US5761306A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Key replacement in a public key cryptosystem
Assignee: Visa International Service Association
•
Filing: 1996-02-22
•
Granted: 1998-06-02
•
Expires: 2016-02-22
Abstract
Abstract Improved key management is provided by a public key replacement apparatus and method for operating over insecure networks. An active public key and the mask of a replacement public key are provided by a key server to nodes where the active key is used to encrypt and verify messages. To replace the active public key with the replacement public key, a key replacement message is sent to the node. The key replacement message contains the replacement public key and contains the mask of the next replacement key. The mask of the replacement public key may be generated by hashing or encrypting. The key replacement message is signed by the active public key and the replacement public key. Nodes are implemented by a computer, a smart card, a stored data card in combination with a publicly accessible node machine, or other apparatus for sending and/or receiving messages. In a particular application, a financial transaction network, nodes are consumer nodes, merchant nodes, or both, and transactions are securely sent over a possible insecure network.
Inventors
- 👤 Tony Lewis
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-29 04:58
CPC Classifications
G; G06; G06Q; G06Q20/00; G06Q20/38; G06Q20/382; G06Q20/3829; H; H04; H04L; H04L9/00; H04L9/08; H04L9/0891; H04L2209/00; H04L2209/56
Claims Analysis
Total Claims: 23
Claim 1
Independent Claim
265 words
A method of secure public key replacement in a public key cryptography system, wherein secure messages are transmitted from a first node to a second node over a network presumed to be insecure, the method comprising the steps of: generating, at the first node, an active key pair comprising an active private key and an active public key, wherein the active key pair is used to secure messages between the first and second nodes according to a public key scheme; generating, at the first node, a replacement key pair comprising a replacement private key and a replacement public key; generating at the first node, a mask of the replacement public key; sending the active public key and the mask of the replacement public key from the first node to the second node over a secure channel; when the active key pair is to be retired, performing the steps of: generating, at the first node, the next replacement key pair comprising the next replacement private key and the next replacement public key; generating, at the first node, the mask of the next replacement public key; sending a key replacement message including the replacement public key from the first node to the second node over the network; and verifying, at the second node, the replacement public key; and thereafter using the replacement key pair as the active key pair, for use in securing messages between the first and second nodes, and thereafter using the next replacement key pair in place of the replacement key pair, which is stored for use in a subsequent key pair retiring step.
Claim 2
Independent Claim
265 words
A method of secure public key replacement in a public key cryptography system, wherein secure messages are transmitted from a first node to a second node over a network presumed to be insecure, the method comprising the steps of: generating, at the first node, an active key pair comprising an active private key and an active public key, wherein the active key pair is used to secure messages between the first and second nodes according to a public key scheme; generating, at the first node, a replacement key pair comprising a replacement private key and a replacement public key; generating at the first node, a mask of the replacement public key; sending the active public key and the mask of the replacement public key from the first node to the second node over a secure channel; when the active key pair is to be retired, performing the steps of: generating, at the first node, the next replacement key pair comprising the next replacement private key and the next replacement public key; generating, at the first node, the mask of the next replacement public key; sending a key replacement message including the replacement public key from the first node to the second node over the network; and verifying, at the second node, the replacement public key; and thereafter using the replacement key pair as the active key pair, for use in securing messages between the first and second nodes, and thereafter using the next replacement key pair in place of the replacement key pair, which is stored for use in a subsequent key pair retiring step.
Claim 3
Dependent Claim
78 words
The method of claim 1, wherein the process of retiring the active key pair further comprises the steps of: sending, from the first node to the second node, the mask of the next replacement public key; and sending, from the first node to the second node, digital signatures for providing to the second node that the active private key and the replacement private key were known to the initiator of the process for retiring the active key pair.
Claim 4
Dependent Claim
40 words
The method of claim 1, further comprising the step of sending a message from the first node to the second node, wherein the message is digitally signed using either the active private key or the replacement private key or both.
Claim 5
Dependent Claim
39 words
The method of claim 1, further comprising the step of sending a message from the second node to the first node, wherein the message is encrypted using either the active public key or the replacement public key or both.
Claim 6
Dependent Claim
65 words
The method of claim 1, wherein replacement of the mask of the replacement public key with the mask of the next replacement public key is performed at the second node and is performed synchronously with the replacement of the active private key with the replacement private key and the replacement of the replacement private key with the next replacement private key at the first node.
Claim 7
Dependent Claim
26 words
The method of claim 1, wherein the first node is a key server node and the second node is one of a plurality of user nodes.
Claim 8
Dependent Claim
26 words
The method of claim 1, wherein the first node is one of a plurality of user nodes and the second node is a key server node.
Claim 9
Dependent Claim
33 words
The method of claim 1, wherein the network connects a plurality of nodes to each other, the plurality of nodes comprising a plurality of key server nodes and a plurality of user nodes.
Claim 10
Dependent Claim
18 words
The method of claim 1, further comprising the step of repeating the step of retiring a key pair.
Claim 11
Dependent Claim
28 words
The method of claim 1 wherein said step of generating the mask of the replacement public key is accomplished by generating a hash of the replacement public key.
Claim 12
Dependent Claim
24 words
The method of claim 10 wherein said step of generating a hash of the replacement public key is accomplished by using MD5 hashing algorithm.
Claim 13
Dependent Claim
25 words
The method of claim 10 wherein said step of generating a hash of the replacement public key is accomplished by using SHA 1 hashing algorithm.
Claim 14
Dependent Claim
25 words
The method of claim 1 wherein said step of generating the mask of the replacement public key is accomplished by encrypting the replacement public key.
Claim 15
Independent Claim
202 words
A method of secure public key replacement in a public key cryptography system, wherein a first node stores an active private key and a second node stores an active public key and a replacement public key, the active public key and the active private key being an active key pair used for public key cryptography and the replacement public key and the replacement private key being a replacement key pair, and wherein the replacement public key is stored as an encrypted replacement public key at the second node, the method comprising the steps of: generating, at the first node, a next replacement key pair comprising a next replacement private key and a next replacement public key; generating, at the first node, a mask of the next replacement public key; sending the replacement public key from the first node to the second node; verifying, at the second node, the encrypted replacement public key; and thereafter using the replacement key pair as the active key pair, for use in securing messages between the first and second nodes, and thereafter using the next replacement key pair in place of the replacement key pair, which is stored for use in the subsequent key pair retiring step.
Claim 16
Independent Claim
202 words
A method of secure public key replacement in a public key cryptography system, wherein a first node stores an active private key and a second node stores an active public key and a replacement public key, the active public key and the active private key being an active key pair used for public key cryptography and the replacement public key and the replacement private key being a replacement key pair, and wherein the replacement public key is stored as an encrypted replacement public key at the second node, the method comprising the steps of: generating, at the first node, a next replacement key pair comprising a next replacement private key and a next replacement public key; generating, at the first node, a mask of the next replacement public key; sending the replacement public key from the first node to the second node; verifying, at the second node, the encrypted replacement public key; and thereafter using the replacement key pair as the active key pair, for use in securing messages between the first and second nodes, and thereafter using the next replacement key pair in place of the replacement key pair, which is stored for use in the subsequent key pair retiring step.
Claim 17
Dependent Claim
31 words
The method of claim 14, wherein the step of sending the replacement public key from the first node to the second node is performed over a network presumed to be secure.
Claim 18
Dependent Claim
28 words
The method of claim 14 wherein the step of generating a mask of the replacement public key is accomplished by generating a hash of the replacement public key.
Claim 19
Dependent Claim
15 words
The method of claim 16 wherein said hash is generated using the MD5 hashing algorithm.
Claim 20
Dependent Claim
15 words
The method of claim 16 wherein said hash is generated using the SHA 1 algorithm.
Claim 21
Dependent Claim
25 words
The method of claim 14 wherein the step of generating the mask of the replacement public key is accomplished by encrypting the replacement public key.
Claim 22
Independent Claim
224 words
A method of secure public key replacement in a public key cryptography system, wherein secure messages are transmitted from a first node to a second node over a network presumed to be insecure, the method comprising the steps of: generating, at the first node, an active key pair comprising an active private key and an active public key, wherein the active key pair is used to secure messages between the first and second nodes according to a public key scheme; generating, at the first node, a replacement key pair comprising a replacement private key and a replacement public key; sending the active public key and the replacement public key from the first node to the second node over a secure channel; when the active key pair is to be retired, performing the steps of: generating, at the first node, a next replacement key pair comprising a next replacement private key and a next replacement public key; and sending the next replacement public key from the first node to the second node over the network; and thereafter using the replacement key pair as the active key pair, for use in securing messages between the first and second nodes, and thereafter using the next replacement key pair in place of the replacement key pair, which is stored for use in a subsequent key pair retiring step.
Claim 23
Independent Claim
224 words
A method of secure public key replacement in a public key cryptography system, wherein secure messages are transmitted from a first node to a second node over a network presumed to be insecure, the method comprising the steps of: generating, at the first node, an active key pair comprising an active private key and an active public key, wherein the active key pair is used to secure messages between the first and second nodes according to a public key scheme; generating, at the first node, a replacement key pair comprising a replacement private key and a replacement public key; sending the active public key and the replacement public key from the first node to the second node over a secure channel; when the active key pair is to be retired, performing the steps of: generating, at the first node, a next replacement key pair comprising a next replacement private key and a next replacement public key; and sending the next replacement public key from the first node to the second node over the network; and thereafter using the replacement key pair as the active key pair, for use in securing messages between the first and second nodes, and thereafter using the next replacement key pair in place of the replacement key pair, which is stored for use in a subsequent key pair retiring step.
References Cited (Backward Citations)
US4405829A
Cited
US4453074A
Cited
US4578531A
Cited
US4799258A
Cited
US4972472A
Cited
US4688250A
Cited
US4850018A
Cited
US4993067A
Cited
US4926478A
Cited
US5365225A
Cited
US5046125A
Cited
US5144664A
Cited
US5309516A
Cited
US5208859A
Cited
US5214698A
Cited
US5325434A
Cited
US5164988A
Cited
US5265164A
Cited
US5325432A
Cited
US5465206A
Cited
US5465206B1
Cited
US5499294A
Cited
US5469507A
Cited
US5506905A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-06-01 | 2001-12-01 | 2002-06-02 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-06-01 | 2005-12-01 | 2006-06-02 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-06-01 | 2009-12-01 | 2010-06-02 | $7700.00 | Window Closed / Lapsed |