Abstract: A system involving a central computer (2) and a remote computer (3), which can communicate over a link (1), is migrated from in-clear working to encrypted working automatically as the computers receive and install long term keys necessary for encrypted communication. When migration is required, the settings at both ends of the link need to be changed to “encrypt” simultaneously and, particularly, if there are numerous remote computers and the possibility of connection of a remote computer to different central computers, as is possible in virtual private network (VPN) scenarios, severe problems can ensue. Hence, as well as the normal two modes of working “in-clear” and “encrypt”, a third mode in which “initiate encryption” is set at one end of the link and “accept encryption” is set at the other end of the link is proposed.

Abstract: Business data flows from one computer system (1) to another (2) and its integrity can be protected by cryptographic means, such as digital signatures. In particular, a source system (1) may use a private key (DSPR) to sign outgoing data, and a destination system (2) may use a public key (DSPU) to verify incoming data. For security purposes all keys should be changed at scheduled times calculated using factors including key lifetime (from which is calculated the key expiry time) and key delivery time. If a key is compromised it needs to be changed at other than the scheduled time, and in general this will result in calculation of a new scheduled key change time. If a DSPR key is delivered to the source system (1) encrypted by a key encryption key (KEK), then change to the KEK key will in general also be needed upon compromise of the DSPR key.