International Business Machines Corporation

Phil Chi-Chung Yeh

Ronald Morton Smith, Sr

Shawn D Lundvall

Ronald A Smith

Michael James Kelly

Randall J Easter

Robert S DeBellis

Vincent A Spano

Edward J D'Avignon

Lucina L Green

William A Merz

Peter Grimm Sutton

Ronald M Smith

Wendell W Wilkinson

Mark A Boonie

Margaret Croft Enichen

A method, system and program product for executing a multi-function instruction in an emulated computer system by specifying, via the multi-function instruction, either a capability query or execution of a selected function of one or more optional functions, wherein the selected function is an installed optional function, wherein the capability query determines which optional functions of the one or more optional functions are installed on the computer system.

Multi-function instruction that determines whether functions are installed on a system

Optional function multi-function instruction in an emulated computing environment

A method, system and program product for executing a multi-function instruction in a computer system by specifying, via the multi-function instruction, either a capability query or execution of a selected function of one or more optional functions, wherein the selected function is an installed optional function, wherein the capability query determines which optional functions of the one or more optional functions are installed on the computer system.

Optional function multi-function instruction

A method, system and computer program product for computing a message authentication code for data in storage of a computing environment. An instruction specifies a unit of storage for which an authentication code is to be computed. An computing operation computes an authentication code for the unit of storage. A register is used for providing a cryptographic key for use in the computing to the authentication code. Further, the register may be used in a chaining operation.

Security message authentication instruction

A method, system and computer program product for digesting data in storage of a computing environment. The digesting computes a condensed representation of a message or data stored in the computer storage. A COMPUTE INTERMEDIATE MESSAGE DIGEST (KIMD) and a COMPUTE LAST MESSAGE DIGEST (KLMD) instruction are disclosed which specify a unit of storage to be digested by a secure hashing algorithm.

Message digest instruction

A method, system and program product for executing a cipher message assist instruction in a computer system by specifying, via the cipher message assist instruction, either a capability query installed function or execution of a selected function of one or more optional functions, wherein the selected function is an installed optional function, wherein the capability query determines which optional functions of the one or more optional functions are installed on the computer system.

Cipher message assist instruction

Security message authentication control instruction

A method, system and program product for enciphering or deciphering storage of a computing environment by specifying, via an instruction, a unit of storage to be enciphered or deciphered. The unit of storage to be enciphered or deciphered includes a plurality of pages which may be operated on in a chaining operation.

Cipher message assist instructions

Message digest instructions

Public key security control (PKSC) is provided for a cryptographic module by means of digitally signed communications between the module and one or more authorities with whom it interacts. Authorities interact with the crypto module by means of unsigned queries seeking nonsecret information or signed commands for performing specified operations. Each command signed by an authority also contains a transaction sequence number (TSN), which must match a corresponding number stored by the crypto module for the authority. The TSN for each authority is initially generated randomly and is incremented for each command accepted from that authority. A signature requirement array (SRA) controls the number of signatures required to validate each command type. Upon receiving a signed command from one or more authorities, the SRA is examined to determine whether a required number of authorities permitted to sign the command have signed the command for each signature requirement specification defined for that command type. A command requiring multiple signatures is held in a pending command register (PCR) while awaiting the required cosignatures. The crypto module also stores a single crypto module signature sequence number (CMSSN) which it increments for each reply to any authority to enable one authority to determine whether any other authority has communicated with the module.

Method and apparatus for providing public key security control for a cryptographic processor

Public key security control (PKSC) is provided for a cryptographic module by means of digitally signed communications between the module and one or authorities with whom it interacts. Authorities interact with the crypto module by means of unsigned queries seeking nonsecret information or signed commands for performing specified operations. Each command signed by an authority also contains a transaction sequence number (TSN), which must match a corresponding number stored by the crypto module for the authority. The TSN for each authority is initially generated randomly and is incremented for each command accepted from that authority. A signature requirement array (SRA) controls the number of signatures required to validate each command type. Upon receiving a signed command from one or more authorities, the SRA is examined to determine whether a required number of authorities permitted to sign the command have signed the command for each signature requirement specification defined for that command type. A command requiring multiple signatures is held in a pending command register (PCR) while awaiting the required cosignatures. The crypto module also stores a single crypto module signature sequence number (CMSSN) which it increments for each reply to any authority to enable one authority to determine whether any other authority has communicated with the module.

A method and apparatus for decrypting an input block encrypted under a predetermined key in a cryptographic system having a cryptographic facility providing cryptographic functions for transforming blocks of data. The cryptographic functions include an encryption function for encrypting a block under a predetermined key and a transformation function for transforming a block encrypted under a first key to the same block encrypted under a second key. The cryptographic functions have at least one key pair with the property that successive encryption of a block under the keys of the pair regenerates the block in clear form. The input block is first transformed into an intermediate block encrypted under one of the key pair using the transformation function. The intermediate block is then further encrypted under the other of the key pair using the encryption function to generate an output block successively encrypted under the keys of pair, thereby to regenerate the input block in clear form. The invention is useful in cryptographic systems in which the decryption function being emulated by the transformation and encryption functions is unavailable for export control or other reasons.

Method and apparatus for performing strong encryption or decryption data using special encryption functions

A method and apparatus for serializing access by n entities to a shared resource in an information handling system. A waiter list is defined as a circular list of n bits, each of which is assigned to an entity. When a bit is false (0) it indicates that the corresponding entity is not waiting for the lock; when the bit is true (1) it indicates the corresponding entity is waiting for the lock. A next waiter indicator (NWI) is also defined that contains a value from 0 to n inclusive; a value of 0 indicates that there are currently no waiters, while a value from 1 to n indicates the next waiter to whom the lock will be granted. The waiter list is initialized to zeros to indicate there are no waiters. When an entity requests a lock that cannot be granted, the entity is made a waiter by setting the corresponding bit in the waiter list to one. If the next waiter indicator is zero, indicating that there were previously no waiters for the lock, the indicator is set to identify the requesting entity as the next waiter. When a lock is released and there is a next waiter for the lock as indicated by the next waiter indicator, that waiter is made a lock holder and the corresponding bit in the waiter list is reset to indicate that the entity is no longer a waiter for the lock. A new next waiter is then found by scanning the waiter list beginning with the entry following that for the entity granted access to the resource. This ensures that once a waiter releases a lock, the waiter is not selected to receive the lock again until all other waiters have received the lock.

Growing community of inventors

Poughkeepsie, NY, United States of America

Phil Chi-Chung Yeh