# US 5,710,814 A · Cryptographic unit touch point logic

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 5,710,814 A
- Document ID: US5710814A
- Status: Granted
- Kind: A
- Application number: 08/685,076
- Filed: 1996-07-23
- Granted: 1998-01-20
- Earliest claimed: 1996-07-23
- Assignees: Cheyenne Property Trust
- Inventors: Keith Klemba; Roger Merkling
- Web page: https://patentgrep.com/patent/US5710814A

## CPC

- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/72: in cryptographic circuits
- G06F 2211/007: Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
- G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Cryptographic hardware is provided that is disabled at the time of shipment and that is selectively enabled in a trusted fashion using methods and interfaces that may be controlled by and governed by government policy in strict compliance with existing and future legislation. A given cryptographic algorithm is disabled/enabled at several points, referred to as Touch Points, and referred to collectively as Touch Point Logic. Because attributes of each touch point are satisfied by providing data that are referred to as Touch Point Data, manufactures are allowed to include disabled cryptographic hardware in their products and governments are provided with the ability to enable this cryptographic hardware only in compliance with governing legislation.

## Claims

### Claim 1

A cryptographic unit, comprising:
at least one cryptographic method that is disabled in one or more predetermined ways at a plurality of touch points; and
dynamic state enabling logic at each touch point that forms a touch point gate which requires regular reconfiguration to maintain said touch points in an enabled state.

### Claim 2 (depends on 1)

The cryptographic unit of claim 1, further comprising:
touch point data associated with said touch points to provide parametric control over the functioning of each touch point.

### Claim 3 (depends on 1)

The cryptographic unit of claim 1, wherein each cryptographic method is controlled by several touch points within that method.

### Claim 4 (depends on 1)

The cryptographic unit of claim 1, wherein all of the touch point gates for a given cryptographic method must be in an enabled state to activate that method.

### Claim 5 (depends on 1)

The cryptographic unit of claim 1, further comprising:
a touch point heartbeat established between said cryptographic unit and a policy for providing dynamic, constant refresh and state determination for said cryptographic unit.

### Claim 6

A cryptographic method, comprising the steps of:
providing at least one cryptographic method that is disabled in one or more predetermined ways at a plurality of touch points; and
providing dynamic state enabling logic at each touch point that forms a touch point gate which requires regular reconfiguration to maintain said touch points in an enabled state.

### Claim 7 (depends on 6)

The method of claim 6, further comprising the step of:
providing touch point data associated with said touch points to assert parametric control over the functioning of each touch point.

### Claim 8 (depends on 6)

The method of claim 6, wherein each cryptographic method is controlled by several touch points within that method.

### Claim 9 (depends on 6)

The method of claim 6, wherein all of the touch point gates for a given cryptographic method must be in an enabled state to activate that method.

### Claim 10 (depends on 6)

The method of claim 6, further comprising the step of:
establishing a touch point heartbeat between said cryptographic unit and a policy for providing dynamic, constant refresh and state determination for said cryptographic unit.

### Claim 11

A cryptographic unit, comprising:
at least one cryptographic method that is disabled in one or more predetermined ways at a plurality of touch points, wherein each cryptographic method is controlled by several touch points within that method; and
dynamic state enabling logic at each touch point that forms a touch point gate which requires regular reconfiguration to maintain said touch points in an enabled state.

### Claim 12 (depends on 11)

The cryptographic unit of claim 11, further comprising:
touch point data associated with said touch points to provide parametric control over the functioning of each touch point.

### Claim 13 (depends on 11)

The cryptographic unit of claim 11, wherein all of the touch point gates for a given cryptographic method must be in an enabled state to activate that method.

### Claim 14 (depends on 11)

The cryptographic unit of claim 11, further comprising:
a touch point heartbeat established between said cryptographic unit and a policy for providing dynamic, constant refresh and state determination for said cryptographic unit.

### Claim 15 (depends on 11)

The cryptographic unit of claim 11, wherein said cryptographic unit is adapted for operation in an international cryptography framework that has four service elements, each offering different types of services, wherein said service elements comprise a policy, said cryptographic unit, a host system, and a network security server.

### Claim 16 (depends on 15)

The cryptographic unit of claim 15, wherein said cryptographic unit does not provide any cryptographic functions in the absence of said policy.

### Claim 17 (depends on 15)

The cryptographic unit of claim 15, wherein said policy sets appropriate touchpoint data at various points associated with a class of service to enable any of a plurality of cryptographic classes of service.

### Claim 18 (depends on 11)

The cryptographic unit of claim 11, further comprising:
a challenge/response mechanism for securing communications between said cryptographic unit and an enabling policy.

### Claim 19 (depends on 18)

The cryptographic unit of claim 18, further comprising:
a decay function for dynamically altering a challenge/response key.

### Claim 20 (depends on 19)

The cryptographic unit of claim 19, said decay function further comprising:
means at said policy for randomly altering said challenge/response key.

### Claim 21 (depends on 19)

The cryptographic unit of claim 19, said decay function further comprising:
a fixed value offset that defines a range of acceptable values for said challenge/response key.

### Claim 22 (depends on 18)

The cryptographic unit of claim 18, wherein said challenge/response mechanism is non-repeating and/or non-predictable.

### Claim 23 (depends on 11)

The cryptographic unit of claim 11, further comprising:
a certificate mechanism for authenticating said cryptographic unit.

### Claim 24 (depends on 23)

The cryptographic unit of claim 23, wherein said certificate mechanism is non-repeating and/or non-predictable.

### Claim 25 (depends on 23)

The cryptographic unit of claim 23, wherein said certificate mechanism implements a privilege hierarchy.

### Claim 26 (depends on 11)

The cryptographic unit of claim 11, wherein said method is dynamically loaded into said cryptographic unit.

### Claim 27 (depends on 11)

The cryptographic unit of claim 11, wherein at least one said method is resident in said cryptographic unit and dormant until activated by said policy.

### Claim 28 (depends on 11)

The cryptographic unit of claim 11, wherein said cryptographic unit comprises an initialization attribute.

### Claim 29 (depends on 28)

The cryptographic unit of claim 28, wherein said cryptographic unit is functionally destroyed by alteration of said initialization attribute.

### Claim 30

A cryptographic method, comprising the steps of:
providing a cryptographic unit having at least one cryptographic method that is disabled in one or more predetermined ways at a plurality of touch points, wherein each cryptographic method is controlled by several touch points within that method; and
providing dynamic state enabling logic at each touch point that forms a touch point gate which requires regular reconfiguration to maintain said touch points in an enabled state.

### Claim 31 (depends on 30)

The cryptographic method of claim 30, further comprising the step of:
providing parametric control over the functioning of each touch point with touch point data associated with said touch points.

### Claim 32 (depends on 30)

The cryptographic method of claim 30, wherein all of the touch point gates for a given cryptographic method must be in an enabled state to activate that method.

### Claim 33 (depends on 30)

The cryptographic method of claim 30, further comprising the steps of:
establishing a touch point heartbeat between said cryptographic unit and a policy for providing dynamic, constant refresh and state determination for said cryptographic unit.

### Claim 34 (depends on 30)

The cryptographic method of claim 30, wherein said cryptographic unit is adapted for operation in an international cryptography framework that has four service elements, each offering different types of services, wherein said service elements comprise a policy, said cryptographic unit, a host system, and a network security server.

### Claim 35 (depends on 34)

The cryptographic method of claim 34, wherein said cryptographic unit does not provide any cryptographic functions in the absence of said policy.

### Claim 36 (depends on 34)

The cryptographic method of claim 34, wherein said policy sets appropriate touchpoint data at various points associated with a class of service to enable any of a plurality of cryptographic classes of service.

### Claim 37 (depends on 30)

The cryptographic method of claim 30, further comprising the step of:
providing a challenge/response mechanism for securing communications between said cryptographic unit and an enabling policy.

### Claim 38 (depends on 37)

The cryptographic method of claim 37, further comprising the step of:
dynamically altering a challenge/response key with a decay function.

### Claim 39 (depends on 38)

The cryptographic method of claim 38, further comprising the step of:
randomly altering said challenge/response key with said decay function.

### Claim 40 (depends on 38)

The cryptographic method of claim 38, further comprising the step of:
providing a fixed value offset that defines a range of acceptable values for said challenge/response key.

### Claim 41 (depends on 37)

The cryptographic method of claim 37, wherein said challenge/response mechanism is non-repeating and/or non-predictable.

### Claim 42 (depends on 30)

The cryptographic method of claim 30, further comprising the step of:
authenticating said cryptographic unit with a certificate mechanism.

### Claim 43 (depends on 42)

The cryptographic method of claim 42, wherein said certificate mechanism is non-repeating and/or non-predictable.

### Claim 44 (depends on 42)

The cryptographic method of claim 42, wherein said certificate mechanism implements a privilege hierarchy.

### Claim 45 (depends on 30)

The cryptographic method of claim 30, wherein said method is dynamically loaded into said cryptographic unit.

### Claim 46 (depends on 30)

The cryptographic method of claim 30, wherein at least one said method is resident in said cryptographic unit and dormant until activated by said policy.

### Claim 47 (depends on 30)

The cryptographic method of claim 30, wherein said cryptographic unit comprises an initialization attribute.

### Claim 48 (depends on 47)

The cryptographic method of claim 47, wherein said cryptographic unit is functionally destroyed by alteration of said initialization attribute.