US 12,143,476 B2
Method of data transfer, a method of controlling use of data and cryptographic device
Ian Bygrave, Cambridge (GB); Alec Edgington, Cambridge (GB); Richard Kettlewell, Cambridge (GB); David O'Doherty, Cambridge (GB); Nicholas Smith, Cambridge (GB); and Neil Walker, Cambridge (GB)
Assigned to NCIPHER SECURITY LIMITED, Cambridge (GB)
Filed by NCIPHER SECURITY LIMITED, Cambridge (GB)
Filed on Nov. 8, 2023, as Appl. No. 18/504,378.
Application 17/376,930 is a division of application No. 16/075,575, granted, now 11,101,983, issued on Aug. 24, 2021, previously published as PCT/GB2017/050264, filed on Feb. 3, 2017.
Application 18/504,378 is a continuation of application No. 17/376,930, filed on Jul. 15, 2021, granted, now 11,849,029.
Claims priority of application No. 1602088 (GB), filed on Feb. 5, 2016.
Prior Publication US 2024/0073003 A1, Feb. 29, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/08 (2006.01); G06F 21/60 (2013.01); H04L 9/32 (2006.01)
CPC H04L 9/083 (2013.01) [G06F 21/606 (2013.01); H04L 9/0825 (2013.01); H04L 9/088 (2013.01); H04L 9/0897 (2013.01); H04L 9/3234 (2013.01); H04L 9/3263 (2013.01); H04L 9/3268 (2013.01)] 10 Claims
OG exemplary drawing
 
1. A hardware security module device, comprising:
a first transceiver configured to receive a first public key and a first cryptographic certificate, comprising information from which the origin of the first public key can be validated, from a second hardware security module device;
a first processor configured to perform cryptographic operations, the first processor being further configured to:
generate a second cryptographic key pair and a second cryptographic certificate, the second cryptographic key pair comprising a second public key and a second private key and the second cryptographic certificate comprising information from which the origin of the second public key can be identified, wherein the first transceiver is further configured to send the second public key and the second cryptographic certificate to the second hardware security module device;
validate that the first public key originated from the second hardware security module device;
encrypt a first cryptographic key and a corresponding access control list to provide a secure channel between the hardware security module device and the second hardware security module device, wherein the secure channel is derived from the first public key, wherein the access control list specifies that a valid use credential must be presented in order to grant a first type of use of the first cryptographic key;
wherein the first transceiver is further configured to send the encrypted first cryptographic key and access control list, and information from which the origin of the encrypted first cryptographic key can be validated, to the second hardware security module device.