Todd Michael Arnold, 54516 Mountain Meadows Dr, Bessemer City, NC 28016

6601175, Jul 29, 2003

Mar 16, 1999

09/270418

Todd Weston Arnold - Charlotte NC
David Carroll Challener - Raleigh NC

International Business Machines Corporation - Armonk NY

G06F 15177

713202, 713 1, 713 2, 713100, 713200, 713201, 713182, 713183, 713184, 709229

Features of a data processing system, such as its configuration, are protected utilizing a machine-specific limited-life password. The data processing system includes execution resources for executing a watchdog program, a limited-life value generator, and non-volatile storage that stores a machine-specific value at least partially derived from relatively unique information associated with the data processing system (and preferably also derived from a secret control password). In response to each attempted access to the protected features of the data processing system, the watchdog program generates at least one machine-specific limited-life password from the machine-specific value and a limited-life value generated by the limited-life value generator. The watchdog program allows access to the protected features in response to entry of the machine-specific limited-life password and otherwise denies access. Depending upon implementation, the limited-life value can represent a timestamp that limits the duration that the machine-specific limited-life value is valid or a nonce that limits the number of times that the machine-specific limited-life value can be used.

7779258, Aug 17, 2010

Sep 22, 2006

11/534236

Todd W. Arnold - Charlotte NC, US
Elizabeth A. Dames - Harrisburg NC, US
Carsten D. Frehr - Farum, DK
Kurt S. Jacobsen - Roskilde, DK
Michael J. Kelly - Staatsburg NY, US
Mark D. Marik - Denver NC, US
Jesper Wiese - Lyngby, DK

International Business Machines Corporation - Armonk NY

H04N 7/16
H04L 9/00
H04L 9/32
G06F 17/30
G06F 7/04
G06K 9/00
H03M 1/68
H04K 1/00

713169, 713171, 713172, 713181, 726 26

A method, article, and system for providing an effective implementation of data structures, and application programming interface (API) functions that allow secure execution of functions behind a secure boundary. The controlling mechanism is a flexible, extendable, and non-forgeable block that details how values and parameters behind the secure boundary can be changed. The invention allows for one entity to execute a security function that will normally require extensive authorizations or dual or multiple control. The method and system comprise instructions that are cryptographically protected against alteration or misuse, wherein the instructions further comprise a trusted block that defines security policies that are permitted when an application program employs the trusted block in APIs. The trusted block has a number of fields containing rules that provide an ability to limit how the trusted block is used, thereby reducing the risk of the trusted block being employed in unintended ways.

7908474, Mar 15, 2011

Sep 22, 2006

11/534232

Todd W. Arnold - Charlotte NC, US
Elizabeth A. Dames - Harrisburg NC, US
Carsten D. Frehr - Farum, DK
Kurt S. Jacobsen - Roskilde, DK
Michael J. Kelly - Staatsburg NY, US
Mark D. Marik - Denver NC, US
Jesper Wiese - Lyngby, DK

International Business Machines Corporation - Armonk NY

H04L 9/00
G06F 21/00

713155, 713190

A method, article, and system for providing an effective implementation of a data structure comprising instructions that are cryptographically protected against alteration or misuse, wherein the instructions further comprise a trusted block that defines specific key management policies that are permitted when an application program employs the trusted block in application programming interface (API) functions to generate or export symmetric cryptographic keys. The trusted block has a number of fields containing rules that provide an ability to limit how the trusted block is used, thereby reducing the risk of the trusted block being employed in unintended ways or with unintended keys.

8538939, Sep 17, 2013

May 31, 2011

13/118925

Todd W. Arnold - Charlotte NC, US
Carsten D. Frehr - Farum, DK
Richard V. Kisley - Charlotte NC, US

International Business Machines Corporation - Armonk NY

G06F 7/00

707700

A computer program product is provided and includes a tangible storage medium readable by a processing circuit and on which instructions are stored for execution by the processing circuit for initially verifying a presence of parameters passed to a parameter database and that a selected group of the parameters are greater than or equal to zero, parsing optional block data to validate the optional block data, determine a length thereof and a number of optional blocks contained therein and proceeding with one of a secondary info-parsing and a secondary data-parsing operation with respect to the optional block data in accordance with content of the parameters passed to the parameter database.

8566913, Oct 22, 2013

May 4, 2011

13/100357

Todd W. Arnold - Charlotte NC, US
Elizabeth A. Dames - Concord NC, US
Carsten D. Frehr - Farum, DK
Kenneth B. Kerr - New Paltz NY, US
Richard V. Kisley - Charlotte NC, US
Michael J. Kelly - Staatsburg NY, US
Eric D. Rossman - Wappingers Falls NY, US
Eric B. Smith - Concord NC, US

International Business Machines Corporation - Armonk NY

H04L 29/06

726 5, 713193

A system for secure key management is provided. The system includes a computer processor and an application configured to execute on the computer processor, the application implementing a method. The method includes populating a section of information associated with a key, the section of information being populated with information relating to a level of protection of the key accumulated over time. Secure key management further includes securely binding the section of information to the key, wherein the key is encrypted.

8615081, Dec 24, 2013

Jun 1, 2011

13/150592

Todd W. Arnold - Charlotte NC, US
Elizabeth A. Dames - Concord NC, US
Richard V. Kisley - Charlotte NC, US
Michael J. Miele - Concord NC, US
James W. Sweeny - Millbrook NY, US

International Business Machines Corporation - Armonk NY

H04L 9/00

380 44

Key creation includes sending a first public key part from a first system to a second system, receiving a second public key part sent by the second system to the first system and establishing a first secret material in the first system using the first and second public key parts, wherein the first secret material is identical to a second secret material established on the second system using the first and second key parts. Key creation also includes binding key control information to the first secret material in the first system, wherein the key control information includes information relating to key type and key management and deriving a first key material from the combination of the key control information and the first secret material, wherein the first key material is identical to a second key material derived by the second system.

8619990, Dec 31, 2013

Apr 27, 2011

13/095226

Todd W. Arnold - Charlotte NC, US
Elizabeth A. Dames - Concord NC, US
Carsten D. Frehr - Farum, DK
Kenneth B. Kerr - New Paltz NY, US
Richard V. Kisley - Charlotte NC, US
Eric D. Rossman - Wappingers Falls NY, US
Eric B. Smith - Concord NC, US

International Business Machines Corporation - Armonk NY

H04L 9/08
H04L 9/30

380277

A system for creating a secure key is provided that includes a computer processor and an application configured to execute on the computer processor, the application implementing a method that includes creating a token and populating a key control information section of the token with a value to indicate a minimum number of key parts used to form a key. Creating the secure key also includes populating a payload section of the token with a first key part, binding the key control information section to the payload section, adding a second key part to the first key part and iterating the value and binding the key control information section to the payload section after the second key part has been added. Creating the secure key further includes indicating the key is complete, wherein the key comprises a combination of the first and second key parts.

8634561, Jan 21, 2014

May 4, 2011

13/100354

Todd W. Arnold - Charlotte NC, US
Elizabeth A. Dames - Concord NC, US
Carsten D. Frehr - Farum, DK
Kenneth B. Kerr - New Paltz NY, US
Richard V. Kisley - Charlotte NC, US
Michael J. Kelly - Staatsburg NY, US
Eric D. Rossman - Wappingers Falls NY, US
Eric B. Smith - Concord NC, US

International Business Machines Corporation - Armonk NY

G06F 21/00

380280, 380277, 380278, 380279

A system for implementing secure key management is provided. The system includes a computer processor and an application configured to execute on the computer processor, the application implementing a method. The method includes populating a section of information associated with a key, the section being populated with information relating to how the key was created. The method also includes populating the section with information relating to how the key was acquired by a secure module; and binding the section to the key, wherein the key is encrypted.