; and a processor which is a) coupled to said memory and said computer system, and b) responsive to receiving via a physical interface a cryptographic passphrase provided by a user, decrypts said encrypted data using a second cryptographic key provided by said computer system, and that is associated with said first cryptographic key, said decryption being performed only when i) said cryptographic passphrase compares favorably to said first, cryptographic key and, ii) a determination is made that said cryptographic passphrase is received within a chosen time frame associated with said scheduling information.
Claim 2
Dependent Claim
125 words
A cryptographic module for accessing encrypted data stored on a computer system, said cryptographic module comprising a memory which stores a first cryptographic key; and scheduling information for use of said cryptographic module; and a processor which is a) coupled to said memory and said computer system, and b) responsive to receiving via a physical interface a cryptographic passphrase provided by a user, decrypts said encrypted data using a second cryptographic key provided by said computer system, and that is associated with said first cryptographic key, said decryption being performed only when i) said cryptographic passphrase compares favorably to said first, cryptographic key and, ii) a determination is made that said cryptographic passphrase is received within a chosen time frame associated with said scheduling information.
Claim 3
Dependent Claim
31 words
The invention of claim 1 wherein said processor stores in said memory transactional information indicative of at least one instance of use of the cryptographic module to decrypt said encrypted data.
Claim 4
Dependent Claim
29 words
The invention of claim 2 wherein said processor overwrites transactional information previously stored on said cryptographic module to record the most recent instance of use of the cryptographic module.
Claim 5
Dependent Claim
103 words
The invention of claim 2 wherein said transactional information includes data indicative of information selected from a group of such information which includes a) time and date for each instance the cryptographic module was used to decrypt the encrypted data, b) amount of information decrypted for each instance of use of the cryptographic module, c) length of time for each instance of use of the cryptographic module, d) number of times the cryptographic module was used to decrypt said stored encrypted data, and e) a summary of times and dates of the usage of the cryptographic module for decrypting said encrypted stored data.
Claim 6
Dependent Claim
71 words
The invention of claim 1 wherein said scheduling information includes parameters for use of said cryptographic module, said parameters including a) the chosen time frame within which said cryptographic module is able to decrypt the encrypted data, b) a date interval within which said cryptographic module is able to decrypt the encrypted data, and c) a limited number of times said cryptographic module can be used to decrypt the encrypted data.
Claim 7
Dependent Claim
12 words
The invention of claim 1 wherein said cryptographic module is a smartcard.
Claim 8
Independent Claim
126 words
A method of providing access to encrypted data stored in a computer system, said method comprising the steps of: receiving a cryptographic passphrase at a portable cryptographic module which has a processor designed to a) compare said cryptographic passphrase to a first cryptographic key which is stored in a memory of said cryptographic module and b) allow access to the encrypted data only during a selected time frame; decrypting encrypted data retrieved from said computer system using a second cryptographic key that is received from said computer system and that is associated with said first cryptographic key, said decryption being performed only when a) said cryptographic passphrase favorably compares to said first cryptographic key, and b) said cryptographic passphrase is received within said selected time frame.
Claim 9
Independent Claim
126 words
A method of providing access to encrypted data stored in a computer system, said method comprising the steps of: receiving a cryptographic passphrase at a portable cryptographic module which has a processor designed to a) compare said cryptographic passphrase to a first cryptographic key which is stored in a memory of said cryptographic module and b) allow access to the encrypted data only during a selected time frame; decrypting encrypted data retrieved from said computer system using a second cryptographic key that is received from said computer system and that is associated with said first cryptographic key, said decryption being performed only when a) said cryptographic passphrase favorably compares to said first cryptographic key, and b) said cryptographic passphrase is received within said selected time frame.
Claim 10
Dependent Claim
27 words
The method of claim 7 further comprising the step of: storing in the memory of the cryptographic module transactional information associated with performance of said decrypting step.
Claim 11
Dependent Claim
25 words
The method of claim 8 further comprising the step of; auditing use of said cryptographic module by retrieving at a later time said transactional information.
Claim 12
Dependent Claim
62 words
The method of claim 8 or 9 wherein more than one cryptographic phrase is assigned to the cryptographic module and wherein said invention further comprises the step of: limiting the scope of use of the cryptographic modules to one or more functions for each cryptographic passphrase, said functions being selected from a group of functions which include said decrypting and said auditing.
Claim 13
Dependent Claim
97 words
The method of claim 8 wherein said transactional information includes data indicative of at least one of a) time and date at which the cryptographic module was used to decrypt the encrypted data files, b) amount of information decrypted for each instance of use of the cryptographic module, c) length of time for each instance of use of the cryptographic module, d) number of times the cryptographic module was used to decrypt said stored encrypted data, and e) a summary of times and dates of the usage of the cryptographic module for decrypting said encrypted stored data.
Claim 14
Dependent Claim
27 words
The method of claim 7 further comprising the step of: authenticating the cryptographic module after it has been used at least once to decrypt said encrypted data.
Claim 15
Independent Claim
154 words
A method of managing access to one or more encrypted data files, said method comprising the steps of: assigning at a data file system a cryptographic key to a cryptographic module which is entrusted to a selected user; storing in a memory of the cryptographic module a) access information allowing use of the cryptographic module by the selected user under specific conditions, said access information including the cryptographic key, at least one corresponding cryptographic passphrase and b) a software program to decrypt the one or more encrypted data files; permitting decryption of said one or more encrypted data tries by the cryptographic module when the selected user provides the cryptographic passphrase corresponding to the autographic key under the specific conditions; and querying said cryptographic module to retrieve transactional information recorded on said autographic module after at least one instance of use of the cryptographic module to decrypt said encrypted data by the selected user.
Claim 16
Independent Claim
154 words
A method of managing access to one or more encrypted data files, said method comprising the steps of: assigning at a data file system a cryptographic key to a cryptographic module which is entrusted to a selected user; storing in a memory of the cryptographic module a) access information allowing use of the cryptographic module by the selected user under specific conditions, said access information including the cryptographic key, at least one corresponding cryptographic passphrase and b) a software program to decrypt the one or more encrypted data files; permitting decryption of said one or more encrypted data tries by the cryptographic module when the selected user provides the cryptographic passphrase corresponding to the autographic key under the specific conditions; and querying said cryptographic module to retrieve transactional information recorded on said autographic module after at least one instance of use of the cryptographic module to decrypt said encrypted data by the selected user.
Claim 17
Dependent Claim
18 words
The method of claim 13 wherein said cryptographic module is disabled if said specific conditions are not met.
Claim 18
Dependent Claim
47 words
The method of claim 13 wherein said specific conditions are selected from a group of conditions which include a) a time frame within which said cryptographic module is functional, b) date interval within which said cryptographic module is functional, and c) number of times said cryptographic module.
Claim 19
Independent Claim
174 words
A system for managing access to one or more encrypted data files stored in a computer system, said system comprising: a file of the computer system which associates a cryptographic key with a cryptographic module that is subsequently assigned to a selected user; a memory of the cryptographic module which stores a) access information allowing use of the cryptographic module by the selected user under specific conditions, said access information including the cryptographic key, a corresponding cryptographic passphrase and a software program to decrypt the one or more encrypted data files; means responsive to receiving at said cryptographic module said corresponding cryptographic passphrase from said selected user, for a) permitting decryption of said one or more data flies when the specific conditions are met, and b) recording in said memory transactional information associated with said decryption, and b) uses said cryptographic module for the purpose of decrypting one or more of said data files; and means for querying at a later time said cryptographic module to retrieve said transactional information recorded on said memory.
Claim 20
Independent Claim
174 words
A system for managing access to one or more encrypted data files stored in a computer system, said system comprising: a file of the computer system which associates a cryptographic key with a cryptographic module that is subsequently assigned to a selected user; a memory of the cryptographic module which stores a) access information allowing use of the cryptographic module by the selected user under specific conditions, said access information including the cryptographic key, a corresponding cryptographic passphrase and a software program to decrypt the one or more encrypted data files; means responsive to receiving at said cryptographic module said corresponding cryptographic passphrase from said selected user, for a) permitting decryption of said one or more data flies when the specific conditions are met, and b) recording in said memory transactional information associated with said decryption, and b) uses said cryptographic module for the purpose of decrypting one or more of said data files; and means for querying at a later time said cryptographic module to retrieve said transactional information recorded on said memory.
Claim 21
Dependent Claim
18 words
The system of claim 16, wherein said cryptographic module is disabled if said specific conditions are not met.
Claim 22
Dependent Claim
52 words
The method of claim 16 wherein said specific conditions are selected from a group of conditions which include a) a time frame within which said cryptographic module is functional, b) a date interval within which said cryptographic module is functional, and c) a limited number of times said cryptographic module is usable.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-02-23 | 2001-08-25 | 2002-02-24 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-02-23 | 2005-08-25 | 2006-02-24 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-02-23 | 2009-08-25 | 2010-02-24 | $7700.00 | Window Closed / Lapsed |