Dual-party session key derivation
AssigneeInternational Business Machines Corporation
InventorsTodd W. Arnold, Richard V. Kisley, Michael J. Miele
Life of this patent
Estimating the term…
Abstract
Embodiments relate to negotiating a session key to secure a user session executed in a host computer. An electronic hardware security module (HSM) located in the host computer generates a first session key. A smart card generates a second session key that matches the first session key. An encrypted copy of the second session key is communicated to an electronic host application module installed in the host computer. The electronic host application module decrypts the encrypted session key to obtain a copy of the session key such that the first and second session keys possessed by the smart card, the host application module and the HSM match one another.
Claims20
A method of negotiating a session key to secure a user session executed in a host computer, the method comprising:
- generating, by an electronic hardware security module (HSM) located in the host computer, a first session key;
- generating, by an electronic smart card, a second session key that matches the first session key;
- encrypting a copy of the second session key based on encryption information provided by the HSM to generate an encrypted session key and communicating the encrypted session key to an electronic host application module installed in the host computer;
- and
- decrypting, by the electronic host application module, the encrypted session key to obtain the copy of the second session key such that the first and second session keys possessed by the smart card, the host application module and the HSM match one another.
A computer program product for implementing a method of negotiating a session key to secure a user session executed in a host computer, the computer program product comprising:
- a computer readable storage medium having program instructions embodied therewith, the program instructions readable by a processing circuit to cause the processing circuit to perform a method comprising:
- generating, by an electronic hardware security module (HSM) located in the host computer, a first session key;
- generating, by an electronic smart card, a second session key that matches the first session key;
- encrypting a copy of the second session key to generate an encrypted session key and communicating the encrypted session key to an electronic host application module installed in the host computer;
- and
- decrypting, by the electronic host application module, the encrypted session key to obtain the copy of the second session key such that the first and second session keys possessed by the smart card, the host application module and the HSM match one another.
A computer system for implementing a method of negotiating a session key to secure a user session executed in a host computer, the system comprising:
- a memory having computer readable instructions;
- and
- a computer processor configured to execute the computer readable instructions, the instructions comprising:
- generating, by an electronic hardware security module (HSM) located in the host computer, a first session key;
- generating, by an electronic smart card, a second session key that matches the first session key;
- encrypting a copy of the second session key to generate an encrypted session key and communicating the encrypted session key to an electronic host application module installed in the host computer;
- and
- decrypting, by the electronic host application module, the encrypted session key to obtain the copy of the second session key such that the first and second session keys possessed by the smart card, the host application module and the HSM match one another.
Dependencies are inferred from the claim text.