US6148083A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Application certification for an international cryptography framework
Assignee: HP Inc
•
Filing: 1996-08-23
•
Granted: 2000-11-14
•
Expires: 2016-08-23
Abstract
Abstract An application which requests cryptographic services from various service elements within an international cryptography framework is identified through a certificate to protect against the misuse of a granted level of cryptography. A cryptographic unit, one of the framework core elements, builds several certification schemes for application objects. One or more methods are provided that establish a degree of binding between an application code image and issued certificates using the framework elements. Within the framework, the application is assured of the integrity of the cryptographic unit from which it is receiving services. One or more mechanisms are provided which allow the application to validate that the cryptographic unit has not been replaced or tampered with.
Inventors
- 👤 Helmut Fieres
- 👤 Roger Merkling
- 👤 Keith Klemba
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-29 14:18
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/602; G06F2211/00; G06F2211/007
Claims Analysis
Total Claims: 38
Claim 1
Independent Claim
59 words
An apparatus for certifying applications, comprising: a security domain authority for granting at least one class of service to an application; an application domain authority for receiving said class of service granted by said security domain authority; and at least one application certificate issued by said application domain authority to applications that belong to an application domain authority domain.
Claim 2
Independent Claim
59 words
An apparatus for certifying applications, comprising: a security domain authority for granting at least one class of service to an application; an application domain authority for receiving said class of service granted by said security domain authority; and at least one application certificate issued by said application domain authority to applications that belong to an application domain authority domain.
Claim 3
Dependent Claim
18 words
The apparatus of claim 1, said application certificate comprising: an application ID; and said granted class of service.
Claim 4
Dependent Claim
31 words
The apparatus of claim 1, further comprising: a processing unit for receiving said application certificate to determine whether said application has a right to access a requested cryptographic class of service.
Claim 5
Dependent Claim
36 words
The apparatus of claim 3, further comprising: a policy element that enables said processing unit for said granted class of service, wherein any mismatch between said policy element and said processing unit invalidates said processing unit.
Claim 6
Independent Claim
55 words
A method of validating that an application rightfully executes a class of service as it was granted by an application domain authority, comprising the steps of: issuing an application certificate containing a valid class of services; and tightly binding said application to said application certificate to establish trust between said application and a target processor.
Claim 7
Independent Claim
55 words
A method of validating that an application rightfully executes a class of service as it was granted by an application domain authority, comprising the steps of: issuing an application certificate containing a valid class of services; and tightly binding said application to said application certificate to establish trust between said application and a target processor.
Claim 8
Independent Claim
66 words
A method for processing unit validation in which an application that requests processing services is assured about the identity of said processing unit, comprising the steps of: challenging said processing unit; and issuing a puzzle to said processing unit that only said processing unit is able to resolve, wherein said processing unit's ability to solve said puzzle is proof of the identity of said processing unit.
Claim 9
Independent Claim
66 words
A method for processing unit validation in which an application that requests processing services is assured about the identity of said processing unit, comprising the steps of: challenging said processing unit; and issuing a puzzle to said processing unit that only said processing unit is able to resolve, wherein said processing unit's ability to solve said puzzle is proof of the identity of said processing unit.
Claim 10
Independent Claim
77 words
A method for processing unit validation in which an application that requests processing services is assured about the identity of said processing unit, comprising the steps of: shipping said application to a target system in a scrambled form; and using said processing unit to prepare said application to function; wherein only a processing unit that has a correct key that is able to unscramble said application, thereby establishing that said processing unit is a valid processing unit.
Claim 11
Independent Claim
77 words
A method for processing unit validation in which an application that requests processing services is assured about the identity of said processing unit, comprising the steps of: shipping said application to a target system in a scrambled form; and using said processing unit to prepare said application to function; wherein only a processing unit that has a correct key that is able to unscramble said application, thereby establishing that said processing unit is a valid processing unit.
Claim 12
Independent Claim
96 words
A method for producing a certified application in which there is a tight binding between an application image and an application certificate issued by an application domain authority, comprising the steps of: performing an installation stage that introduces said application and delivers an accompanying application certificate to a target processing unit; performing a validation stage that validates said application identity, based upon passing said application certificate along with a validation request; and after successful validation; and entering an execution stage during which said processing unit is able to issue a validation request to revalidate said application.
Claim 13
Independent Claim
96 words
A method for producing a certified application in which there is a tight binding between an application image and an application certificate issued by an application domain authority, comprising the steps of: performing an installation stage that introduces said application and delivers an accompanying application certificate to a target processing unit; performing a validation stage that validates said application identity, based upon passing said application certificate along with a validation request; and after successful validation; and entering an execution stage during which said processing unit is able to issue a validation request to revalidate said application.
Claim 14
Dependent Claim
21 words
The method of claim 8, further comprising the steps of: introducing certified applications to said target processor at said installation stage.
Claim 15
Dependent Claim
23 words
The method of claim 8, said certified application comprising: said application image; and said application certificate, which issued by an application domain authority.
Claim 16
Dependent Claim
30 words
The method of claim 8, wherein said installation stage produces an application credential which uniquely denotes said application, said target processor, and a valid class of services for said application.
Claim 17
Dependent Claim
50 words
The method of claim 8, further comprising the steps of: receiving a request for installation; computing a hash value from said application image with said target processor; using said hash value and a class of service defined for said application certificate to produce an application credential that identifies said application.
Claim 18
Dependent Claim
27 words
The method of claim 12, further comprising the steps of: signing said application credential with said target processor; and storing said application credential in a local memory.
Claim 19
Independent Claim
73 words
An apparatus for certifying applications, comprising: an application domain authority for issuing at least one application certificate to at least one application that belongs to an application domain authority domain, said application certificate uniquely denoting any of said application, a target processor, and a valid class of services for said application; and a target processor for receiving said application certificate to determine whether said application has a right to access a requested function.
Claim 20
Independent Claim
73 words
An apparatus for certifying applications, comprising: an application domain authority for issuing at least one application certificate to at least one application that belongs to an application domain authority domain, said application certificate uniquely denoting any of said application, a target processor, and a valid class of services for said application; and a target processor for receiving said application certificate to determine whether said application has a right to access a requested function.
Claim 21
Dependent Claim
21 words
The apparatus of claim 14, said application certificate comprising: an application ID; and a grant of said valid class of services.
Claim 22
Dependent Claim
22 words
The apparatus of claim 14, further comprising: a security domain authority for granting at least one class of service to an application.
Claim 23
Dependent Claim
23 words
The apparatus of claim 14, further comprising: an application domain authority for receiving a class of service granted by a security domain authority.
Claim 24
Dependent Claim
36 words
The apparatus of claim 14, further comprising: a policy element that enables said target processor for a granted class of service, wherein any mismatch between said policy element and said target processor invalidates said target processor.
Claim 25
Dependent Claim
27 words
The apparatus of claim 18, wherein said target processor is a cryptographic unit that does not provide any cryptographic functions in the absence of said policy element.
Claim 26
Dependent Claim
22 words
The apparatus of claim 14, further comprising: software touchpoints that are not usable by a host system environment unless they are transformed.
Claim 27
Dependent Claim
37 words
The apparatus of claim 20, said software touchpoints further comprising: instruction sequences in a code image which have been transformed in a way such that an instruction fetch unit of said host system cannot decode them successfully.
Claim 28
Dependent Claim
25 words
The apparatus of claim 20, said software touchpoints further comprising: data areas which have been altered in a way that original data is not accessible.
Claim 29
Dependent Claim
21 words
The apparatus of claim 20, said software touchpoints further comprising: data level touchpoints that describe an area inside a data object.
Claim 30
Dependent Claim
52 words
The apparatus of claim 20, said software touchpoints further comprising: instruction level touchpoints that describe touchpoints inside an instruction stream, where either of an area in the instruction stream is replaced by said touchpoint or said touchpoint is structured to start and end with a special instruction which demarcates a touchpoint area.
Claim 31
Dependent Claim
24 words
The apparatus of claim 20, said software touchpoints further comprising: software level touchpoints that prevent an application image from being copied to another system.
Claim 32
Dependent Claim
28 words
The apparatus of claim 20, wherein said software touchpoints are used to allow installation of an application only on host systems that are identified by a target processor.
Claim 33
Dependent Claim
16 words
The apparatus of claim 20, wherein said software touchpoints are resolved in a host processing element.
Claim 34
Dependent Claim
22 words
The apparatus of claim 20, wherein said software touchpoints are resolved at a cache level in a host processing system memory hierarchy.
Claim 35
Dependent Claim
21 words
The apparatus of claim 20, said software touchpoints further comprising: a structured software level touchpoint identified by a start/stop instruction pair.
Claim 36
Dependent Claim
25 words
The apparatus of claim 29, wherein said structured software level touchpoint identified by a start/stop instruction pair is executed as an atomic sequence of operations.
Claim 37
Independent Claim
67 words
An apparatus for processing unit validation in which an application that requests processing services is assured about the identity of said processing unit, comprising: means for challenging said processing unit; and means for issuing a puzzle to said processing unit that only said processing unit is able to resolve, wherein said processing unit's ability to solve said puzzle is proof of the identity of said processing unit.
Claim 38
Independent Claim
67 words
An apparatus for processing unit validation in which an application that requests processing services is assured about the identity of said processing unit, comprising: means for challenging said processing unit; and means for issuing a puzzle to said processing unit that only said processing unit is able to resolve, wherein said processing unit's ability to solve said puzzle is proof of the identity of said processing unit.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-11-14 | 2004-05-15 | 2004-11-14 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-11-14 | 2008-05-15 | 2008-11-14 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-11-14 | 2012-05-15 | 2012-11-14 | $7700.00 | Window Closed / Lapsed |