Public key cryptosystem key management based on control vectors

• US 5,200,999 A
• Filed: 09/27/1991
• Issued: 04/06/1993
• Est. Priority Date: 09/27/1991
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Martin, William C., Rohland, William S., Johnson, Donald B., Matyas, Stephen M., Prymak, Rostislaw, Le, An V., Wilkins, John D.
• Primary Examiner(s): CAIN, DAVID C
• Application Number:
  US07/766,260
• Time in Patent Office: 557 Days
• Field of Search: 380/23, 380/25, 380/30
• US Class Current: 380/277
• CPC Class Codes: G06F 9/30007 to perform operations on data operands
• CPC Class Codes: H04L 2209/12 Details relating to cryptographic hardware or logic circuitry
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A data processing system, method and program are disclosed, for managing a public key cryptographic system. The method includes the steps of generating a first public key and a first private key as a first pair in the data processing system, for use with a first public key algorithm and further generating a second public key and a second private key as a second pair in the data processing system, for use with a second public key algorithm. The method then continues by assigning a private control vector for the first private key and the second private key in the data processing system, for defining permitted uses for the first and second private keys. Then the method continues by forming a private key record which includes the first private key and the second private key in the data processing system, and encrypting the private key record under a first master key expression which is a function of the private control vector. The method then forms a private key token which includes the private control vector and the private key record, and stores the private key token in the data processing system.

At a later time, the method receives a first key use request in the data processing system, requiring the first public key algorithm. In response to this, the method continues by accessing the private key token in the data processing system and checking the private control vector to determine if the private key record contains a key having permitted uses which will satisfy the first request. The method then decrypts the private key record under the first master key expression in the data processing system and extracts the first private key from the private key record. The method selects the first public key algorithm in the data processing system for the first key use request and executes the first public key algorithm in the data processing system using the first private key to perform a cryptographic operation to satisfy the first key use request.

Claims

1. In a data processing system, a method for managing a public key cryptographic system, comprising the steps of:

generating a first public key and a first private key as a first pair in said data processing system, for use with a first public key algorithm;

generating a second public key and a second private key as a second pair in said data processing system, for use with a second public key algorithm;

assigning a private control vector for said first private key and said second private key in said data processing system, for defining permitted uses for said first and second private keys;

forming a private key record which includes said first private key and said second private key in said data processing system, and encrypting said private key record under a first master key expression which is a function of said private control vector;

forming a private key token which includes said private control vector and said private key record, and storing said private key token in said data processing system;

receiving a first key use request in said data processing system, reguiring said first public key algorithm;

accessing said private key token in said data processing system and checking said private control vector to determine if said private key record contains a key having permitted uses which will satisfy said first request;

decrypting said private key record under said first master key expression in said data processing system and extracting said first private key from said private key record;

selecting said first public key algorithm in said data processing system for said first key use request;

selecting said first public key algorithm in said data processing system using said first private key to perform a cryptographic operation to satisfy said first key use request.

2. The method of claim 1, which further comprises:

said private key record including first parse data to locate said first private key and said second private key in said key record;

said extracting step including using said parse data for extracting said first private key from said private key record.

3. The method of claim 1, which further comprises:

forming a first private key authentication record in said data processing system, by computing a hash value using a hashing function on said private key record and encrypting said first private key authentication record under a second master key expression which is a function of said private control vector;

said private key token including said first private key authentication record.

4. The method of claim 3, which further comprises:

after said decrypting step, computing a second private key authentication record in said data processing system, by computing a second hash value using said hashing function on said decrypted private key record and comparing said second a private key authentication record with said first private key authentication record;

aborting further processing of said first key use request in said data processing system, if said second private key authentication record is not equal to said first private key authentication record.

5. The method of claim 4, which further comprises:

said private key token including first header data to locate said control vector, said private key record and said private key authentication record in said private key token;

said accessing step including using said header data to locate said private key record in said private key token.

6. The method of claim 1, which further comprises:

assigning a public control vector for said first public key and said second public key in said data processing system, for defining permitted uses for said first and second public keys;

forming a public key record which includes said first public key and said second public key in said data processing system, and encrypting said public key record under a third master key expression which is a function of said public control vector;

forming a public key token which includes said public control vector and said public key record, and storing said public key token in said data processing system;

receiving a second key use request in said data processing system, regulating said second public key algorithm;

accessing said public key token in said data processing system and checking said public control vector to determine if said public key record contains a key having permitted uses which will satisfy said second request;

decrypting said public key record under said third master key expression in said data processing system and extracting said first public key from said public key record;

selecting said second public key algorithm in said data processing system for said second key use request;

selecting said second public key algorithm in said data processing system using said first public key to perform a cryptographic operation to satisfy said second key use request.

7. The method of claim 6, which further comprises:

said public key record including second parse data to locate said first public key and said second public key in said key record;

said extracting step for said first public key including using said parse data for extracting said first public key from said public key record.

8. The method of claim 6, which further comprises:

forming a second public key authentication record in said data processing system, by computing a hash value using said hashing function on said public key record and encrypting said second public key authentication record under a fourth master key expression which is a function of said public control vector;

said public key token including said second public key authentication record.

9. The method of claim 8, which further comprises:

after said decrypting step for said public key record, computing a second public key authentication record in said data processing system, by computing a second hash value using said hashing function on said decrypted public key record and comparing said second a public key authentication record with said second public key authentication record;

aborting further processing of said second key use request in said data processing system, if said second public key authentication record is not equal to said second public key authentication record.

10. The method of claim 9, which further comprises:

said public key token including second header data to locate said control vector, said public key record and said public key authentication record in said public key token;

said accessing step for said public key token including using said header data to locate said public key record in said public key token.

11. In a data processing system, a method for managing a public key cryptographic system, comprising the steps of:

generating a public key and a private key as a pair in said data processing system, for use with a public key algorithm;

assigning a private control vector for said private key in said data processing system, for defining permitted uses for said private key;

forming a private key record which includes said private key in said data processing system, and encrypting said private key record under a first master key expression which is a function of said private control vector;

forming a private key token which includes said private control vector and said encrypted private key record and storing said private key token in said data processing system;

receiving a first key use request in said data processing system, requiring execution of said public key algorithm with a private key;

accessing said private key token in said data processing system and checking said private control vector to determine if said private key record contains a key having permitted uses which will satisfy said first request;

decrypting said private key record under said first master key expression in said data processing system and extracting said private key from said private key record;

executing said public key algorithm in said data processing system using said private key to perform a cryptographic operation to satisfy said first key use request.

12. The method of claim 11, which further comprises:

assigning a public control vector for said public key in said data processing system, for defining permitted uses for said public key;

forming a public key record which includes said public key in said data processing system, and encrypting said public key record under a second master key expression which is a function of said public control vector;

forming a public key token which includes said public control vector and said public key record and storing said public key token in said data processing system;

receiving a second key use request in said data processing system, requiring execution of said public key algorithm with a public key;

accessing said public key token in said data processing system and checking said public control vector to determine if said public key record contains a key having permitted uses which will satisfy said second request;

decrypting said public key record under said second master key expression in said data processing system and extracting said public key from said public key record;

executing said public key algorithm in said data processing system using said public key to perform a cryptographic operation to satisfy said second key use request.

13. The method of claim 12, which further comprises:

forming a first private key authentication record in said data processing system, by computing a hash value using a hashing function on said private key record;

said private key token including said first private key authentication record.

14. The method of claim 13, which further comprises:

after said decrypting step for said private key record, computing a second private key authentication record in said data processing system, by computing a second hash value using said hashing function on said decrypted private key record and comparing said second a private key authentication record with said first private key authentication record;

aborting further processing of said first key use request in said data processing system, if said second private key authentication record is not equal to said first private key authentication record.

15. The method of claim 14, which further comprises:

forming a second public key authentication record in said data processing system, by computing a hash value using said hashing function on said public key record;

said public key token including said second public key authentication record.

16. The method of claim 15, which further comprises:

after said decrypting step for said public key record, computing a second public key authentication record in said data processing system, by computing a second hash value using said hashing function on said decrypted public key record and comparing said second a public key authentication record with said second public key authentication record;

aborting further processing of said second key use request in said data processing system, if said second public key authentication record is not equal to said second public key authentication record.

17. In a data processing system, a method for managing a public key cryptographic system, comprising the steps of:

generating a public key and a private key in said cryptographic system;

assigning a public key control vector to said public key in accordance with intended uses for said public key;

assigning a private key control vector to said private key in accordance with intended uses for said private key;

storing said public key in a public key record and storing said private key in a private key record;

encrypting said public key record under a master key and encrypting said private key under said master key;

forming a modification detection code on a concatenated expression of said public key control vector and said public key record as a public key authentication record;

forming a modification detection code on a concatenated expression of said private key control vector and said private key record to produce a private key authentication record;

encrypting said public key authentication record under said master key and encrypting said private key authentication record under said master key;

forming a public key token which includes said public key control vector in a first field, said encrypted public key record in a second field, and said encrypted public key authentication record in a third field;

forming a private key token including said private key control vector in a first field, said encrypted private key record in a second field, and said encrypted private key authentication record in a third field.

18. The method of claim 17 wherein said master key is a secret key belonging to a symmetric key algorithm.

19. The method of claim 18 wherein said secret key is a data encryption algorithm key.

20. In a data processing system, a computer program for managing a public key cryptographic system, which when executed on said data processing system, performs a method comprising the steps of:

generating a first public key and a first private key as a first pair in said data processing system, for use with a first public key algorithm;

generating a second public key and a second private key as a second pair in said data processing system, for use with a second public key algorithm;

assigning a private control vector for said first private key and said second private key in said data processing system, for defining permitted uses for said first and second private keys;

forming a private key record which includes said first private key and said second private key in said data processing system, and encrypting said private key record under a first master key expression which is a function of said private control vector;

forming a private key token which includes said private control vector and said private key record, and storing said private key token in said data processing system;

receiving a first key use request in said data processing system, regulating said first public key algorithm;

accessing said private key token in said data processing system and checking said private control vector to determine if said private key record contains a key having permitted uses which will satisfy said first request;

decrypting said private key record under said first master key expression in said data processing system and extracting said first private key from said private key record;

selecting said first public key algorithm in said data processing system for said first key use request;

selecting said first public key algorithm in said data processing system using said first private key to perform a cryptographic operation to satisfy said first key use request.

21. The method of claim 20, which further comprises:

said private key record including first parse data to locate said first private key and said second private key in said key record;

said extracting step including using said parse data for extracting said first private key from said private key record.

22. The method of claim 20, which when executed on said data processing system, performs the further steps, comprising:

forming a first private key authentication record in said data processing system, by computing a hash value using a hashing function on said private key record and encrypting said first private key authentication record under a second master key expression which is a function of said private control vector;

said private key token including said first private key authentication record.

23. The method of claim 22, which when executed on said data processing system, performs the further steps, comprising:

after said decrypting step, computing a second private key authentication record in said data processing system, by computing a second hash value using said hashing function on said decrypted private key record and comparing said second a private key authentication record with said first private key authentication record;

aborting further processing of said first key use request in said data processing system, if said second private key authentication record is not equal to said first private key authentication record.

24. The method of claim 23, which further comprises:

said private key token including first header data to locate said control vector, said private key record and said private key authentication record in said private key token;

said accessing step including using said header data to locate said private key record in said private key token.

25. In a data processing system, a computer program for managing a public key cryptographic system, which when executed on said data processing system, performs a method comprising the steps of:

generating a public key and a private key as a pair in said data processing system, for use with a public key algorithm;

assigning a private control vector for said private key in said data processing system, for defining permitted uses for said private key;

forming a private key record which includes said private key in said data processing system, and encrypting said private key record under a first master key expression which is a function of said private control vector;

forming a private key token which includes said private control vector and said encrypted private key record and storing said private key token in said data processing system;

receiving a first key use request in said data processing system, requiring execution of said public key algorithm with a private key;

accessing said private key token in said data processing system and checking said private control vector to determine if said private key record contains a key having permitted uses which will satisfy said first request;

decrypting said private key record under said first master key expression in said data processing system and extracting said private key from said private key record;

executing said public key algorithm in said data processing system using said private key to perform a cryptographic operation to satisfy said first key use request.

26. The method of claim 25, which when executed on said data processing system, performs the further steps, comprising:

assigning a public control vector for said public key in said data processing system, for defining permitted uses for said public key;

forming a public key record which includes said public key in said data processing system, and encrypting said public key record under a second master key expression which is a function of said public control vector;

forming a public key token which includes said public control vector and said public key record, and storing said public key token in said data processing system;

receiving a second key use request in said data processing system, requiring execution of said public key algorithm with a public key;

accessing said public key token in said data processing system and checking said public control vector to determine if said public key record contains a key having permitted uses which will satisfy said second request;

decrypting said public key record under said second master key expression in said data processing system and extracting said public key from said public key record;

executing said public key algorithm in said data processing system using said public key to perform a cryptographic operation to satisfy said second key use request.

27. The method of claim 26, which when executed on said data processing system, performs the further steps, comprising:

forming a first private key authentication record in said data processing system, by computing a hash value using a hashing function on said private key record;

said private key token including said first private key authentication record.

28. The computer program of claim 27, which when executed on said data processing system, performs the further steps, comprising:

after said decryption step for said private key record, computing a second private key authentication record in said data processing system, by computing a second hash value using said hashing function on said decrypted private key record and comparing said second a private key authentication record with said first private key authentication record;

aborting further processing of said first key use request in said data processing system, if said second private key authentication record is not equal to said first private key authentication record.

29. The computer system of claim 28, which when executed on said data processing system, performs the further steps, comprising:

forming a second public key authentication record in said data processing system, by computing a hash value using a hashing function on said public key record;

said public key token including said second public key authentication record.

30. The computer program of claim 29, which when executed on said data processing system, performs the further steps, comprising:

after said decrypting step for said public key record, computing a second public key authentication record in said data processing system, by computing a second hash value using said hashing function on said decrypted public key record and comparing said second a public key authentication record with said first public key authentication record;

aborting further processing of said second key use request in said data processing system, if said second public key authentication record is not equal to said second public key authentication record.

31. A data processing system for managing a public key cryptographic system, comprising:

first generating means for generating a first public key and a first private key as a first pair in said data processing system, for use with a first public key algorithm;

second generating means for generating a second public key and a second private key as a second pair in said data processing system, for use with a second public key algorithm;

assigning means for assigning a private control vector for said first private key in said second private key in said data processing system, for defining permitted uses for said first and second private keys;

key record forming means coupled to said first and second generating means, for forming a private key record which includes said first private key and said second private key in said data processing system, encrypting means coupled to said key record forming means and said assigning means, for encrypting said private key record under a first master key expression which is a function of said private control vector;

key token forming means coupled to said assigning means and to said key record forming means, for forming a private key token which includes said private control vector and said private key record;

storing means coupled to said key token forming means, for storing said private key token in said data processing system;

receiving means coupled to a user input, for receiving a first key use request in said data processing system, requiring said first public key algorithm;

accessing means coupled to said receiving means and to said storing means, for accessing said private key token in said data processing system and checking said private control vector to determine if said private key record contains a key having permitted uses which will satisfy said first request;

decrypting means coupled to said accessing means, for decrypting said private key record under said first master key expression in said data processing system and extracting said first private key from said private key record;

selecting means coupled to said receiving means, for selecting said first public key algorithm in said data processing system for said first key use request;

executing means coupled to said selecting means and to said decrypting means, for executing said first public key algorithm in said data processing system using said first private key to perform a cryptographic operation to satisfy said first key use request.

32. The system of claim 31, which further comprises:

authentication record forming means coupled to said key record forming means, for forming a first private key authentication recording said data processing system, by computing a hash value using a hashing function on said private key record and encrypting said first private key authentication record under a second master key expression which is a function of said private control vector;

said private key token including said first private key authentication record.

33. The system of claim 32, which further comprises:

computing means coupled to said decryption means, for computing a second private key authentication record in said data processing system, by computing a second hash value using said hashing function on said decrypted private key record and comparing said second a private key authentication record with said first private key authentication record;

terminating means coupled to said computing means, for aborting further processing of said first key use request in said data processing system, if said second private key authentication record is not equal to said first private key authentication record.