John Ralph Peck

US Patent:

8630418, Jan 14, 2014

Filed:

Jan 5, 2011

Appl. No.:

12/984869

Inventors:

Bruce A. Rich - Cedar Park TX, US
Thomas H. Benjamin - Cedar Park TX, US
John T. Peck - Liberty Hill TX, US

Assignee:

International Business Machines Corporation - Armonk NY

International Classification:

H04L 9/08
G06F 12/14
G06F 21/86
G06F 12/08

US Classification:

380277, 380278, 380279, 713193, 713194, 711113, 711135, 711161, 711162

Abstract:

A system or computer usable program product for managing keys in a computer memory including receiving a request to store a first key to a first key repository, storing the first key to a second key repository in response to the request, and storing the first key from the second key repository to the first key repository within said computer memory based on a predetermined periodicity.

US Patent:

20110258458, Oct 20, 2011

Filed:

Apr 20, 2010

Appl. No.:

12/763811

Inventors:

Kristin M. Hazlewood - Austin TX, US
John T. Peck - Liberty Hill TX, US
Krishna K. Yellepeddy - Austin TX, US

Assignee:

INTERNATIONAL BUSINESS MACHINES CORPORATION - Armonk NY

International Classification:

G06F 21/00

US Classification:

713189

Abstract:

A method, a data processing system, and a computer program product for managing cryptographic information. A determination is made as to whether a first time stamp of when cryptographic information was created is more recent than a second time stamp of a backup of the cryptographic information in response to receiving a request for the cryptographic information from a requester. The cryptographic information is used to encrypt data. The cryptographic information is prevented from being provided to the requester in response to a determination that the first time stamp of cryptographic information creation is more recent than the second time stamp of the backup of the cryptographic information.

US Patent:

20110289324, Nov 24, 2011

Filed:

May 18, 2010

Appl. No.:

12/782551

Inventors:

Krishna K. Yellepeddy - Austin TX, US
John T. Peck - Austin TX, US
Kristin M. Hazlewood - Austin TX, US
John A. Morganti - Austin TX, US

Assignee:

INTERNATIONAL BUSINESS MACHINES CORPORATION - Armonk NY

International Classification:

G06F 12/14

US Classification:

713189

Abstract:

Use of cryptographic key-store hardware security modules is optimized in a system having a first scarce high-security key storage device and a second more plentiful low-security key storage device comprising securing a cryptographic key to the higher security level by initially storing the key in the first storage device, then responsive to an event, evaluating the stored key against one or more rules, and subsequent to the evaluation, reclassifying the stored key for relocation, encrypting the reclassified key using a key-encryption key; relocating the reclassified key into the second, lower-security storage device, and storing the key-encryption key in the first storage device.

US Patent:

20120159192, Jun 21, 2012

Filed:

Mar 1, 2012

Appl. No.:

13/409717

Inventors:

Krishna K. Yellepeddy - Austin TX, US
John T. Peck - Austin TX, US
Kristin M. Hazlewood - Austin TX, US
John A. Morganti - Austin TX, US

Assignee:

INTERNATIONAL BUSINESS MACHINES CORPORATION - Armonk NY

International Classification:

G06F 12/14

US Classification:

713189

Abstract:

Use of cryptographic key-store hardware security modules is optimized in a system having a first scarce high-security key storage device and a second more plentiful low-security key storage device comprising securing a cryptographic key to the higher security level by initially storing the key in the first storage device, then responsive to an event, evaluating the stored key against one or more rules, and subsequent to the evaluation, reclassifying the stored key for relocation, encrypting the reclassified key using a key-encryption key; relocating the reclassified key into the second, lower-security storage device, and storing the key-encryption key in the first storage device.

US Patent:

20120191985, Jul 26, 2012

Filed:

Mar 20, 2012

Appl. No.:

13/424428

Inventors:

Kristin M. Hazlewood - Austin TX, US
John T. Peck - Liberty Hill TX, US
Krishna K. Yellepeddy - Austin TX, US

Assignee:

INTERNATIONAL BUSINESS MACHINES CORPORATION - Armonk NY

International Classification:

G06F 21/00

US Classification:

713189

Abstract:

A method, a data processing system, and a computer program product for managing cryptographic information. A determination is made as to whether a first time stamp of when cryptographic information was created is more recent than a second time stamp of a backup of the cryptographic information in response to receiving a request for the cryptographic information from a requester. The cryptographic information is used to encrypt data. The cryptographic information is prevented from being provided to the requester in response to a determination that the first time stamp of cryptographic information creation is more recent than the second time stamp of the backup of the cryptographic information.

US Patent:

20120213369, Aug 23, 2012

Filed:

Apr 30, 2012

Appl. No.:

13/459675

Inventors:

Bruce A. Rich - Cedar Park TX, US
Thomas H. Benjamin - Cedar Park TX, US
John T. Peck - Liberty Hill TX, US

Assignee:

INTERNATIONAL BUSINESS MACHINES CORPORATION - Armonk NY

International Classification:

H04L 9/00

US Classification:

380277

Abstract:

A method for managing keys in a computer memory including receiving a request to store a first key to a first key repository, storing the first key to a second key repository in response to the request, and storing the first key from the second key repository to the first key repository within said computer memory based on a predetermined periodicity.

US Patent:

20130044878, Feb 21, 2013

Filed:

Aug 19, 2011

Appl. No.:

13/213161

Inventors:

Bruce Arland Rich - Cedar Park TX, US
John Thomas Peck - Liberty Hill TX, US
Gordon Kent Arnold - Cary NC, US

Assignee:

INTERNATIONAL BUSINESS MACHINES CORPORATION - Armonk NY

International Classification:

H04L 9/00
H04L 9/32

US Classification:

380277

Abstract:

A key management protocol (such as KMIP) is extended to provide an extended credential type to pass information from clients to the server to enable the server to deduce pre-provisioned cryptographic materials for the individual clients. Preferably, KMIP client code communicates device information to a key management server in a value in the headers of KMIP requests that flow to the server. In this manner, KMIP requests are associated with pre-provisioned cryptographic materials for particular devices or device groups.

US Patent:

20130044882, Feb 21, 2013

Filed:

Aug 19, 2011

Appl. No.:

13/213191

Inventors:

Bruce Arland Rich - Cedar Park TX, US
John Thomas Peck - Liberty Hill TX, US

Assignee:

INTERNATIONAL BUSINESS MACHINES CORPORATION - Armonk NY

International Classification:

H04L 9/08

US Classification:

380279

Abstract:

A key management protocol (such as Key Management Interoperability Protocol (KMIP)) is extended via set of one or more custom attributes to provide a mechanism by which clients pass additional metadata to facilitate enhanced key provisioning operations by a key management server. The protocol comprises objects, operations, and attributes. Objects are the cryptographic material (e.g., symmetric keys, asymmetric keys, digital certificates and so on) upon which operations are performed. Operations are the actions taken with respect to the objects, such as getting an object from a key management server, modifying attributes of an object and the like. Attributes are the properties of the object, such as the kind of object it is, the unique identifier for the object, and the like. According to this disclosure, a first custom server attribute has a value that specifies a keygroup name that can be used by the key management server to locate (e.g., during a Locate operation) key material associated with a named keygroup. A second custom server attribute has a value that specifies a keygroup name into which key material should be registered (e.g., during a Register operation) by the server. A third custom server attribute has a value that specifies a default keygroup that the server should use for the device passing a request that include the attribute. Using these one or more custom server attributes, the client taps into and consumes/contributes to the key management server's provisioning machinery.