# US 8,789,210 B2 · Key usage policies for cryptographic keys

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,789,210 B2
- Document ID: US8789210B2
- Status: Granted
- Kind: B2
- Application number: 13/100,693
- Filed: 2011-05-04
- Published: 2012-11-08
- Granted: 2014-07-22
- Earliest claimed: 2011-05-04
- Assignees: International Business Machines Corporation
- Applicants: Todd W. Arnold; Elizabeth A. Dames; Carsten D. Frehr; Michael J. Kelly; Kenneth B. Kerr; Richard V. Kisley; Eric D. Rossman; Eric B. Smith
- Inventors: Todd W. Arnold; Elizabeth A. Dames; Carsten D. Frehr; Michael J. Kelly; Kenneth B. Kerr; Richard V. Kisley; Eric D. Rossman; Eric B. Smith
- Web page: https://patentgrep.com/patent/US8789210B2

## CPC

- G06F 21/602: {Providing cryptographic facilities or services}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computer program product for secure key management is provided. The computer program product includes a tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for creating a token and populating the token with key material, and binding key control information to the key material. The key control information includes information relating to usage of the key material populating one or more key usage fields that define attributes that limit actions that may be performed with the key material.

## Claims

### Claim 1

A computer program product for secure key management, the computer program product comprising:
a non-transient computer readable medium readable by a processing circuit and storing instructions for execution by the processing circuit for:
creating a token and populating the token with key material; and
cryptographically binding key control information to the key material such that the key material is accompanied with key binding material, which conforms to and is wrapped using a wrapping method indicated by token fields that are unchanged by a chosen wrapping method, the key control information including:
information relating to usage of the key material populating one or more key usage fields that define attributes that limit actions that may be performed with the key material,
wherein the key control information further comprises a key usage field count indicating a number of the key usage fields and each of the key usage fields comprises:
a high order byte containing flag bits as an indicator, the high order flag bits comprising a first position defining a rule for export using a symmetric key, a second position defining a rule for export using an unauthenticated asymmetric key, a third position defining a rule for export using an authenticated asymmetric key, a fourth position defining a rule for export to a TR-31 format and a fifth position defining a rule for export in RAW format; and
a low order byte containing flag bits as an indicator, the low order flag bits comprising a first position defining a rule for export using a DES key, a second position defining a rule for export using an AES key and a fifth position defining a rule of export using an RSA key,
each of the indicators being independent and indicative of one key exchange that is performable with the key material.

### Claim 2 (depends on 1)

The method according to claim 1, wherein the number of the key usage fields is 1 to n.

### Claim 3 (depends on 1)

The method according to claim 1, wherein a fixed set of indicators have indicators that are in use and indicators that are reserved, the reserved indicators being set to ‘Not allowed’.

### Claim 4

A system for secure key management, comprising:
a computer processor; and
an application configured to execute on the computer processor, the application implementing:
creation of a token and population of the token with key material; and
a cryptographic binding of key control information to the key material such that the key material is accompanied with key binding material, which conforms to and is wrapped using a wrapping method indicated by token fields that are unchanged by a chosen wrapping method, the key control information including:
information relating to usage of the key material populating one or more key usage fields that that define attributes that limit actions that may be performed with the key material,
wherein each of the key usage fields comprises:
a high order byte containing flag bits as an indicator, the high order flag bits comprising a first position defining a rule for export using a symmetric key, a second position defining a rule for export using an unauthenticated asymmetric key, a third position defining a rule for export using an authenticated asymmetric key, a fourth position defining a rule for export to a TR-31 format and a fifth position defining a rule for export in RAW format; and
a low order byte containing flag bits as an indicator, the low order flag bits comprising a first position defining a rule for export using a DES key, a second position defining a rule for export using an AES key and a fifth position defining a rule of export using an RSA key,
each of the indicators being independent and indicative of one key exchange that is performable with the key material.

### Claim 5 (depends on 4)

The method according to claim 4, wherein the number of the key usage fields is 1 to n.

### Claim 6 (depends on 4)

The method according to claim 4, wherein the key control information further comprises a key usage field count indicating a number of the key usage fields.

### Claim 7 (depends on 4)

The method according to claim 4, wherein a fixed set of indicators have indicators that are in use and indicators that are reserved, the reserved indicators being set to ‘Not allowed’.