US 6,959,390 B1Granted

Data processing system and method for maintaining secure user private keys in non-secure storage

AssigneeInternational Business Machines Corporation

InventorsDavid Carroll Challener, Daryl Carvis Cromer, Mark Charles Davis, Scott Thomas Elliott, Howard Jeffrey Locker, Andy Lloyd Trotter, James Peter Ward

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

A data processing system and method are disclosed for maintaining secure user private keys in a non-secure storage device. A master key pair is established for the system. The master key pair includes a master private key and a master public key. The master key pair is stored in a protected storage device. A unique user key pair is established for each user. The user key pair includes a user private key and a user public key. The user private key is encrypted utilizing the master public key. The encrypted user private key is stored in the non-secure storage device, wherein the encrypted user private key is secure while stored in the non-secure storage device.

Claims10

Dependent claims

A method in a data processing system for maintaining multiple secure user private keys in a non-secure storage device, said method comprising the steps of:

establishing an encryption device having an encryption engine and a protected storage device, wherein said protected storage device is accessible only through said encryption engine;
establishing a master key pair for said system, said master key pair including a master private key and a master public key;
storing said master key pair in said protected storage device;
establishing a unique user key pair for each of multiple users, each of said user key pairs including a user private key and a user public key;
said encryption engine encrypting each of said user private keys utilizing said master public key;
storing each of said encrypted user private keys in said non-secure storage device, wherein each of said encrypted user private keys is secure while stored in said non-secure storage device;
in response to receiving a message to transmit to a recipient, said encryption engine decrypting a particular user's private key utilizing said master private key;
said encryption engine encrypting said message utilizing said decrypted particular user's private key and said recipient's public key;
and
transmitting said encrypted message to said recipient.

7 more elements

A data processing system for maintaining multiple secure user private keys in a non-secure storage device, said data processing system comprising:

an encryption device for establishing a master key pair for said system that includes a master private key and a master public key, said encryption device including an encryption engine and a protected storage device for storing said master key pair wherein said protected storage device is capable of being accessed only through said encryption engine;
said encryption device executing code for establishing a unique user key pair for each of multiple users, each of said user key pairs including a user private key and a user public key;
said encryption engine executing code for encrypting each of said user private keys utilizing said master public key;
a non-secure storage device for storing each of said encrypted user private keys, wherein each of said encrypted user private keys is secure while stored in said non-secure storage device;
wherein said encryption engine, responsive to
receiving a message to transmit to a recipient, executes code for decrypting a particular user's private key utilizing said master private key and executes code for encrypting said message utilizing said decrypted particular user's private key and said recipients public key;
and
wherein said system transmits said encrypted message to said recipient.

5 more elements

Dependencies are inferred from the claim text.