Abstract: A key management scheme for managing encryption keys in a cryptographic co-processor includes the first step of selecting a key from one of a symmetrical key type and an asymmetrical key type. Then, the key bit length is selected. The key is then generated and, lastly, the key is represented in either an external form or an internal form.

Abstract: A unique method of authenticating access to a computer system or central processor is disclosed. The computer system is in data communication with a plurality of stored challenges and response pairs in a set, with one challenge corresponding to only one response. After a user successfully logs onto the system, the system randomly selects one of the challenges from the set to which the user must respond. If, after comparing the user response with the response in the set corresponding to the selected challenge, the system determines a match, the system continues to select challenges and prompting for responses and will ultimately allow access to the central processor after a predetermined number of matches are received from the user.

Abstract: A method of generating a recovery key encryption key (RKEK) in a secure manner by an integrated circuit (IC) and a key recovery escrow agent includes the steps of generating by the IC a first number having a private component and a public component, and generating by the escrow agent a second number having a private component and a public component. The public component of the first number is provided to the escrow agent, and the public component of the second number is provided to the integrated circuit. A Diffie-Hellman modulo-exponentiation mathematical operation is performed by the integrated circuit using the private component of the first number, the public component of the first number and the public component of the second number to create the RKEK. A similar operation is performed by the escrow agent using the private component of the second number, the public number of the second number and the public component of the first number to create the RKEK at its end.

Abstract: A method and apparatus for configuring an ultrasound imaging system at a remote location by obtaining an encrypted feature key from a central location (e.g., via telephone) and then inputting that feature key into the ultrasound imaging system using an operator interface (e.g., a keyboard). To validate the feature key, the ultrasound imaging system decrypts the encrypted data and then compares the decrypted data to validation data pre-stored in the system. If the decrypted data matches the validation data, then the optional feature identified by the feature key will be enabled each time the system is booted or initialized. Optionally, an expiration date can be associated with the activated option, after which date the feature will be disabled when the system is initialized. Similarly, an activated optional feature can be disabled at a remote location by the input of an encrypted key obtained from a central location.