System and methods for opportunistic cryptographic key management on an electronic device

• US 10,237,062 B2
• Filed: 05/09/2018
• Issued: 03/19/2019
• Est. Priority Date: 10/30/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Duo Security Incorporated (Cisco Systems, Inc.)
• Inventors: Oberheide, Jon, Song, Douglas
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US15/975,275
• Publication Number:
  US 20180262330A1
• Time in Patent Office: 314 Days
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

A system and method for opportunistic cryptographic key management includes generating a security capability assessment on a first electronic device based on security capabilities of the device, selecting a key management mode based on the security capability assessment, generating a cryptographic key based on the key management mode, and storing the cryptographic key based on the key management mode.

Claims

1. A method for cryptographic key generation, the method comprising:

performing, by the computing device, an assessment of computing capabilities of the computing device to generate a cryptographic key, wherein the assessment identifies a capability level of cryptographic key generation from a plurality of capability levels of cryptographic key generation;

selecting a cryptographic key generation mode from a plurality of distinct cryptographic key generation modes based on the assessment, wherein;

(i) if the identified capability level satisfies a minimum-security capability threshold, selecting by the computing device a first cryptographic key generation mode of the plurality of distinct cryptographic key generation modes, or

(ii) if the identified capability level does not satisfy the minimum-security capability threshold, selecting by the computing device a second cryptographic key generation mode of the plurality of distinct cryptographic key generation modes; and

generating the cryptographic key based on the selected cryptographic key generation mode.

2. The method of claim 1, wherein:

the first cryptographic key generation mode comprises an on-device cryptographic key generation mode, the on-device cryptographic key generation mode enabling the computing device to generate the cryptographic key using one or more hardware components of the computing device; and

the second cryptographic key generation mode comprises a remote key generation mode, the remote key generation mode enabling the computing device to use one or more hardware components of a remote computing device to generate the cryptographic key.

3. The method of claim 2, wherein:

the remote key generation mode includes using one of;

an external computing device that is communicatively coupled to the computing device via a first network, and

a remote computing server that is in operable communication with the computing device via a second network.

4. The method of claim 3, wherein:

the remote computing server comprises a component of multi-factor authentication service, wherein the remote computing server includes computer processing capabilities for remotely generating cryptographic keys.

5. The method of claim 1, further comprising:

identifying, at the computing device, a cryptographic key generation request, wherein the cryptographic key generation request includes the minimum-security capability threshold.

6. The method of claim 1, further comprising:

using the key generation request to set the minimum-security capability threshold that is referenced in selecting from the plurality of distinct cryptographic key generation modes.

7. The method of claim 1, further comprising:

identifying, at the computing device, a cryptographic key generation request, wherein the cryptographic key generation request includes an option prioritization used for dynamically selecting from the plurality of distinct cryptographic key generation modes, wherein the option prioritization indicates a priority for selecting available cryptographic key generation modes available to the computing device.

8. The method of claim 7, further comprising:

selecting the cryptographic key generation mode using (i) results of the analyzing and (ii) the option prioritization included with the cryptographic key generation request.

9. The method of claim 1, wherein

performing the assessment further includes:

analyzing platform-enabled key management capabilities of the computing device, the platform-enabled key management capabilities includes one or more security features enabled by an operating system of the computing device that operate to protect a generated cryptographic key.

10. The method of claim 1, wherein

performing the assessment further includes:

analyzing device usage protection capabilities of the computing device, the device usage protection capabilities include one or more authentication features implemented by the computing device for using the computing device.

11. The method of claim 1, wherein:

each of the plurality of distinct cryptographic key generation modes includes cryptographic key creation configuration data that defines one or more parameters for generating the cryptographic key, and

wherein the one or more parameters define where the cryptographic key is generated and a cryptographic key type to be generated, wherein the cryptographic key type includes one of an asymmetric key and a symmetric key.

12. The method of claim 1, wherein:

selecting, by the computing device, the second cryptographic key generation mode that includes selecting cryptographic key generation by a remote computing server,

generating the cryptographic key includes generating the cryptographic key at the remote computing server, and

in response to successfully generating the cryptographic key at the remote computing server, receiving at the computing device, from the remote computing server the cryptographic key.

13. The method of claim 1, wherein:

selecting, by the computing device, the second cryptographic key generation mode includes selecting cryptographic key generation by an external computing device, the external computing device being in operable communication with the computing device via a network,

generating the cryptographic key includes generating the cryptographic key at the external computing device, and

in response to successfully generating the cryptographic key at the external computing device, receiving from the external computing device the cryptographic key.

14. The method of claim 1, wherein:

generating the cryptographic key includes;

generating, by a hardware random number generator of the computing device, a random number to be used as a seed for generating the cryptographic key.

15. The method of claim 5, wherein:

a generation of the cryptographic key generation request is triggered in response configuring the computing device for use as a secondary authentication device in a multi-factor authentication of a transaction.

16. The method of claim 1, wherein:

generating the cryptographic key includes generating an asymmetric cryptographic key pair including a private cryptographic key and a public cryptographic key defining a private/public cryptographic key pair, and

the method further comprises;

storing, at the computing device, the private cryptographic key of the private/public cryptographic key pair; and

transmitting the public cryptographic key of the private/public cryptographic key pair to a remote multi-factor authentication service.

17. The method of claim 1, wherein:

generating the cryptographic key includes generating a symmetric cryptographic key, and

the method further comprises;

storing, at the computing device, a copy of the symmetric cryptographic key; and

transmitting a copy of the symmetric cryptographic key of the to a remote multi-factor authentication service.

18. The method of claim 1, further comprising:

during an instantiation of a cryptographic key management system on the computing device, performing the self-assessment of capabilities of the computing device by a device capability profiler of the cryptographic key management system.

19. A method enabling a mobile computing device to perform cryptographically secured multi-factor authentication, the method comprising:

performing, by the mobile computing device, an assessment of computing capabilities of the mobile computing device to generate a cryptographic key, wherein the assessment identifies a capability level of cryptographic key generation from a plurality of capability levels of cryptographic key generation;

selecting a cryptographic key generation mode from a plurality of distinct cryptographic key generation modes based on the assessment, wherein;

(i) if the identified capability level satisfies a minimum-security capability threshold, selecting by the mobile computing device a first cryptographic key generation mode of the plurality of distinct cryptographic key generation modes, or

(ii) if the identified capability level does not satisfy the minimum-security capability threshold, selecting by the mobile computing device a second cryptographic key generation mode of the plurality of distinct cryptographic key generation modes;

generating the cryptographic key according to the selected cryptographic key generation mode; and

performing a non-primary factor of authentication of a multi-factor authentication using the cryptographic key for securing one or more aspects of the non-primary factor of authentication.

20. A system for cryptographic key generation, the system comprising:

a cryptographic key management system, wherein the cryptographic key management system enables a computing device to dynamically select a cryptographic key generation mode;

a device capability profiler that tests and/or analyzes cryptographic key generation capabilities of the computing device to determine whether the computing device is capable of generating a cryptographic key, wherein;

(i) during an instantiation of the key management system on the computing device, performing, by the computing device, an assessment of computing capabilities of the computing device to generate a cryptographic key, wherein the assessment identifies a capability level of cryptographic key generation from a plurality of capability levels of cryptographic key generation;

(ii) the computing device selects a cryptographic key generation mode from a plurality of distinct cryptographic key generation modes based on the assessment, wherein;

(a) if the identified capability level satisfies a minimum-security capability threshold, selecting by the computing device a first cryptographic key generation mode of the plurality of distinct cryptographic key generation modes, or

(b) if the identified capability level does not satisfy the minimum-security capability threshold, selecting by the computing device a second cryptographic key generation mode of the plurality of distinct cryptographic key generation modes; and

(iii) the computing device generates the cryptographic key based on the selected cryptographic key generation mode.