Apparatus and method for generating keys in a network computing environment

• US 7,890,758 B2
• Filed: 03/27/2003
• Issued: 02/15/2011
• Est. Priority Date: 03/27/2003
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Stevens, Richard Joseph, Dettinger, Richard Dean, La Rocca, Jennifer Lynn
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Reza; Mohammad W
• Application Number:
  US10/401,261
• Publication Number:
  US 20040190724A1
• Time in Patent Office: 2,882 Days
• Field of Search: 380/277, 380/37, 380/262, 380/268, 380/278, 713/171
• US Class Current: 713/171
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819

Abstract

A global key control mechanism provides a single point of overall control for key generation, but portions of the key generation and/or allocation tasks may be delegated to client computer systems, thereby reducing network traffic. The global key control mechanism may download a client key generation mechanism on one or more client computer systems, and may allocate a block of keys to the client key generation mechanism. Requests for keys may then be routed to the client key generation mechanism, which can generate and/or allocate keys within the block of keys that the global key control mechanism allocated to it. When the block of keys is used up, the client key generation mechanism may request another block from the global key control mechanism. The preferred embodiments also include the capability of downloading a client key generation mechanism with an associated block of keys once the requests from one or more client applications exceed a predetermined threshold. In addition, the preferred embodiments include a hierarchy of key control mechanisms, with a single global key control mechanism that maintains control over one or more client key control mechanisms that may, in turn, control other client key control mechanism(s) or which may generate and/or allocate keys directly to requesting applications.

Claims

1. A networked computer system comprising:

a first computer system; and

a second computer system coupled via a network to the first computer system, wherein the second computer system includes a global key control mechanism, the global key control mechanism allocating and downloading a first block of globally unique keys to a client key generation mechanism executing on the first computer system, the client key generation mechanism allocating a plurality of globally unique keys from the first block to at least one application that requests a key.

2. The networked computer system of claim 1 wherein the global key control mechanism generates a plurality of globally unique keys according to at least one global key criterion.

3. The networked computer system of claim 2 wherein the client key generation mechanism executing on the first computer system generates a plurality of globally unique keys within the first block of globally unique keys according to the at least one global key criterion.

4. The networked computer system of claim 1 wherein the global key control mechanism executing on the second computer system downloads the client key generation mechanism to the first computer system.

5. The networked computer system of claim 1 wherein the client key generation mechanism requests a second block of keys from the global key control mechanism when a predetermined number of the first block of keys has been allocated by the client key generation mechanism.

6. The networked computer system of claim 1 wherein the at least one application that requests a key is executing on the first computer system.

7. A networked computer system comprising:

(A) a first computer system; and

(B) a second computer system coupled via a network to the first computer system, wherein the second computer system includes a global key control mechanism that generates a plurality of globally unique keys and determines when to share some of the work load of allocating globally unique keys, and when the global key control mechanism determines to share some of the work load of allocating globally unique keys, the global key control mechanism performs the steps of;

(B1) downloading a client key allocation mechanism to the first computer system; and

(B2) allocating and downloading a first block of globally unique keys to the client key allocation mechanism;

(C) wherein the client key allocation mechanism allocates a plurality of globally unique keys to at least one application that requests a key.

8. The networked computer system of claim 7 wherein the client key allocation mechanism requests a second block of keys from the global key control mechanism when a predetermined number of the first block of keys has been allocated by the client key allocation mechanism to the at least one application.

9. A networked computer system comprising:

(A) a first computer system; and

(B) a second computer system coupled via a network to the first computer system, wherein the second computer system includes a global key control mechanism that generates a plurality of globally unique keys and determines when to share some of the work load of generating globally unique keys, and when the global key control mechanism determines to share some of the work load of generating globally unique keys, the global key control mechanism performs the steps of;

(B1) downloading a client key generation mechanism to the first computer system; and

(B2) allocating a first block of globally unique keys to the client key generation mechanism;

(C) wherein the client key generation mechanism generates a plurality of keys in the first block and allocates the plurality of keys to at least one application that requests a key.

10. The networked computer system of claim 9 wherein the client key generation mechanism requests a second block of keys from the global key control mechanism when a predetermined number of the first block of keys has been generated and allocated by the client key generation mechanism to the at least one application.

11. A computer-implemented method for generating and allocating globally unique keys in a network computing environment, the method comprising the steps of:

(A) executing a global key control mechanism on a first computer system, the global key control mechanism generating a plurality of globally unique keys; and

(B) allocating and downloading a first block of the plurality of globally unique keys to a client key allocation mechanism executing on a second computer system coupled via network to the first computer system, the client key allocation mechanism allocating a plurality of globally unique keys in the first block to at least one application that requests a key.

12. The method of claim 11 wherein the global key control mechanism generates the plurality of globally unique keys according to at least one global key criterion.

13. The method of claim 12 further comprising the step of the client key generation mechanism generating a plurality of globally unique keys within the first block of keys according to the at least one global key criterion.

14. The method of claim 11 further comprising the steps of:

the global key control mechanism downloading the client key generation mechanism to the first computer system; and

executing the client key generation mechanism on the first computer system.

15. The method of claim 11 further comprising the step of the client key generation mechanism requesting a second block of keys from the global key control mechanism when a predetermined number of the first block of keys has been allocated by the client key generation mechanism to the at least one application.

16. A computer-implemented method for generating and allocating globally unique keys in a networked computing environment, the method comprising the steps of:

(A) generating a plurality of globally unique keys on a first computer system;

(B) determining when to share some of the work load of allocating globally unique keys;

(C) when the determination is made to share some of the work load of allocating globally unique keys, the global key control mechanism performing the steps of;

(C1) downloading a client key allocation mechanism to a second computer system; and

(C2) allocating and downloading a first block of globally unique keys to the client key allocation mechanism;

(D) the client key allocation mechanism allocating a plurality of keys in the first block to at least one application that requests a key.

17. The method of claim 16 further comprising the step of the client key allocation mechanism requesting a second block of keys from the global key control mechanism when a predetermined number of the first block of keys has been allocated by the client key allocation mechanism to the at least one application.

18. A computer-implemented method for generating and allocating globally unique keys in a networked computing environment, the method comprising the steps of:

(A) generating a plurality of globally unique keys on a first computer system;

(B) determining when to share some of the work load of generating globally unique keys;

(C) when the determination is made to share some of the work load of generating globally unique keys, performing the steps of;

(C1) downloading a client key generation mechanism to a second computer system; and

(C2) allocating a first block of globally unique keys to the client key generation mechanism;

(D) the client key generation mechanism generating a plurality of keys in the first block and allocating the plurality of keys to at least one application that requests a key.

19. The method of claim 18 further comprising the step of the client key generation mechanism requesting a second block of keys from the global key control mechanism when a predetermined number of the first block of keys has been generated and allocated by the client key generation mechanism to the at least one application.

20. A computer-readable program product comprising:

(A) a global key control mechanism that generates a plurality of globally unique keys and determines when to share some of the work load of allocating globally unique keys, and when the global key control mechanism determines to share some of the work load of allocating globally unique keys, the global key control mechanism performs the steps of;

(A1) downloading a client key allocation mechanism to the first computer system; and

(A2) allocating and downloading a first block of globally unique keys to the client key allocation mechanism;

wherein the client key allocation mechanism allocates a plurality of keys in the first block to at least one application that requests a key; and

(B) recordable media bearing the global key control mechanism and the client key generation mechanism.

21. The program product of claim 20 wherein the client key allocation mechanism requests a second block of keys from the global key control mechanism when a predetermined number of the first block of keys has been allocated by the client key allocation mechanism to the at least one application.

22. A computer-readable program product comprising:

(A) a global key control mechanism that generates a plurality of globally unique keys and determines when to share some of the work load of allocating globally unique keys, and when the global key control mechanism determines to share some of the work load of generating globally unique keys, the global key control mechanism performs the steps of;

(A1) downloading a client key generation mechanism to the first computer system; and

(A2) allocating a first block of globally unique keys to the client key generation mechanism;

wherein the client key generation mechanism generates a plurality of keys in the first block to at least one application that requests a key; and

(B) recordable media bearing the global key control mechanism and the client key generation mechanism.

23. The program product of claim 22 wherein the client key generation mechanism requests a second block of keys from the global key control mechanism when a predetermined number of the first block of keys has been generated and allocated by the client key generation mechanism to the at least one application.