Two-tiered communication security employing asymmetric session keys

In a data communication network including a host interconnected to a facility at a remote location by a telecommunication link, a data security system comprising:

• a first link encryptor/decryptor connected between said facility and said link, said first encryptor/decryptor having:
• a first means for storing a master key, said master key being utiized for enciphering session encryptor/decryptor keys;
• a second means for storing a facility session encryptor key, said facility session encryptor key being utilized to encrypt data to be transmitted from said remote location;
• a third means for storing a facility session decryptor key, said facility session decryptor key being utilized for decrypting data received at said remote location, said facility session decryptor key differing from said facility session encryptor key;
• and
• cipher means responsive to said second and third storing means, said cipher means for enciphering plain text from said facility under said facility session encryptor key for transmission to said host and for deciphering cipher text from said host under said facility session decryptor key for transmission to said facility.

A method for transmitting data in a secure manner between a terminal and a host comprising:

• generating a terminal session encryptor key at said terminal;
• encrypting said terminal session encryptor key under a master key;
• transmitting said master key encrypted terminal session encryptor key to said host;
• decrypting said master key encrypted terminal session encryptor key at said host to form a host session decryptor key;
• automatically generating a host session encryptor key upon receipt of said master key encrypted terminal session encryptor key, said host session encryptor key being different from said terminal session encryptor key;
• encrypting said host session encryptor key under said master key;
• transmitting said master key encrypted host session encryptor key to said terminal;
• decrypting said master key encrypted host session encryptor key at said terminal to form a terminal session decryptor key;
• and
• thereafter transmitting data from said terminal to said host under said terminal session encryptor key and from said host to said terminal under said host session encryptor key.