Cryptographic facility environment backup/restore and replication in a public key cryptosystem

• US 5,265,164 A
• Filed: 10/31/1991
• Issued: 11/23/1993
• Est. Priority Date: 10/31/1991
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Johnson, Donald B., Martin, William C., Matyas, Stephen M., Prymak, Rostislaw, Le, An V., Wilkins, John D., Rohland, William S.
• Primary Examiner(s): Cain, David C.
• Application Number:
  US07/786,237
• Time in Patent Office: 754 Days
• Field of Search: 380/30, 380/23, 380/25, 380/45, 380/21
• US Class Current: 380/30
• CPC Class Codes: G06F 9/30003 Arrangements for executing specific machine instructions
• CPC Class Codes: G06F 9/30007 to perform operations on data operands
• CPC Class Codes: G06F 9/30043 LOAD or STORE instructions; Clear instruction
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A computer apparatus, program and method function in a data processing system to replicate a cryptographic facility. The system includes a first cryptographic facility containing a portable part which personalizes the first cryptographic facility. The system also includes a second cryptographic facility which is linked to the first cryptographic facility by a public key cryptographic system. The portable part of the first cryptographic facility is encrypted and transferred to the second cryptographic facility, where it is decrypted and used to personalize the second cryptographic facility to enable replication of the first cryptographic facility. In one application, personalization of the second cryptographic facility can be in response to the detection of a failure in the first cryptographic facility. In another application, multiple cryptographic facilities can be brought on-line for parallel operation in the data processing system.

Claims

1. In a data processing system which includes a first cryptographic facility containing configuration information for configuring said first cryptographic facility and coupled to a second cryptographic facility in a public key cryptographic system, a method for duplicating a configuration of said first cryptographic facility, comprising the steps of:

generating a public key and a private key as a pair in said second cryptographic facility;

transferring said public key to said first cryptographic facility;

encrypting at least a portion of said configuration information under said public key forming a configuration token at said first cryptographic facility;

transferring said configuration token to said second cryptographic facility;

decrypting said configuration token using said private key forming a duplicate configuration information at said second cryptographic facility; and

configuring said second cryptographic facility with said duplicate configuration information to duplicate a configuration of said first cryptographic facility.

2. The method of claim 1, which further comprises:

said configuration information including secured information and non-secured information;

said secured information including a master key of said first cryptographic facility;

said encrypting step further comprising encrypting said secured information under said public key;

transferring a cryptographic key data set to said second cryptographic facility, containing an operating key encrypted under a key expression formed as an exclusive OR product of said master key and a control vector for said operating key.

3. The method of claim 1, which further comprises the steps of:

detecting a failure condition of said first cryptographic facility, prior to said configuring step;

said configuring step being performed in response to said detecting step.

4. The method of claim 1, which prior to said configuring step, further comprises the steps of:

generating a second public key and a second private key as a second pair, in said first cryptographic facility;

transferring said second public key to said second cryptographic facility;

encrypting a representation of said configuration information under said second private key forming a digital signature at said first cryptographic facility;

transferring said digital signature to said second cryptographic facility;

decrypting said digital signature using said second public key forming a reference representation of said configuration information at said second cryptographic facility;

comparing said reference representation of said configuration information with a representation of said duplicate configuration information at said second cryptographic facility to confirm receipt thereof from said first cryptographic facility; and

said configuring step being performed in response to said comparing step.

5. The method of claim 4, which further comprises the steps of:

detecting a failure condition of said first cryptographic facility, prior to said configuring step;

said configuring step being performed in response to said detecting step and said comparing step.

6. The method of claim 1, wherein said step of transferring said public key further comprises:

transferring said public key and a control vector to said first cryptographic facility, said control vector specifying limitations on use of said public key to include said step of encrypting at least a portion of said configuration information under said public key forming said configuration token at said first cryptographic facility.

7. In a data processing system which includes a first cryptographic facility containing configuration information for configuring said first cryptographic facility and coupled to a second cryptographic facility in a public key cryptographic system, a method for duplicating a configuration of said first cryptographic facility, comprising the steps of:

generating a public key and a private key as a pair at said second cryptographic facility;

transferring said public key to said first cryptographic facility;

generating a key encrypting key at said first cryptographic facility;

encrypting at least a portion of said configuration information under said key encrypting key forming a configuration token at said first cryptographic facility;

transferring said configuration token to said second cryptographic facility;

encrypting at least said key encrypting key under said public key forming an encrypted key lock at said first cryptographic facility;

transferring said encrypted key block to said second cryptographic facility as a received encrypted key block;

decrypting said received encrypted key block using said private key forming a recovered key block including a recovered key encrypting key at said second cryptographic facility;

decrypting said configuration token using said recovered key encrypting key forming a duplicate configuration information at said second cryptographic facility; and

configuring said second cryptographic facility with said duplicate configuration information to duplicate a configuration of said first cryptographic facility.

8. The method of claim 7, which further comprises:

said configuration information including secured information and non-secret information;

said secured information including a master key of said first cryptographic facility;

said first said encrypting step further comprising encrypting said secured information under said public key;

transferring a cryptographic key data set to said second cryptographic facility, containing an operating key encrypted under a key expression formed as an exclusive OR product of said master key and a control vector for said operating key.

9. The method of claim 7, which further comprises the steps of:

detecting a failure condition of said first cryptographic facility, prior to said configuring step;

said configuring step being performed in response to said detecting step.

10. The method of claim 7, which prior to said configuring step, further comprises the steps of:

generating a second public key and a second private key as a second pair, in said first cryptographic facility;

transferring said second public key to said second cryptographic facility;

encrypting a representation of said encrypted key block under said second private key forming a digital signature at said first cryptographic facility;

transferring said digital signature to said second cryptographic facility;

decrypting said digital signature using said second public key forming a reference representation of said encrypted key block at said second cryptographic facility;

comparing said reference representation of said encrypted keyblock with a representation of said received encrypted key block at said second cryptographic facility to confirm receipt thereof from said first cryptographic facility; and

said configuring step being performed in response to said comparing step.

11. The method of claim 7, which prior to said configuring step, further comprises the steps of:

generating a second public key and a second private key as a second pair, in said first cryptographic facility;

transferring said second public key to said second cryptographic facility;

encrypting a representation of said key block under said second private key forming a digital signature at said first cryptographic facility;

transferring said digital signature to said second cryptographic facility;

decrypting said digital signature using said second public key forming a reference representation of said key block at said second cryptographic facility;

comparing said reference representation of said key block with a representation of said recovered key block at said second cryptographic facility to confirm receipt thereof from said first cryptographic facility; and

said configuring step being performed in response to said comparing step.

12. The method of claim 11, which further comprises the steps of:

detecting a failure condition of said first cryptographic facility, prior to said configuring step;

said configuring step being performed in response to said detecting step and said comparing step.

13. The method of claim 7, wherein said step of transferring said public key further comprises:

transferring said public key and a control vector to said first cryptographic facility, said control vector specifying limitations on use of said public key to include said step of encrypting at least said key encrypting key under said public key forming said encrypted key block at said first cryptographic facility.

14. The method of claim 7, wherein said encrypted key block is formed comprising the steps of:

computing a hash value of a representation of said configuration information at said first cryptographic facility;

concatenating said hash value with said key encrypting key, forming an argument value at said first cryptographic facility; and

encrypting at least said argument value under said public key forming said encrypted key block at said first cryptographic facility;

and wherein said configuring step is performed in response to the steps comprising;

separating said hash value from said key encrypting key in said recovered key block, as a received hash value, at said second cryptographic facility;

computing a reference hash value of a representation of said duplicate configuration information, at said second cryptographic facility;

comparing said reference hash value with said received hash value, at said second cryptographic facility;

said configuring step being performed in response to said comparing step.

15. The method of claim 7, wherein said encrypted key block is formed comprising the steps of:

accessing a master key value at said first cryptographic facility;

computing a hash value of a representation of said configuration information at said first cryptographic facility;

logically combining said master key with said key encrypting key forming a product value, using an invertible logical operation;

concatenating said product value and said hash value forming an argument value at said first cryptographic facility; and

encrypting at least said argument value under said public key forming said encrypted key block at said first cryptographic facility;

and wherein said recovered key encrypting key is formed, comprising the steps of;

separating said product value from said recovered key block at said second cryptographic facility;

transferring said master key to said second cryptographic facility; and

logically combining said master key with said product at said second cryptographic facility, forming said recovered key encrypting key, using an inverse of said logical operation.

16. A computer program in a data processing system which includes a first cryptographic facility containing configuration information for configuring said first cryptographic facility and coupled to a second cryptographic facility in a public key cryptographic system, the computer program when executed in said data processing system, performing a method for duplicating a configuration of said first cryptographic facility, comprising the steps of:

generating a public key and a private key as a pair in said second cryptographic facility;

transferring said public key to said first cryptographic facility;

encrypting at least a portion of said configuration information under said public key forming a configuration token at said first cryptographic facility;

transferring said configuration token to said second cryptographic facility;

decrypting said configuration token using said private key forming a duplicate configuration information at said second cryptographic facility; and

configuring said second cryptographic facility with said duplicate configuration information to duplicate a configuration of said first cryptographic facility.

17. The computer program of claim 16, which further comprises:

said configuration information including secured information and non-secret information;

said secured information including a master key of said first cryptographic facility;

said encrypting step further comprising encrypting said secured information under said public key;

said method performed by the computer program transferring a cryptographic key data set to said second cryptographic facility, containing an operating key encrypted under a key expression formed as an exclusive OR product of said master key and a control vector for said operating key.

18. The computer program of claim 16, wherein said method performed thereby further comprises the steps of:

detecting a failure condition of said first cryptographic facility, prior to said configuring step;

said configuring step being performed in response to said detecting step.

19. A computer program in a data processing system which includes a first cryptographic facility containing configuration information for configuring said first cryptographic facility and coupled to a second cryptographic facility in a public key cryptographic system, the computer program when executed in said data processing system, performing a method for duplicating a configuration of said first cryptographic facility, comprising the steps of:

generating a public key and a private key as a pair of said second cryptographic facility;

transferring said public key to said first cryptographic facility;

generating a key encrypting key at said first cryptographic facility;

encrypting at least a portion of said configuration information under said key encrypting key forming a configuration token at said first cryptographic facility;

transferring said configuration token to said second cryptographic facility;

encrypting at least said key encrypting key under said public key forming an encrypted key block at said first cryptographic facility;

transferring said encrypted key block to said second cryptographic facility as a received encrypted key block;

decrypting said received encrypted key block using said private key forming a recovered key block including a recovered key encrypting key at said second cryptographic facility;

decrypting said configuration token using said recovered key encrypting key forming a duplicate configuration information at said second cryptographic facility; and

configuring said second cryptographic facility with said duplicate configuration information to duplicate a configuration of said first cryptographic facility.

20. The computer program of claim 19, which further comprises:

said configuration information including secured information and non-secured information;

said secured information including a master key of said first cryptographic facility;

said first said encrypting step further comprising encrypting said secured information under said public key;

said method performed by the computer program transferring a cryptographic key data set to said second cryptographic facility, containing an operating key encrypted under a key expression formed as an exclusive OR product of said master key and a control vector for said operating key.

21. In a data processing system which includes a first cryptographic facility containing configuration information for configuring said first cryptographic facility and coupled to a second cryptographic facility in a public key cryptographic system, a computer apparatus for duplicating a configuration of said first cryptographic facility, comprising:

generating means for generating a public key and a private key as a pair in said second cryptographic facility;

first transferring means coupled to said generating means, for transferring said public key to said first cryptographic facility;

encrypting means coupled to said first transferring means, for encrypting at least a portion of said configuration information under said public key forming a configuration token at said first cryptographic facility;

second transferring means coupled to said encrypting means, for transferring said configuration token to said second cryptographic facility;

decrypting means coupled to said second transferring means, for decrypting said configuration token using said private key forming a duplicate configuration information at said second cryptographic facility; and

configuring means coupled to said decrypting means, for configuring said second cryptographic facility with said duplicate configuration information to duplicate a configuration of said first cryptographic facility.

22. The computer apparatus of claim 21, which further comprises:

said configuration information including secured information and non-secured information;

said secured information including a master key of said first cryptographic facility;

said encrypting means encrypting said secured information under said public key;

third transferring means coupled to a storage means in said data processing system, for transferring a cryptographic key data set to said second cryptographic facility, containing an operating key encrypted under a key expression formed as an exclusive OR product of said master key and a control vector for said operating key.

23. The computer apparatus of claim 21, which further comprises:

detecting means coupled to said first and said second cryptographic facility, for detecting a failure condition of said first cryptographic facility;

said configuring means operating in response to said detecting means.

24. In a data processing system which includes a first cryptographic facility containing configuration information for configuring said first cryptographic facility and coupled to a second cryptographic facility in a public key cryptographic system, a computer apparatus for duplicating a configuration of said first cryptographic facility, comprising:

first generating means for generating a public key and a private key as a pair at said second cryptographic facility;

first transferring means coupled to said first generating means, for transferring said public key to said first cryptographic facility;

second generating means for generating a key encrypting key at said first cryptographic facility;

first encrypting means coupled to said second generating means, for encrypting at least a portion of said configuration information under said key encrypting key forming a configuration token at said first cryptographic facility;

second transferring means coupled to said first encrypting means, transferring said configuration token to said second cryptographic facility;

second encrypting means coupled to said first transferring means and said second generating means, for encrypting at least said key encrypting key under said public key forming an encrypted key block at said first cryptographic facility;

third transferring means coupled to said second encrypting means, transferring said encrypted key block to said second cryptographic facility as a received encrypted key block;

first decrypting means coupled to said third transferring means, for decrypting said received encrypted key block using said private key forming a recovered key block including a recovered key encrypting key at said second cryptographic facility;

second decrypting means coupled to said second transferring means, decrypting said configuration token using said recovered key encrypting key forming a duplicate configuration information at said second cryptographic facility; and

configuring means coupled to said decrypting means, for configuring said second cryptographic facility with said duplicate configuration information to duplicate a configuration of said first cryptographic facility.

25. The computer apparatus of claim 24, which further comprises:

said configuration information including secured information and non-secured information;

said secured information including a master key of said first cryptographic facility;

said first encrypting means encrypting said secured information under said public key;

fourth transferring means coupled to a storage means in said data processing system, for transferring a cryptographic key data set to said second cryptographic facility, containing an operating key encrypted under a key expression formed as an exclusive OR product of said master key and a control vector for said operating key.

26. The computer apparatus of claim 24, which further comprises:

detecting means coupled to said first, and said second cryptographic facility, for detecting a failure condition of said first cryptographic facility;

said configuring means operating in response to said detecting means.