US5778072A
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method to transparently integrate private key operations from a smart card with host-based encryption services
Assignee: Sun Microsystems Inc
•
Filing: 1995-07-07
•
Granted: 1998-07-07
•
Expires: 2015-07-07
Abstract
Abstract A system and method provide transparent integration of a smart card private key operations with an existing set of encryption services and system applications. A key store manager manages user key data, and handles requests for key operations from the system applications. A user information file stores user data, including user private keys for users that do not have smart cards, and an indication of those users that have smart cards. A set of system applications interfaces with the key store manager through encryption protocol specific application programming interfaces. Users connect to the system through terminals or remote computers that may be equipped with smart card readers. For users having smart cards, the key store manager forwards to the smart cards requests for private key operations, such as encryption or decryption with the user's private key, from the system applications. In this manner the user's private key cannot be compromised by exposure to the computer system. For users without smart cards the key store manager forwards the request for private key operation to an encryption service for handling. The key store manager may handle only requests for private key operations, with the system applications identifying and handling directly public key operations, or the key store manager may handle both private key and public key operations.
Inventors
- 👤 Vipin Samar
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-05 05:33
CPC Classifications
G; G07; G07F; G07F7/00; G07F7/08; G07F7/10; G07F7/1008; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/34; G06Q; G06Q20/00; G06Q20/30; G06Q20/34; G06Q20/341; G06Q20/38; G06Q20/40; G06Q20/409; G06Q20/4097; G06Q20/40975; G06F2221/00; G06F2221/21; G06F2221/2103
Claims Analysis
Total Claims: 21
Claim 1
Independent Claim
200 words
A computer system integrating at least one encryption service that provides at least one key operation with a smart card providing at least one key operation, comprising: at least one smart card that provides at least one key operation for a private key of a user, and that non-readably stores the private key of the user; and, a computer including: at least one computer executable application program capable of requesting a key operation; and, a key store manager that communicatively couples to the application program and receives therefrom a request for a key operation for a first user, the key store manager determining whether the first user has a first smart card, and responsive to the first user having first smart card, the key store manager communicatively coupling to the first smart card and providing thereto the request for a key operation on a first private key of the first user, the first smart card providing a key operation on the first private key; and responsive to the first user not having the first smart card, the key store manager communicatively coupling to a first encryption service, the first encryption service providing a key operation on the first private key.
Claim 2
Dependent Claim
200 words
A computer system integrating at least one encryption service that provides at least one key operation with a smart card providing at least one key operation, comprising: at least one smart card that provides at least one key operation for a private key of a user, and that non-readably stores the private key of the user; and, a computer including: at least one computer executable application program capable of requesting a key operation; and, a key store manager that communicatively couples to the application program and receives therefrom a request for a key operation for a first user, the key store manager determining whether the first user has a first smart card, and responsive to the first user having first smart card, the key store manager communicatively coupling to the first smart card and providing thereto the request for a key operation on a first private key of the first user, the first smart card providing a key operation on the first private key; and responsive to the first user not having the first smart card, the key store manager communicatively coupling to a first encryption service, the first encryption service providing a key operation on the first private key.
Claim 3
Dependent Claim
57 words
The computer system of claim 1, further comprising: a computer readable storage facility that stores user data for selected users, the user data identifying the user and whether the user has a smart card; wherein the key store manager communicatively couples to and determines from the storage facility whether the first user has a first smart card.
Claim 4
Dependent Claim
36 words
The computer system of claim 1, wherein each application program determines whether a key operation is a private key operation or a public key operation, and provides to the key store manager only private key operations.
Claim 5
Dependent Claim
23 words
The computer system of claim 1, wherein each application program requests the key store manager both private key operations and public key operations.
Claim 6
Dependent Claim
35 words
The computer system of claim 1, wherein responsive to the first user not having the first smart card, the key store manager obtains the first private key and provides it to the first encryption service.
Claim 7
Dependent Claim
27 words
The computer system of claim 1, wherein responsive to the first user not having the first smart card, the first encryption service obtains the first private key.
Claim 8
Dependent Claim
242 words
In a computer system having at least one smart card providing at least one key operation for a private key of a user, and non-readably storing the private key of a user, a computer readable storage facility that stores user data for selected users, the user data indicating whether a user has been authenticated to the computer system by a smart card, at least one computer executable encryption service providing at least one key operation, and at least one computer executable application program capable of requesting a key operation, a computer readable medium including a computer executable program controlling the operation of the computer to provide smart card and host-based encryption, and comprising: a key store manager capable of communicatively coupling to the application program and receiving therefrom a request for a key operation for a first user, the key store manager capable of communicatively coupling to and determining from the storage facility whether the first user has a first smart card, and responsive to the first user having a first smart card, the key store manager capable of communicatively coupling to the first smart card and providing thereto a request for a key operation on a first private key of the first user; and responsive to the first user not having the first smart card, the key store manager capable of communicatively coupling to a first encryption service, the first encryption service providing a key operation on the first private key.
Claim 9
Dependent Claim
242 words
In a computer system having at least one smart card providing at least one key operation for a private key of a user, and non-readably storing the private key of a user, a computer readable storage facility that stores user data for selected users, the user data indicating whether a user has been authenticated to the computer system by a smart card, at least one computer executable encryption service providing at least one key operation, and at least one computer executable application program capable of requesting a key operation, a computer readable medium including a computer executable program controlling the operation of the computer to provide smart card and host-based encryption, and comprising: a key store manager capable of communicatively coupling to the application program and receiving therefrom a request for a key operation for a first user, the key store manager capable of communicatively coupling to and determining from the storage facility whether the first user has a first smart card, and responsive to the first user having a first smart card, the key store manager capable of communicatively coupling to the first smart card and providing thereto a request for a key operation on a first private key of the first user; and responsive to the first user not having the first smart card, the key store manager capable of communicatively coupling to a first encryption service, the first encryption service providing a key operation on the first private key.
Claim 10
Dependent Claim
62 words
The computer readable medium of claim 7, further comprising: a computer readable storage facility that stores user data for selected users, the user data identifying the user and whether the user has a smart card; and, wherein the key store manager is capable of communicatively couples to and determining from the storage facility whether the first user has a first smart card.
Claim 11
Dependent Claim
36 words
The computer system of claim 7, wherein each application program determines whether a key operation is a private key operation or a public key operation, and provides to the key store manager only private key operations.
Claim 12
Dependent Claim
24 words
The computer system of claim 7, wherein each application program provides to the key store manager both private key operations and public key operations.
Claim 13
Dependent Claim
27 words
The computer system of claim 7, wherein responsive to the first user not having the first smart card, the first encryption service obtains the first private key.
Claim 14
Dependent Claim
125 words
In a computer system having at least one encryption service providing at least one key operation, a computer implemented method of providing a user smart card capable of providing at least one private key operation on a user private key stored thereon, comprising the steps of: receiving a request from an application program for a private key operation on the private key of the user; determining whether the user has a smart card; responsive to the user having a smart card, transmitting the request to the smart card, the smart card providing the private key operation; and, responsive to the user not having a smart card, performing the step of: transmitting the request to the encryption service, the encryption service providing the private key operation.
Claim 15
Dependent Claim
125 words
In a computer system having at least one encryption service providing at least one key operation, a computer implemented method of providing a user smart card capable of providing at least one private key operation on a user private key stored thereon, comprising the steps of: receiving a request from an application program for a private key operation on the private key of the user; determining whether the user has a smart card; responsive to the user having a smart card, transmitting the request to the smart card, the smart card providing the private key operation; and, responsive to the user not having a smart card, performing the step of: transmitting the request to the encryption service, the encryption service providing the private key operation.
Claim 16
Dependent Claim
54 words
The method of claim 12, further comprising the step of: storing in a computer readable medium user data identifying the user and indicating whether a user has a smart card; and, wherein the step of determining whether the user has a smart card further comprises reading from the computer readable medium the user data.
Claim 17
Dependent Claim
61 words
The method of claim 12, further comprising the steps of: connecting the user to the computer system; determining whether the user has a smart card; responsive to the user having a smart card, performing the steps of: coupling the smart card to the computer system; and, storing in the computer readable medium data indicating that the user has a smart card.
Claim 18
Dependent Claim
41 words
The method of claim 14, further comprising the steps of: responsive to the user not having a smart card, performing the step of: storing in a computer readable medium facility data identifying the user and a private key of the user.
Claim 19
Dependent Claim
40 words
The method of claim 14, further comprising the steps of: determining whether the smart card is uncoupled from the computer system; and responsive to the smart card being uncoupled from the computer system, disconnecting the user from the computer system.
Claim 20
Dependent Claim
21 words
The method of claim 15, further comprising the step of: obtaining a private key of the user from a storage facility.
Claim 21
Dependent Claim
22 words
The method of claim 12, further comprising the step of: returning to the application program a result of the private key operation.
References Cited (Backward Citations)
US4944007A
Cited
US5191611A
Cited
US5124117A
Cited
US5282249A
Cited
US5142578A
Cited
US5307411A
Cited
US5265164A
Cited
US5602915A
Cited
US5299263A
Cited
US5406628A
Cited
US5402492A
Cited
US5432852A
Cited
US5581615A
Cited
US5588061A
Cited
US5541994A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-07-06 | 2002-01-05 | 2002-07-07 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-07-06 | 2006-01-05 | 2006-07-07 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-07-06 | 2010-01-05 | 2010-07-07 | $7700.00 | Window Closed / Lapsed |