Abstract:
A paired-secure message identification controller for computers and the like is provided which yields secure communications between two computers with the invention installed. The message originator provides a guest identification module to the recipient which matches the originator&#39;s host identification module. If return messages are to be sent another set of modules is provided by the recipient. Before a message is transmitted from the originator to the recipient a pre-validation check is first performed. Once the validation is received the message is authenticated and/or encrypted, transmitted, reauthenticated, and/or decrypted, and verified for accuracy. The control codes, message, date, time and any error messages are permanently stored.

Description:
BACKGROUND OF THE INVENTION 
     The present invention relates generally to the field of telecommunications systems for the transmission of data, and, more specifically to those systems which assure privacy and integrity of communications by providing for verification of the identity of the sender and/or the receiver, authentication of the message and encrypting/decrypting of the message content. 
     The use of computers and telecommunications networks to deliver messages containing critical data and value-related transfers is restrained by uncertainty of the identity of the party at the other end of the connection and by uncertainty of the integrity of the message content. 
     A limited degree of certainty and integrity is attained by controlling the physical attributes of the network and the handling of the message; by restricting the number of participants in a network, by limiting the devices and communication lines that can be used, by requiring special access features such as plastic cards and by prescribing the message format to be employed. 
     Another alternative is to control the message itself; to transform the message so that it is intelligible only to the intended party or to express it in a private language. 
     Both solutions depend on isolating each network from all others. Many networks have been established using one or both of these solutions. They are successful in serving specific groups of users for particular purposes. They are not suitable as a foundation for universal electronic transaction services. Further, since proprietary systems and encrypted messages forego economies of scale to attain the isolation that permits control they are too expensive to serve the great number of critical-data and value-related messages now processed through paper-based systems. The most important example is found in banking where 40 billion paper checks are processed each year. 
     SUMMARY OF THE INVENTION 
     It is, therefore, a primary object of the present invention to provide a paired-secure message identification controller for computers and the like which eliminates the uncertainty about the identity of the other party in an electronic transaction. The uncertainty about the identity of the party at the other end of the communication channel is resolved by placing at the recipient&#39;s site one member of a pair of devices, both of which are under the control of the originator. 
     A further object is to provide a paired-secure message identification controller for computers and the like which eliminates the uncertainty about the content of the message. The paired devices resolve the uncertainty about the integrity of the communication by providing dual authentication of the message and by accommodating encrypting/decrypting of the content. 
     A still further object is to provide a paired-secure message identification controller for computers and the like which eliminates the uncertainty about the fact and timing of the delivery. The paired devices resolve the uncertainty of the integrity and timing of the message by providing paired records of the message and/or of the identity of the originator and recipient. 
     A yet still further object is to provide a paired-secure message identification controller for computers and the like which is compatible with existing computers and telecommunications processors, and with existing authentication &amp; encrypting schemes, and additionally permits each user to establish controlled communication over any available communication channel with any desired number of other parties at moderate cost. 
     Further objects of the invention will appear as the description proceeds. 
     To the accomplishment of the above and related objects, this invention may be embodied in the form illustrated in the accompanying drawings, attention being called to the fact, however, that the drawings are illustrative only and that changes may be made in the specific construction illustrated and described within the scope of the appended claims. 
    
    
     BRIEF DESCRIPTION OF THE DRAWING FIGURES 
     The figures in the drawings are briefly described as follows: 
     FIG. 1 is a diagrammatic view illustrating a control processor, with blocks removed for clarity, connected to a computer and a telecommunications processor. The jagged lines emphasize that two data links are present. 
     FIG. 2 is a diagrammatic view illustrating two control processors communicating with each other. 
     FIG. 3 is a diagrammatic view illustrating the components of the control processor including identification modules, universal interface and a custom interface. 
     FIG. 4 is a diagrammatic view of a typical host or guest identification module with on-board micro-processor. 
     FIG. 5 is a plan view of a plug-in identification module similar to the diagrammatic view of FIG. 4. 
     FIG. 6 is a plan view of a typical control processor board. 
     FIGS. 7A and 7B is a protocol flow chart, at maximum security level, illustrating how the various components cooperate with each other. 
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     As illustrated in FIG. 1, the paired-secure message identification controller 10 consists of a control processor 12 containing a host identification module 14, and one or more guest identification modules typified by 16 and 18. The controller 10 is associated with a computer 20, which can range in size from a portable computer to a large mainframe central processor, and a telecommunications processor 22. 
     The placement of identification modules may best be understood with reference to FIG. 2. The originator&#39;s site is called site &#34;A&#34; while the recipient&#39;s site is called site &#34;B&#34;. For each site, there exists a host identification module, such as Host &#34;A&#34;, numeral 24 at site A and Host &#34;B&#34;, numeral 26 at site B. There also exists one guest identification module for each remote site with which communications is to take place, such as Guest &#34;B&#34;, numeral 28 at site A and Guest &#34;A&#34;, numeral 30 at site B. Each of the control processors, 32 and 34, can accept as many guest modules as needed. 
     The transfer of control from one party to another, Host &#34;A&#34; to Guest &#34;B&#34; or Host &#34;B&#34; to Guest &#34;A&#34;, is effected locally between a host identification module and a paired guest identification module, within a single control processor using data link 37 at site A and date link 39 at site B. 
     The transfer of location from one site to another, Host &#34;A&#34; at site A to Guest A at site B or Host &#34;B&#34; at site B to Guest &#34;B&#34; at site A, is effected over any distance by both ends of the data link, numeral 36 for &#34;A&#34; and numeral 38 for &#34;B&#34;, are controlled by the same party. 
     Additional details of control processor 12 may be seen in FIG. 3. The control processor 12 includes custom interfaces 38, as appropriate to computer 20 and telecommunications processor 22; and a universal interface 40 that enables communication between host and guest identification modules, typified by 14, 16 and 18, whether at the same site or resident at other sites. 
     Details of the guest and host identification modules may best be understood with reference to block diagram FIG. 4 and FIG. 5, which is a view of a printed-circuit board implementation of this circuit. Since both host and guest modules are functionally similar, host module 14 will be considered. Host module 14 includes control circuitry 42 to process signals to and from the universal interface 40, security cells 44, and message record cells 46. Each identification module is equipped with an on-board micro-processor 48 with built-in read-only-memory (ROM). 
     The security cells 44, permit the controlling party to control the activation and disabling of the identification module 14 and to establish multiple levels of security by the insertion of cells containing processing sequences, encrypting/decrypting keys, authentication algorithms and random number generators. 
     The message record cells 46 provide a permanent record of each transaction by storing selected reference codes, and/or the message, and/or the identity codes for the sender or receiver as defined by the security cells 44 to provide different levels of security. Separate logs are recorded in each of the identification modules that are paired in a transaction thereby assuring the means to resolve all questions about a message and its processing. 
     The entire control processor 50, with plug-in identification modules may best be understood with reference to FIG. 6 which illustrates the type of board which might plug into an option slot on such personal computers as the IBM PC, PC/XT or PC/AT. On the left, four guest module sockets, 52, 54, 56 and 58 are provided along with their respective connectors 60, 62, 64 and 66. A buffer memory 68, typically a random-access-memory (RAM) provides volatile storage. Control circuitry 70 is provided as previously explained. Two host module are provided, 72 for local guests, and 74 for remote guests. Timing and date information is provided by clock/calendar 76. An asynchronous communications interface 78 feeding a serial interface connector 80 provides a standard interface, such as RS232, for connection to a modem. A custom interface 82 matches the controller board 50 to the host computer via an edge-connector 84. A modular expansion connector 86 permits stacking of boards to increase the number of guests accommodated. While a particular personal computer based system is shown, it is understood that other configurations for various personal computers, mini-computers and mainframe computers could be built without departing from the spirit of the invention. 
     The configuration illustrated in FIG. 6 is readily attainable at the present state-of-the-art. Typical parts might include: microprocessor for guest/host modules: INTEL 8048 with 2K ROM. Custom interface: LS245 octal transceivers for control bus buffers and data bus buffers, LS244 octal address bus buffer, LS374 octal flip-flop for bus direction and enable, and for data latch, LS373 octal latches for I/O address decoder. Asynchronous communications interface: LS245 control, 8250 serializer/deserializer (SERDES). Clock and calendar: 8255. Control circuitry: INTEL 8048 microprocessor with 2K ROM, LS244, LS245 and LS373 buffers, latches and decoders, LS158, LS245, LS373 memory support logic. &#34;LS&#34; numbers refer to low-power-Schottky, transistor to transistor logic integrated circuits and the 8000 series numbers are Intel numbers for large scale integrated circuits. On the identification modules, the security cells are 8 bit ROMs. The non-volatile memory for the message record is implemented in standard bubble-memory arrays or on magnetic media. 
     The complex process of cross-verifying the identities of a sender and a remote recipient, encrypting and decrypting a message and logging all transactions when maximum security levels are used may best be understood with reference to FIGS. 7A,B. It must be understood that the purpose of the invention is to transmit a message from origination at 100 to the final message log at 200 with accuracy and integrity. 
     To better understand this protocol flow chart the headings should first be examined from left to right. &#34;Originator&#34; refers to the originator&#39;s computer into which the controller board has been inserted. &#34;Paired-secure message ID (identification) controller&#34; refers to the board which has been plugged into the originators computer. Herein it will be referred to as the originator&#39;s P-S MIC. This originator&#39;s P-S MIC has host module &#34;A&#34; plugged into it which contains a series of identity codes, coding keys and algorithms. For two-way communication, a guest module is also inserted, but for the sake of clarity one-way communications is illustrated, from originator to recipient. &#34;COMM&#34; represents the communications links between originator and recipient. &#34;P.S.&#34; represents the data pathway used for paired-secured pre-verification, before the actual message is transmitted and &#34;REG&#34; represents the regular data pathway used for transmission of the actual message itself. Similarly, at the recipient&#39;s site, the recipient&#39;s &#34;paired-secure message ID controller&#34; (recipient&#39;s P-S MIC) has both guest and host modules installed, since both are necessary to receive messages. &#34;Recipient&#34; refers to the computer into which the recipient&#39;s P-S MIC is installed and on which the final message will be displayed and stored along with the final message log and any error messages. Within each column, one item of hardware, e.g. the recipient&#39;s P-S MIC, is given a succession of numerals i.e. 122, 128, 152, 158, 160 to clarify the flow of data and control signals. Similarly a module, e.g. the guest module in the recipient&#39;s P-S MIC, is given a sequence of numerals i.e. 126, 150, 154 to clarify the different processes that occur within the security of the sealed module. 
     The originator and recipient maintain a common code {C} of whatever structure and degree of sophistication is mutually agreeable. If plain-language transmission is desired, {C} is an identity transformation. 
     The originator&#39;s host identification module 102 and its remote guest identification module 104 maintain a unique common key {K} in their security cells, hold secret identity codes of the host {H} and guest {G} and have separate random number generators {X} and {Y}. The recipient&#39;s host identification module 106 and its local guest identification module 108 maintain a common key {L}. 
     The originator 112 originates 100 the message {M} and its envelope {E} and sends them via data pathway 110 to the originator P-S MIC 118. The envelope includes the names and addresses of the originator 112 and recipient 114, a serial number of the message and the date and time. 
     The host identification module 116 in the originator&#39;s P-S MIC 118, upon receipt of {M} and {E}, determines {H} and {G} from the participants named in the envelope, retrieves the key {K} appropriate to the {H}{G} pair, generates a random number {X} and generates {U} a transform of {X} based on {K} and {V} a transform of {X} based on {H}. The envelope {E} is modified to become {F} with a serial number based on traffic between the host/guest module pair. An identification code {I} is generated from {M} and {E} based on {K}. The originator&#39;s P-S MIC 120 sends variables {F}{I}{U} and {V} to the recipient&#39;s P-S MIC 122 via data pathway 124 using the paired-secured communication pathway indicated by the arrow. 
     The originator&#39;s guest identification module 126 in the recipient&#39;s P-S MIC 122 identifies {H} and {G} from the addresses in {F} and extracts {X1} from {U} using {K} and {X2} from {V} using {H}. If {X1}={X2}, the identity of the sender {H} is verified. If not verified, error procedures are followed to advise non-acceptance and the values of {XIF} are stored via pathways 130 and 132. With acceptance, a new random number {Y} is generated and a new pair of recognition codes is prepared using {K} to obtain a pre-verification code {W} and using {G} to obtain {Z}. The recipient&#39;s P-S MIC 128 transmits acceptance using variables {FIWZ} to the originator&#39;s P-S MIC 134 via pathway 136. 
     The host identification module 138 in the originator&#39;s P-S MIC 134 matches records based on {F}, then determines {G} based on {F} and extracts {X} from {Z}. If {X} is consistent with {G} the identity of {G} is confirmed along with the assurance that {G} has confirmed the identity of {H}. If rejected, error procedures are followed to advise nonacceptance and the values {XIF} are stored via pathway 142. With acceptance, {Y} is extracted from the pre-verification code {W} using {K} and {T} is generated from {Y} using {H} as the recognition code for the message. The originator&#39;s P-S MIC 144 transmits variables {EIT} to the originator&#39;s computer 146. 
     The originator&#39;s computer 146 matches records based on {E}, transforms the message {M} based on {C} into {N} and releases it to the recipient&#39;s computer 148 via pathway 149 with {T} and the original envelope {E}. 
     The recipient&#39;s computer 148, upon receipt of {N}, extracts {M}, based on {C} as determined from the identity of the sender included in {E}. The originator&#39;s guest identification module 150 in the recipient&#39;s P-S MIC 152 identifies the originator {H} from {E}, retrieves {K} and generates {I} from {ME}, given {K} and matches on {I}. If {I} as-generated matches {I} as-received the content of the message is confirmed. Then {Y} is extracted from {T} on the basis of {H} and {G} represented in {F}. The match of {Y} confirms the pre-verification provided earlier in {W}. If there is no match an error message with {EIXF} is stored at 133 via data 132. If the match is confirmed, the local host side 154 of the originator&#39;s guest identification module 150 generates {R} from {M} and {E}, given {L}, generates {J} from {I}  given {L}, and stores {EIRJ} in 153. 
     The recipient&#39;s host identification module 156, located in recipient&#39;s P-S MIC 158 receives {E}, {J} and {R} from its pair, the originator&#39;s guest identification module 154, matches on {E} the record received from the recipient&#39;s computer 148 via data link 155, generates {R} from {M} and {E}, given the key {L}, and verifies that {R} as-received matches {R} as-generated. If there is no verification, error message {ERJ} is reported at 159. If verified, {I} is extracted from {J}, given {L} and acceptance is reported by the recipient&#39;s P-S MIC 160 to the recipient&#39;s computer 162. 
     The recipient&#39;s computer 162 matches records on {E} and generates {Q} from {J}, given {C}. Upon advise via data link 163, the originator&#39;s computer 164 repeats the exact same matching and extracts{J} from {Q} given {C}. The final message logs of the originator&#39;s computer 166 and the recipient&#39;s computer 200 are identical. The message logs of the originator&#39;s host module 140 and originator&#39;s guest module 128 are identical and the originator&#39;s guest module 153 and the recipient&#39;s host module 159 are identical. Error messages in each pair record rejection events. 
     The above example represents an exposition of a large number of capacities of the controller. A subset of these capacities may be selected and the order in which they occur may be varied without departing from the spirit of the invention. 
     While certain novel features of this invention have been shown and described and are pointed out in the annexed claims, it will be understood that various omissions, substitutions and changes in the forms and the details of the device illustrated and in its operation can be made by those skilled in the art without departing from the spirit of the invention.