Managing use of security keys

• US 10,116,438 B1
• Filed: 08/23/2017
• Issued: 10/30/2018
• Est. Priority Date: 12/31/2012
• Status: Active Grant

• Current Assignee: RSA Security LLC (Symphony Technology Group LLC)
• Original Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Inventors: Van Dijk, Marten E., Morneau, Todd A., Duane, William M.
• Primary Examiner(s): Simitoski, Michael
• Application Number:
  US15/684,087
• Time in Patent Office: 433 Days
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

A method is used in managing use of security keys. Based on a request for use of a key that serves as part of a data security system, a set of criteria to apply to the request is determined. The set of criteria pertain to security management of the key that is subject of the request. The set of criteria is applied to the request; and a result is determined based on the application of the set of criteria.

Claims

1. A method comprising steps of:

receiving a request for a key that serves as part of a data security system that limits a number of accesses to key or keys associated therewith, wherein the request comprises one or more attributes associated with the request;

analyzing the one or more attributes associated with the request and a history in connection with one or more previous requests;

based on the analysis, determining a riskiness in connection with the request, wherein the riskiness indicates a high risk in connection with the request; and

upon determining the high risk in connection with the request, determining to refuse the request and creating a new limit that reduces the number of accesses to key or keys associated with the data security system;

wherein the steps are performed by at least one processing device comprising a processor coupled to a memory.

2. An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;

said at least one processing device being configured to;

receive a request for a key that serves as part of a data security system that limits a number of accesses to key or keys associated therewith, wherein the request comprises one or more attributes associated with the request;

analyze the one or more attributes associated with the request and a history in connection with one or more previous requests;

based on the analysis, determine a riskiness in connection with the request, wherein the riskiness indicates a high risk in connection with the request; and

upon determining the high risk in connection with the request, determine to refuse the request and create a new limit that reduces the number of accesses to key or keys associated with the data security system.

3. An article of manufacture comprising a processor-readable non-transitory storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes said at least one processing device to:

receive a request for a key that serves as part of a data security system that limits a number of accesses to key or keys associated therewith, wherein the request comprises one or more attributes associated with the request;

analyze the one or more attributes associated with the request and a history in connection with one or more previous requests;

based on the analysis, determine a riskiness in connection with the request, wherein the riskiness indicates a high risk in connection with the request; and

upon determining the high risk in connection with the request, determine to refuse the request and create a new limit that reduces the number of accesses to key or keys associated with the data security system.