US5748739A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Access control for sensitive functions
Assignee: Fujitsu Services Ltd
•
Filing: 1995-10-16
•
Granted: 1998-05-05
•
Expires: 2015-10-16
Abstract
Abstract A data processing system has a security infrastructure, including a first cryptographic support facility, a security service for user data, including a further cryptographic support facility, and a number of cryptographic algorithms, usable by said cryptographic support facilities. In order to protect against a user replacing weak algorithms intended for the protection of data with strong algorithms intended for use by the security infrastructure, a challenge/response mechanism is provided, which enables the cryptographic support facilities to verify authenticity of the algorithms. The challenge/response mechanism is as follows. First, the cryptographic support facility sends a challenge to the algorithm. The algorithm then generates a response by applying a cryptographic function to the challenge, and returns the response to the cryptographic support facility. The cryptographic support facility then checks whether the response has an expected value. Only upon successful authentication does the algorithm reveal a pointer to a function table. The pointer is encrypted under a shared secret key to prevent an "attacker in the middle" attack.
Inventors
- 👤 James Press
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 16:30
CPC Classifications
H; H04; H04L; H04L9/00; H04L9/32; H04L9/3271; H04L9/3273; H04L9/14
Claims Analysis
Total Claims: 7
Claim 1
Independent Claim
146 words
A data processing system comprising: (a) a cryptographic support facility; and (b) a cryptographic algorithm module, for use by said cryptographic support facility, said cryptographic algorithm module comprising an enquiry function, a plurality of cryptographic functions, and a function table containing pointers to said cryptographic functions; (c) said cryptographic support facility comprising means for issuing a challenge to said enquiry function of said cryptographic algorithm module; (d) said enquiry function of said cryptographic algorithm module comprising means for generating a response to said challenge and for returning said response to said cryptographic support facility along with an encrypted pointer to said function table; and (e) said cryptographic support facility comprising means for checking said response, and for decrypting said encrypted pointer and thereby enabling use of said cryptographic algorithm module by said cryptographic support facility only when said response is equal to an expected response value.
Claim 2
Dependent Claim
146 words
A data processing system comprising: (a) a cryptographic support facility; and (b) a cryptographic algorithm module, for use by said cryptographic support facility, said cryptographic algorithm module comprising an enquiry function, a plurality of cryptographic functions, and a function table containing pointers to said cryptographic functions; (c) said cryptographic support facility comprising means for issuing a challenge to said enquiry function of said cryptographic algorithm module; (d) said enquiry function of said cryptographic algorithm module comprising means for generating a response to said challenge and for returning said response to said cryptographic support facility along with an encrypted pointer to said function table; and (e) said cryptographic support facility comprising means for checking said response, and for decrypting said encrypted pointer and thereby enabling use of said cryptographic algorithm module by said cryptographic support facility only when said response is equal to an expected response value.
Claim 3
Dependent Claim
19 words
A system according to claim 1 wherein said cryptographic support facility is provided by a static link library (SLL).
Claim 4
Dependent Claim
69 words
A system according to claim 1 wherein said cryptographic support facility further includes means for generating a further response, and for returning said further response to said cryptographic algorithm module, and wherein said cryptographic algorithm module comprises means for checking said further response, and for permitting use of said cryptographic algorithm module by said cryptographic support facility only when said further response is equal to an expected further response.
Claim 5
Dependent Claim
23 words
A system according to claim 1 wherein said means for generating a response comprises means for applying a cryptographic function to said challenge.
Claim 6
Dependent Claim
167 words
In a data processing system comprising a cryptographic support facility and a cryptographic algorithm module for use by said cryptographic support facility, said cryptographic algorithm module comprising an enquiry function, a plurality of cryptographic functions, and a function table containing pointers to said cryptographic functions, a method for enabling said cryptographic support facility to verify authenticity of said cryptographic algorithm module, said method comprising the steps: (a) causing said cryptographic support facility to send a challenge to said enquiry function of said cryptographic algorithm module; (b) causing said enquiry function of said cryptographic algorithm module to generate a response by applying a cryptographic function to the challenge, and to return said response to said cryptographic support facility along with an encrypted pointer to said function table; (c) causing said cryptographic support facility to check said response; and (d) decrypting said encrypted pointer and thereby enabling use of said cryptographic algorithm module by said cryptographic support facility only when said response is equal to an expected response value.
Claim 7
Dependent Claim
167 words
In a data processing system comprising a cryptographic support facility and a cryptographic algorithm module for use by said cryptographic support facility, said cryptographic algorithm module comprising an enquiry function, a plurality of cryptographic functions, and a function table containing pointers to said cryptographic functions, a method for enabling said cryptographic support facility to verify authenticity of said cryptographic algorithm module, said method comprising the steps: (a) causing said cryptographic support facility to send a challenge to said enquiry function of said cryptographic algorithm module; (b) causing said enquiry function of said cryptographic algorithm module to generate a response by applying a cryptographic function to the challenge, and to return said response to said cryptographic support facility along with an encrypted pointer to said function table; (c) causing said cryptographic support facility to check said response; and (d) decrypting said encrypted pointer and thereby enabling use of said cryptographic algorithm module by said cryptographic support facility only when said response is equal to an expected response value.
References Cited (Backward Citations)
US4996711A
Cited
US5148479A
Cited
US5159634A
Cited
US5311596A
Cited
EP0592808A2
Cited
US5351293A
Cited
US5420908A
Cited
US5495098A
Cited
US5455862A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-05-04 | 2001-11-03 | 2002-05-05 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-05-04 | 2005-11-03 | 2006-05-05 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-05-04 | 2009-11-03 | 2010-05-05 | $7700.00 | Window Closed / Lapsed |