International Business Machines Corporation

Garry Joseph Sullivan

James Richard Coon

Richard J Gusefski

Daniel Paul Kolz

Jakob Christopher Lang

Michael J Jordan

Michael J Miele

Brian D Valentine

Victor M Lourenco

Franz Hardt

Roger D Krsnak

Jan Schneider

Peter Kenneth Szwed

Steven G Glassen

Marco Kraemer

John C Dayka

Christopher V Derobertis

Klaus Werner

Thomas B Mathias

Edward W Chencinski

Jessica P Doherty

Marco Pavone

Clifford L Hansen

Taylor L Schreck

Michael J Young

David Christopher Hinkemeyer

Rainieri Ventura

David Nguyen

Ross Martin Heninger

Michael Young

Jessica Doherty

Michael Joseph Jordan

A computer-implemented method for remote management of hardware security modules (HSMs) includes receiving a command request from a mobile device. The command request includes an encrypted key part and an encrypted signing key. The HSM decrypts the command request using a key associated with a security zone of the mobile device. The HSM decrypts the encrypted key part and the encrypted signing key. Decrypting the encrypted key part and the encrypted signing key includes using the key associated with the security zone of the mobile device and a key associated with a remote administrator associated with the mobile device. A command is generated for a domain with a target HSM. The command is generated using the decrypted key part and the decrypted signing key. The command is transmitted to the domain for execution by the target HSM. Various other methods, systems, and computer-readable media are also disclosed.

Remote management of hardware security modules

An approach is provided for distributing a root key to a hardware security module (HSM) of an HSM cluster. A signed first command is transmitted to a source HSM to create a master key. A fingerprint of the master key is received in a response signed by the source HSM using a module signing key hardcoded into the source HSM at manufacturing time. A second command is transmitted to a first HSM to generate an importer key pair. A request is transmitted to the source HSM to create and export a wrapped master key. The master key wrapped with a transport key is received. The wrapped master key is transmitted to the first HSM. The master key is activated in the first HSM.

Securely transporting a root key using a privately/public key pair for user-controlled authentication of nodes in a hardware security module cluster

The solutions disclosed enable security credentials to be shared between two entities. Embodiments of the present invention can be used to facilitate the transfer security credentials associated with a first level of permission of a first entity to a second entity that does not have the security credentials associated with the first level of permission in response to receiving a request to share security credentials between two entities.

Authenticated copying of encryption keys between secure zones

A system and method of managing a plurality of assets by associating a smart card with a compute subsystem by installing a database on the smart card and embedding an identifier of the compute subsystem. The system and method, in turn, may receive a request to access an asset of a compute subsystem; verify that a feature of the database is enabled in response to the request, the feature corresponding to the asset; and grant the access to access the asset upon the verifying of the feature.

Asset protection based on redundantly associated trusted entitlement verification

A computer program product for integrated key serving is provided. The computer program product includes a tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method. The method includes using a smart card of two or more smart cards with a support element of two or more support elements to create an encryption key and storing the encryption key in an encrypted file that can only be decrypted by the smart card and the support element used to create the encryption key.

Integrated key server

A method for using shared vulnerability to provide trusted communication services between systems is disclosed. For example, a server may deny access to a service which renders it vulnerable to an untrusted client unless access to a useful vulnerability is received from the client. That is, the server may trust the client because any misuse by the client may result in the server exploiting the shared vulnerability. A system may request access to a service on another system to perform some transaction. Upon receiving this request, the server may determine a vulnerability of the client useful in deterring or stopping unwanted actions. The server may request access to this vulnerability. Once this vulnerability has been granted to the server, the server may then grant access to the requested service to the client.

Trusted electronic communication through shared vulnerability

An alarm system for certain hearing impaired individuals having implanted hearing assistive devices contains a device for detecting an alarm condition, and a transmitter which is tuned to a resonant frequency of an implanted passive energy portion of a cochlear implant or similar device. Upon detection of an alarm condition, the transmitter transmits an alarm signal at the resonant frequency, causing the implanted device to resonate even in the absence of the externally worn hearing assistive portion. Resonance is perceived by the hearing impaired individual as a buzzing or other abnormal noise, alerting the individual to the alarm condition.

Alarm system for hearing impaired individuals having hearing assistive implanted devices

Growing community of inventors

Rochester, MN, United States of America

Garry Joseph Sullivan