System and method for secure replacement of high level cryptographic keys in a personal security device

Claim 2

A data processing system for initially generating and installing at least one personal security device PSD master key replacement key and at least one PSD master key inside at least one PSD, said system comprising: a first server including a data storage section, wherein said first server is functionally connected to a first hardware security module HSM and a PSD writer; said PSD writer functionally connected to said first server and said at least one PSD; said at least one PSD including a non-mutable unique identification number to be sent to said first HSM, a security executive, a first high level key slot and a second high level key slot, wherein said PSD is functionally connected to said PSD writer; said first HSM including at least one stored public key, at least one stored master key data block, at least one stored master key replacement key data block and a random number generator that generates a random number, wherein said first HSM is functionally connected to said first server; said first HSM comprising a first diversification section that uses said random number to diversify said master key replacement key data block, which generates a unique key replacement key associated with said non-mutable unique identification number.

Claim 3

The system according to claim 1 , wherein said HSM comprises an encrypting section that encrypts said random number using said at least one stored public key, which generates a unique cryptogram associated with said non-mutable unique identification number.

Claim 4

The system according to claim 2 , wherein said unique cryptogram is stored on said first server.

Claim 5

The system according to claim 1 , wherein said random number is deleted inside said first HSM.

Claim 6

The system according to claim 1 , comprising a first transfer section that transfers to said PSD writer and injects into said at least one PSD said unique key replacement key.

Claim 7

The system according to claim 5 , wherein said unique key replacement key is registered with said security executive and installed in said first high level key slot.

Claim 8

The system according to claim 6 , wherein said unique key replacement key is registered with said security executive and installed in said second high level key slot.

Claim 9

The system according to claim 1 , wherein said HSM comprises a second diversification section that uses said unique identification number to diversify said at least one stored master key data block, which generates a unique master key.

Claim 10

The system according to claim 8 , comprising a second transfer section that transfers to said PSD writer and injects into said at least one PSD said unique master key.

Claim 11

The system according to claim 9 , wherein said unique master key is registered with said security executive and installed in said second high level key slot.

Claim 12

The system according to claim 10 , wherein said unique master key is registered with said security executive and installed in said first high level key slot.

Claim 13

A data processing system for post issuance master key replacement for at least one personal security device (PSD), said system comprising: a client functionally connected to said at least one PSD and in secure communications with a first server; said at least one PSD including a non-mutable unique identification number, a pre-installed key replacement key, an active master key and a security executive, wherein said PSD is functionally connected to said client; a first server including at least one stored unique cryptogram associated with said non-mutable unique identification number, wherein said first server is functionally connected to a first hardware security module HSM and in secure communications with said client; a second server functionally connected to a second HSM; said first HSM including a cryptographic section, a key generation and key transfer section, wherein said first HSM is functionally connected to said first server; said second HSM including a cryptographic section, a master key replacement key data block, a master key data block, a key generation and key transfer section, at least one stored private key, wherein said second HSM is functionally connected to said second server; a first transfer section that securely transfers said master key replacement key data block, said master key data block, and said at least one stored private key from said second HSM to said first HSM; a second transfer section that transfers said non-mutable unique identification number to said first server and a retrieving section that retrieves said at least one stored unique cryptogram corresponding to said non-mutable unique identification number; a third transfer section that transfers said at least one stored unique cryptogram and said non-mutable unique identification number from said first server to said first HSM; a decrypting section that uses said at least one stored private key to decrypt said at least one stored unique cryptogram, resulting in a random number specific to said at least one PSD; and a first diversification section that uses said random number to diversify said master key replacement key data block, generating a master key replacement key specific to said at least one PSD.

Claim 14

A data processing system for post issuance master key replacement for at least one personal security device (PSD), said system comprising: a client functionally connected to said at least one PSD and in secure communications with a first server; said at least one PSD including a non-mutable unique identification number, a pre-installed key replacement key, an active master key and a security executive, wherein said PSD is functionally connected to said client; a first server including at least one stored unique cryptogram associated with said non-mutable unique identification number, wherein said first server is functionally connected to a first hardware security module HSM and in secure communications with said client; a second server functionally connected to a second HSM; said first HSM including a cryptographic section, a key generation and key transfer section, wherein said first HSM is functionally connected to said first server; said second HSM including a cryptographic section, a master key replacement key data block, a master key data block, a key generation and key transfer section, at least one stored private key, wherein said second HSM is functionally connected to said second server; a first transfer section that securely transfers said master key replacement key data block, said master key data block, and said at least one stored private key from said second HSM to said first HSM; a second transfer section that transfers said non-mutable unique identification number to said first server and a retrieving section that retrieves said at least one stored unique cryptogram corresponding to said non-mutable unique identification number; a third transfer section that transfers said at least one stored unique cryptogram and said non-mutable unique identification number from said first server to said first HSM; a decrypting section that uses said at least one stored private key to decrypt said at least one stored unique cryptogram, resulting in a random number specific to said at least one PSD; and a first diversification section that uses said random number to diversify said master key replacement key data block, generating a master key replacement key specific to said at least one PSD.

Claim 15

The system according to claim 12 , comprising a second diversification section that uses said non-mutable unique identification number to diversify said master key data block, generating a new master key specific to said at least one PSD.

Claim 16

The system according to claim 12 , comprising a fourth transfer section that securely transfers said master key replacement key to said PSD and said security executive comprises a comparison section that compares said master key replacement key to said pre-installed key replacement key.

Claim 17

The system according to claim 14 , comprising an unlocking section that unlocks said security executive upon a match between said master key replacement key and said pre-installed key replacement key.

Claim 18

The system according to claim 15 , wherein said active master key is deleted from said at least one PSD.

Claim 19

The system according to claim 16 , comprising a transfer section that securely transfers said new master key, installs said new master key inside said at least one PSD and registers said new master key with said security executive.

Claim 20

The system according to claim 17 , comprising a section that relocks said security executive following installation of said new master key.

Claim 21

The system according to claim 12 , wherein said secure transfer occurs at said second server.

Claim 22

The system according to claim 19 , wherein said secure transfer occurs at said first server.

Claim 25

The method according to claim 21 , wherein said first data processing device is an access server.

Claim 26

The method according to claim 22 , wherein said first data processing device is a first hardware security module HSM functionally connected to said access server.

Claim 27

The method according to claim 21 , wherein said second data processing device is a key management server.

Claim 28

The method according to claim 24 , wherein said second data processing device is a second hardware security module HSM functionally connected to said key management server.

Claim 29

The method according to claim 25 , wherein said second data processing device is said second HSM functionally connected to said access server.

Claim 32

The method according to claim 27 , wherein said first data processing device is an access server.

Claim 33

The method according to claim 28 , wherein said first data processing device is a first hardware security module HSM functionally connected to said access server.

Claim 34

The method according to claim 27 , wherein said second data processing device is a key management server.

Claim 35

The method according to claim 30 , wherein said second data processing device is a second hardware security module HSM functionally connected to said key management server.

Claim 36

The method according to claim 31 , wherein said second data processing device is said second HSM functionally connected to said access server.