专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

11. 发明授权

US5432849A Secure cryptographic operations using control vectors generated inside a cryptographic facility 失效
标题翻译：使用在加密设施内生成的控制向量来保护加密操作
公开(公告)号：US5432849A
公开(公告)日：1995-07-11
申请号：US103953
申请日：1993-08-10
申请人： Donald B. Johnson , An V. Le , Stephen M. Matyas , Rostislaw Prymak , John D. Wilkins
发明人： Donald B. Johnson , An V. Le , Stephen M. Matyas , Rostislaw Prymak , John D. Wilkins
IPC分类号： G09C1/00 , G06F12/14 , H04L9/00 , H04L9/08
CPC分类号： G06F12/1408
摘要： The invention described herein suggests methods of cryptographic key management based on control vectors in which the control vectors are generated or derived internal to a cryptographic facility implementing a set of cryptographic operations. The methods of alternate control vector enforcement described in the present application provide a high-integrity facility to ensure that cryptographic keys are used in a manner consistent with the type and usage attributes assigned to the keys by the originator of those keys. Since the control vectors are generated or derived internal to the cryptographic facility on the basis of data contained in each cryptographic service request to the cryptographic facility, control vectors need not be stored or managed outside the cryptographic facility.
摘要翻译：本文所述的发明提出了基于控制向量的加密密钥管理方法，其中控制向量在实现一组密码操作的密码设施内部生成或导出。在本申请中描述的替代控制向量实现的方法提供了高完整性设施，以确保以与这些密钥的发起者分配给密钥的类型和使用属性一致的方式使用加密密钥。由于根据密码设备的每个密码服务请求中包含的数据，在密码设备的内部生成或导出控制向量，因此控制向量不需要在密码设备之外进行存储或管理。

12. 发明授权

US5103478A Secure management of keys using control vectors with multi-path checking 失效
标题翻译：使用多路径检查的控制向量来安全地管理密钥
公开(公告)号：US5103478A
公开(公告)日：1992-04-07
申请号：US596637
申请日：1990-10-12
申请人： Stephen M. Matyas , Dennis G. Abraham , Donald B. Johnson , Ramesh K. Karne , An V. Le , Patrick J. McCormack , Rostislaw Prymak , John D. Wilkins
发明人： Stephen M. Matyas , Dennis G. Abraham , Donald B. Johnson , Ramesh K. Karne , An V. Le , Patrick J. McCormack , Rostislaw Prymak , John D. Wilkins
IPC分类号： G07B17/00 , H04L9/08
CPC分类号： G07B17/00733 , H04L9/088 , G07B2017/00967 , H04L2209/12
摘要： A requested cryptographic function is validated for performance in conjunction with a cryptographic key, by inputting a first portion of an associated control vector into a first control vector checker, which outputs a first authorization signal if the requested cryptographic function has been authorized by the originator of the key. A second portion of the control vector is input to a second control vector checker, which outputs a second authorization signal if the requested cryptographic function has been authorized by the originator of the key. Both the first and the second authorization signals are applied to a cryptographic processor which initiates the execution of the requested cryptographic function.
摘要翻译：通过将相关联的控制向量的第一部分输入到第一控制向量检验器中，所请求的加密函数被验证用于与加密密钥相关的性能，如果所请求的密码功能已被发起者授权，则输出第一授权信号钥匙。控制向量的第二部分被输入到第二控制向量检验器，如果请求的密码函数已被密钥的发起者授权，则输出第二授权信号。第一和第二授权信号都被应用于启动所请求的密码功能的执行的密码处理器。

13. 发明授权

US4941176A Secure management of keys using control vectors 失效
标题翻译：使用控制向量安全地管理密钥
公开(公告)号：US4941176A
公开(公告)日：1990-07-10
申请号：US231114
申请日：1988-08-11
申请人： Stephen M. Matyas , Dennis G. Abraham , Donald B. Johnson , Ramesh K. Karne , An V. Le , Rostislaw Prymak , Julian Thomas , John D. Wilkins , Phil C. Yeh
发明人： Stephen M. Matyas , Dennis G. Abraham , Donald B. Johnson , Ramesh K. Karne , An V. Le , Rostislaw Prymak , Julian Thomas , John D. Wilkins , Phil C. Yeh
IPC分类号： G09C1/00 , G06F9/30 , H04L9/00 , H04L9/08 , H04L9/10 , H04L9/32
CPC分类号： G06F9/30076 , G06F9/30007 , G06F9/30018 , H04L9/0827 , H04L9/088 , H04L2209/12 , H04L2209/38
摘要： The invention is an apparatus and method for validating that key management functions requested for a cryptographic key by the program have been authorized by the originator of the key. The invention includes a cryptographic facility characterized by a secure boundary through which passes an input path for receiving the cryptographic service requests, cryptographic keys and their associated control vectors, and an output path for providing responses thereto. There can be included within the boundary a cryptographic instruction storage coupled to the input path, a control vector checking unit and a cryptographic processing unit coupled to the instruction storage, and a master key storage coupled to the processing means, for providing a secure location for executing key management functions in response to the received service requests. The cryptographic instruction storage receives over the input path a cryptographic service request for performing a key management function on a cryptographic key. The control vector checking unit has an input coupled to the input path for receiving a control vector associated with the cryptographic key and an input connected to the cryptographic instruction storage, for receiving control signals to initiate checking that the control vector authorizes the key management function which is requested by the cryptographic service request. The control vector checking unit has an authorization output connected to an input of the cryptographic processing means, for signalling that the key management function is authorized, the receipt of which by the cryptographic processing unit initiates the performance of the requested key management function with the cryptographic key. The invention enables the flexible control of many cryptographic key management functions in the generation, distribution and use of cryptographic keys, while maintaining a high security standard.
摘要翻译：本发明是用于验证由程序所请求的加密密钥的密钥管理功能已被密钥的发起者授权的装置和方法。本发明包括一个加密设施，其特征在于一个安全边界，通过该边界通过用于接收加密服务请求的输入路径，加密密钥及其相关控制向量，以及用于提供响应的输出路径。可以在边界内包括耦合到输入路径的加密指令存储器，耦合到指令存储器的控制向量检查单元和密码处理单元，以及耦合到处理装置的主密钥存储器，用于提供用于响应于所接收的服务请求执行密钥管理功能。加密指令存储器通过输入路径接收用于对加密密钥执行密钥管理功能的密码服务请求。控制向量检查单元具有耦合到输入路径的输入，用于接收与密码密钥相关联的控制向量和连接到密码指令存储器的输入，用于接收控制信号以启动检查控制向量授权密钥管理功能，被加密服务请求请求。控制向量检查单元具有连接到密码处理装置的输入的授权输出，用于发信号通知密钥管理功能被授权，密码处理单元接收密钥管理功能的密码管理功能的密码键。本发明能够灵活地控制密码密钥的生成，分发和使用中的许多加密密钥管理功能，同时保持高安全性的标准。

14. 发明授权

US4924515A Secure management of keys using extended control vectors 失效
标题翻译：使用扩展控制向量的密钥的安全管理
公开(公告)号：US4924515A
公开(公告)日：1990-05-08
申请号：US398299
申请日：1989-08-24
申请人： Stephen M. Matyas , Dennis G. Abraham , William C. Arnold , Donald B. Johnson , Ramesh K. Karne , An V. Le , Rostislaw Prymak , Steve R. White , John D. Wilkins
发明人： Stephen M. Matyas , Dennis G. Abraham , William C. Arnold , Donald B. Johnson , Ramesh K. Karne , An V. Le , Rostislaw Prymak , Steve R. White , John D. Wilkins
IPC分类号： H04L9/08
CPC分类号： H04L9/088 , H04L9/0643 , H04L2209/12
摘要： A method and apparatus are disclosed for use in a data processing system which executes a program which outputs cryptographic service requests for operations with cryptographic keys which are associated with control vectors defining the functions which each key is allowed by its originator to perform. The improved method and apparatus enable the use of control vectors having an arbitrary length. It includes a control vector register having an arbitrary length, for storing a control vector of arbitrary length associated with an N-bit cryptographic key. It further includes a control vector checking means having an input coupled to the control vector register, for checking that the control vector authorizes the cryptographic function which is requested by the cryptographic service request. It further includes a hash function generator having an input coupled to the control vector register and an N-bit output, for mapping the control vector output from the control vector register, into an N-bit hash value. A key register is included for storing the N-bit cryptographic key. It further includes a logic block having a first input coupled to the N-bit output of the hash function generator, and a second input connected to the key register, for forming at the output thereof a product of the N-bit key and the N-bit hash value. Finally, an encryption device is included having a first input for receiving a cleartext data stream and a key input coupled to the output of the logic block, for forming a ciphertext data stream at the output thereof from the cleartext data stream and the product. A decryption device can be substituted for the encryption device to perform decryption operations in a similar manner.
摘要翻译：公开了一种在数据处理系统中使用的方法和装置，该数据处理系统执行一个程序，该程序输出密码服务请求，该密码服务请求与密码密钥相关联，该控制向量定义每个密钥由其发起者允许执行的功能。改进的方法和装置使得能够使用具有任意长度的控制向量。它包括具有任意长度的控制向量寄存器，用于存储与N位加密密钥相关联的任意长度的控制向量。它还包括控制向量检查装置，其具有耦合到控制向量寄存器的输入，用于检查控制向量授权由密码服务请求请求的加密功能。它还包括具有耦合到控制向量寄存器的输入和用于将从控制向量寄存器输出的控制矢量映射到N位散列值的N位输出的散列函数发生器。包含密钥寄存器用于存储N位加密密钥。它还包括具有耦合到散列函数发生器的N位输出的第一输入和连接到键寄存器的第二输入的逻辑块，用于在其输出处形成N位键和N的乘积位散列值。最后，包括具有用于接收明文数据流的第一输入和耦合到逻辑块的输出的键输入的加密装置，用于在明文数据流和产品的输出处形成密文数据流。解密装置可以代替加密装置以类似的方式执行解密操作。

15. 发明授权

US4924514A Personal identification number processing using control vectors 失效
标题翻译：使用控制向量进行个人识别号码处理
公开(公告)号：US4924514A
公开(公告)日：1990-05-08
申请号：US398300
申请日：1989-08-24
申请人： Stephen M. Matyas , Dennis G. Abraham , Donald B. Johnson , Ramesh K. Karne , An V. Le , Rostislaw Prymak , Julian Thomas , John D. Wilkins , Phil C. Yeh , Ronald M. Smith
发明人： Stephen M. Matyas , Dennis G. Abraham , Donald B. Johnson , Ramesh K. Karne , An V. Le , Rostislaw Prymak , Julian Thomas , John D. Wilkins , Phil C. Yeh , Ronald M. Smith
IPC分类号： G06F9/30 , G07F7/10 , H04L9/32
CPC分类号： G06F9/30018 , G06F9/30007 , G06Q20/3829 , G06Q20/4012 , G07F7/1016 , H04L9/0822 , H04L9/088 , H04L9/0894 , H04L9/3226 , H04L9/3271 , H04L2209/56
摘要： Cryptographic PIN processing is achieved in an improved manner by associating control vectors with the PIN generating (verification) keys and PIN encrypting keys which provide authorization for the uses of the keys intended by the originator of the keys. The originator may be the local cryptographic facility (CF) and a utility program under the control of a security administrator, or the originator may be another network node which uses the key management methods described in the above-referenced copending patent applications to distribute said keys.Among the uses specified by the control vector are limitations on the authority to use the associated key with certain PIN processing instructions, such as PIN generation, verification, translation and PIN block creation. Furthermore, the control vector may limit the authority of certain instructions to process clear PIN inputs (such as in PIN verification). The control vector may contain information identifying and, possibly restricting, PIN processing to a particular PIN format or particular processing algorithm.The control vector implementation provides a flexible method for coupling format, usage, and processing authorization to keys. The system administrator can exercise flexibility in changing the implementation of his security policy by selecting appropriate control vectors in accordance with the invention. Furthermore, a method is provided for the security administrator to restrict certain PIN format translations.
摘要翻译：通过将控制向量与PIN生成（验证）密钥和PIN加密密钥相关联来实现密码PIN处理，该密码提供对使用密钥发起者所期望的密钥的授权。发起者可以是本地加密设施（CF）和在安全管理员的控制下的实用程序，或者发起者可以是使用上述参考的未决专利申请中描述的密钥管理方法的另一个网络节点来分发所述密钥。由控制向量指定的用途之一是对使用相关密钥与某些PIN处理指令（例如PIN生成，验证，翻译和PIN块创建）的权限的限制。此外，控制向量可以限制某些指令的权限来处理明确的PIN输入（例如在PIN验证中）。控制向量可以包含识别并且可能限制对特定PIN格式或特定处理算法的PIN处理的信息。控制向量实现提供了一种用于将格式，使用和处理权限耦合到密钥的灵活方法。系统管理员可以通过根据本发明选择适当的控制向量来灵活地改变其安全策略的实现。此外，提供了一种用于安全管理员限制某些PIN格式转换的方法。

16. 发明授权

US5414833A Network security system and method using a parallel finite state machine adaptive active monitor and responder 失效
标题翻译：网络安全系统和方法采用并行有限状态机自适应主动监控和响应
公开(公告)号：US5414833A
公开(公告)日：1995-05-09
申请号：US144161
申请日：1993-10-27
申请人： Paul C. Hershey , Donald B. Johnson , An V. Le , Stephen M. Matyas , John G. Waclawsky , John D. Wilkins
发明人： Paul C. Hershey , Donald B. Johnson , An V. Le , Stephen M. Matyas , John G. Waclawsky , John D. Wilkins
IPC分类号： G06F1/00 , G06F11/00 , G06F11/32 , G06F21/00 , H04L12/26 , H04L29/06 , H04L9/00
CPC分类号： H04L43/00 , G06F21/564 , H04L12/26 , H04L63/0428 , H04L63/145 , G06F11/0763 , G06F11/327
摘要： A system and method provide a security agent, consisting of a monitor and a responder, that respond to a detected security event in a data communications network, by producing and transmitting a security alert message to a network security manager. The alert is a security administration action which includes setting a flag in an existing transmitted protocol frame to indicate a security event has occurred. The security agent detects the transmission of infected programs and data across a high-speed communications network. The security agent includes an adaptive, active monitor using finite state machines, that can be dynamically reprogrammed in the event it becomes necessary to dynamically reconfigure it to provide real time detection of the presence of a suspected offending virus.
摘要翻译：系统和方法通过产生和向网络安全管理器发送安全警报消息来提供响应于数据通信网络中检测到的安全事件的由监视器和应答器组成的安全代理。该警报是安全管理动作，其包括在现有传输的协议帧中设置标志以指示发生了安全事件。安全代理通过高速通信网络检测受感染程序和数据的传输。安全代理包括使用有限状态机的自适应主动监视器，可以在需要动态重新配置以便实时检测疑似违规病毒的存在的情况下动态重新编程。

17. 发明授权

US5323464A Commercial data masking 失效
标题翻译：商业数据屏蔽
公开(公告)号：US5323464A
公开(公告)日：1994-06-21
申请号：US962951
申请日：1992-10-16
申请人： Robert C. Elander , Christopher J. Holloway , Donald B. Johnson , Michael J. Kelly , An V. Le , Paul G. Lubold , Stephen M. Matyas , James D. Randall
发明人： Robert C. Elander , Christopher J. Holloway , Donald B. Johnson , Michael J. Kelly , An V. Le , Paul G. Lubold , Stephen M. Matyas , James D. Randall
IPC分类号： G09C1/00 , H04L9/06 , H04L9/08 , H04L9/02 , H04K1/00 , H04L9/00
CPC分类号： H04L9/0625 , H04L9/088 , H04L2209/04 , H04L2209/56
摘要： A method and system are disclosed for the implementation of a weakened privacy channel. This is achieved through use of a weakened symmetric cryptographic algorithm called commercial data masking. The masked text is created from clear text at one system and may to transported electronically to another system where the masked text may be unmasked to produce the clear text. The reason to use the commercial data masking algorithm for data privacy is that it is exportable to organizations to which products which contain the Data Encryption Algorithm when used for data privacy are not exportable. In addition, a method and system is disclosed by which the key when used for commercial data masking may be transformed into a key that may be used with the Data Encryption Algorithm.
摘要翻译：公开了一种用于实现弱化的隐私信道的方法和系统。这通过使用称为商业数据掩蔽的弱化对称密码算法来实现。掩蔽的文本是在一个系统中以明文形式创建的，并且可以以电子方式传输到另一个系统，其中屏蔽的文本可能被隐藏以产生明文。使用商业数据隐藏算法进行数据隐私的原因是可以导出到组织，当用于数据隐私时，包含数据加密算法的产品不可导出。此外，公开了一种方法和系统，通过该方法和系统，当用于商业数据屏蔽时，密钥可以被转换成可以与数据加密算法一起使用的密钥。

18. 发明授权

US5301231A User defined function facility 失效
标题翻译：用户定义的功能设施
公开(公告)号：US5301231A
公开(公告)日：1994-04-05
申请号：US834634
申请日：1992-02-12
申请人： Dennis G. Abraham , Daniela Henningsmeyer , John M. Hudson , Donald B. Johnson , An V. Le , Stephen M. Matyas , James V. Stevens
发明人： Dennis G. Abraham , Daniela Henningsmeyer , John M. Hudson , Donald B. Johnson , An V. Le , Stephen M. Matyas , James V. Stevens
IPC分类号： G06F12/00 , G06F9/30 , G06F21/00 , G06F21/22 , H04L9/00
CPC分类号： G06F9/30003 , G06F21/72 , G06F2207/7219
摘要： In a cryptographic module, a User Defined Function (UDF) facility is provided which provides users with the capability of defining and creating custom functions to meet their cryptographic processing needs. The cryptographic module is contained within a physically and logically secure environment and comprises a processing unit and memory connected to the processing unit. The memory includes code for translating User Defined Functions (UDFs) into a machine-readable form and at least one command for operating on the UDFs. The UDFs are loaded into and executed in the secure area of the cryptographic module without compromising the total security of the transaction security system.
摘要翻译：在加密模块中，提供了一种用户定义功能（UDF）功能，可为用户提供定义和创建自定义功能以满足其加密处理需求的功能。加密模块包含在物理和逻辑上安全的环境中，并且包括连接到处理单元的处理单元和存储器。内存包括用于将用户定义函数（UDF）转换为机器可读形式的代码和至少一个用于在UDF上运行的命令。 UDF被加载到密码模块的安全区域并在其中执行，而不会影响交易安全系统的总体安全性。

19. 发明授权

US5214698A Method and apparatus for validating entry of cryptographic keys 失效
标题翻译：用于验证加密密钥的输入的方法和装置
公开(公告)号：US5214698A
公开(公告)日：1993-05-25
申请号：US672265
申请日：1991-03-20
申请人： Ronald M. Smith, Sr. , Phil C. Yeh , Randall J. Easter , Donald B. Johnson , An Van Le , Stephen M. Matyas , Julian Thomas , John D. Wilkins
发明人： Ronald M. Smith, Sr. , Phil C. Yeh , Randall J. Easter , Donald B. Johnson , An Van Le , Stephen M. Matyas , Julian Thomas , John D. Wilkins
IPC分类号： G09C1/00 , H04L9/08
CPC分类号： H04L9/088
摘要： A cryptographic facility implements a multiple key part import procedure. The installation manager can verify that a key part has been correctly entered and has not been compromised. The security requirement for the procedure is that no single party can subvert the system security by misusing the procedure. This is accomplished by the use of a control-vector-dependent verification pattern to indicate that each key part has been accepted by using the proper control vector and the use of different key switch positions to specify whether the key part is a master key part or an operational key part and whether the key part is a first part or a subsequent key part. The apparatus provides an automatic reset of the key part register at the completion of each key-entry instruction so that each key part can be imported only once. This prevents the same key part from being imported twice as different key part types. The apparatus also prevents a key part from being combined with itself to create a known key. The procedure is fail-safe so that the program cannot steal a key part from a previously failed procedure.
摘要翻译：密码工具实现了多重关键部分导入过程。安装管理员可以验证关键部件是否已正确输入，并且未被泄露。程序的安全要求是，没有一方可以通过滥用程序颠覆系统安全。这是通过使用控制向量相关的验证模式来实现的，以通过使用适当的控制向量来指示每个关键部分已被接受，并且使用不同的键开关位置来指定关键部分是主键部分还是主键部分操作键部分以及关键部分是第一部分还是随后的关键部分。该装置在完成每个键入指令时提供关键部分寄存器的自动复位，使得每个键部分只能被导入一次。这样可以防止相同的关键部分作为不同的关键部件类型被导入两次。该装置还防止关键部分与其自身组合以创建已知密钥。该过程是故障安全的，以便程序不能从以前失败的过程中窃取关键部分。

20. 发明授权

US5177791A Secure translation of usage-control values for cryptographic keys 失效
标题翻译：安全地翻译加密密钥的使用控制值
公开(公告)号：US5177791A
公开(公告)日：1993-01-05
申请号：US753245
申请日：1991-08-30
申请人： Phil C. Yeh , Dennis G. Abraham , Donald B. Johnson , An Van Le , Stephen M. Matyas , Rotislaw Prymak , Ronald M. Smith, Sr. , John D. Wilkins
发明人： Phil C. Yeh , Dennis G. Abraham , Donald B. Johnson , An Van Le , Stephen M. Matyas , Rotislaw Prymak , Ronald M. Smith, Sr. , John D. Wilkins
IPC分类号： H04L9/08
CPC分类号： H04L9/088 , H04L2209/08
摘要： A working key of a certain key type is to be transmitted from a first system (having a first usage-control value associated with keys of the certain type) and a second system (having a second usage-control value associated with keys of the certain type). A translation control value, associated with the certain key type, is generated, functionally relating the first and second usage-control values. The translation control value is used in a cryptographic function to send or receive the working key between systems, the cryptographic function being designed to produce valid results when the correct translation control value, and usage-control values, are employed, and unpredictable results otherwise. Effectively, the first usage-control value is translated to the second usage-control value.
摘要翻译：要从第一系统（具有与特定类型的密钥相关联的第一使用控制值）和第二系统（具有与特定密钥的密钥相关联的第二使用控制值）发送某个密钥类型的工作密钥类型）。产生与特定键类型相关联的翻译控制值，功能上与第一和第二使用控制值相关。翻译控制值用于加密功能中以在系统之间发送或接收工作密钥，加密功能被设计为当采用正确的翻译控制值和使用控制值时产生有效结果，否则将产生不可预测的结果。有效地，将第一使用控制值转换为第二使用控制值。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式