Secure key storage systems, methods and apparatuses

• US 10,250,396 B2
• Filed: 07/14/2016
• Issued: 04/02/2019
• Est. Priority Date: 06/28/2012
• Status: Active Grant

• Current Assignee: OLogN Technologies AG
• Original Assignee: OLogN Technologies AG
• Inventors: Ignatchenko, Sergey
• Primary Examiner(s): Nguyen, Trong H
• Application Number:
  US15/210,508
• Publication Number:
  US 20170048071A1
• Time in Patent Office: 992 Days
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

The systems, methods and apparatuses described herein provide a computing environment that manages private key storage. An apparatus according to the present disclosure may comprise a first non-volatile storage for storing a private root key for signing digital certificates, an input device for receiving manual input from an operator, a communication interface consisting of a one-way transmitter for transmitting information from the apparatus, and a processor. The processor may be configured to retrieve the private root key from the first non-volatile storage, receive information for a new digital certificate through the input device, generate the new digital certificate according to the received information, sign the new digital certificate using the private root key and transmit the new digital certificate from the apparatus using the transmitter.

Claims

1. An apparatus, comprising:

a first non-volatile storage for storing a root private key of a certificate authority for signing digital certificates;

an input device for receiving manual input from an operator;

a communication interface consisting of a one-way transmitter for transmitting information from the apparatus to an intermediate device; and

a processor configured to;

retrieve the root private key from the first non-volatile storage;

receive information in the manual input for a new digital certificate through the input device;

generate the new digital certificate according to the received information;

sign the new digital certificate using the root private key; and

transmit the new digital certificate from the apparatus to one or more client devices via the intermediate device using the one-way transmitter, wherein the apparatus is inaccessible to the one or more client devices.

2. The apparatus of claim 1, further comprising:

a timer, and

a second non-volatile storage for storing a certificate revocation list (CRL); and

wherein the processor is further configured to;

retrieve the CRL;

add a timestamp generated by the timer to the retrieved CRL;

sign the retrieved CRL using the root private key; and

transmit the signed CRL through the one-way transmitter from the apparatus.

3. The apparatus of claim 2, wherein the processor is further configured to append one or more error detection codes, error correction codes, or both to the signed CRL.

4. The apparatus of claim 2, wherein the processor is further configured to transmit the signed CRL at regular intervals.

5. The apparatus of claim 1, wherein the processor is further configured to transmit the new digital certificate at regular intervals.

6. The apparatus of claim 1, wherein the processor is further configured to transmit, via the one-way transmitter, a message containing information regarding activity of the apparatus to a monitoring service for analyzing and monitoring activities of the apparatus.

7. A system, comprising:

a first device, comprising;

a first non-volatile storage for storing a root private key of a certificate authority for signing digital certificates;

an input device for receiving manual input from an operator;

a communication interface consisting of a one-way transmitter for transmitting information from the first device to a second device; and

a processor configured to generate a new digital certificate to be transmitted to the second device using the one-way transmitter; and

the second device, comprising;

a receiver coupled to the one-way transmitter of the first device;

a communication port for establishing a two-way communication channel with an external network including one or more client devices, wherein the first device is inaccessible to the one or more client devices of the external network; and

a processor configured to;

receive the new digital certificate from the first device; and

transmit the new digital certificate to at least one client device of the external network through the communication port.

8. The system of claim 7, wherein the processor of the first device is further configured to append one or more error detection codes, error correction codes, or both to a signed certificate revocation list (CRL).

9. The system of claim 8, wherein the second device is configured to perform error detections and corrections appended to the signed CRL and distribute the signed CRL to client devices.

10. A system, comprising:

a first device, comprising;

a first non-volatile storage for storing a root private key of a certificate authority for signing digital certificates;

an input device for receiving manual input from an operator;

a first transceiver for communication with a second device; and

a processor configured to;

receive a new digital certificate request;

verify that the new digital certificate request is valid;

retrieve the root private key from the first non-volatile storage;

generate the new digital certificate according to the new digital certificate request;

sign the new digital certificate using the root private key; and

transmit the new digital certificate from the first device to the second device using the first transceiver; and

the second device, comprising;

a second transceiver coupled to the first transceiver of the first device, wherein the first and second transceivers are coupled together by a non-routable, point-to-point connection;

a communication port for establishing a two-way communication channel with an external network having one or more client devices, wherein the first device is inaccessible to the one or more client devices of the external network; and

a processor configured to transmit the new digital certificate to at least one client device of the external network through the communication port.

11. The system of claim 10, wherein the first device further comprises:

a timer, and

a second non-volatile storage for storing a certificate revocation list (CRL); and

wherein the processor of the first device is further configured to;

receive an update CRL request;

verify that the update CRL request is valid;

retrieve the CRL;

add a timestamp generated by the timer to the retrieved CRL;

sign the retrieved CRL using the root private key; and

transmit the signed CRL through the first transceiver from the first device.

12. The system of claim 11, wherein the update CRL request is signed by more than one remote operator and the processor of the first device is further configured to verify that each remote operator signing the update CRL request has a valid operator'"'"'s digital signature.

13. The system of claim 10, wherein the new digital certificate request is signed by more than one remote operator and the processor of the first device is further configured to verify that each remote operator signing the new digital certificate request has a valid operator'"'"'s digital signature.

14. The system of claim 10, wherein the verifying that the new digital certificate request is valid comprises verifying that a remote operator signing the new digital certificate request has a valid operator'"'"'s digital signature.

15. A computer-implemented method, comprising:

storing, in a first non-volatile storage of a first device, a root private key of a certificate authority for signing digital certificates;

receiving manual input from an operator for information about a new digital certificate;

retrieving the root private key from the first non-volatile storage;

generating the new digital certificate according to the received information;

signing the new digital certificate using the root private key; and

transmitting the new digital certificate from the first device to a client device of an external network via a second device connected to the first device by a one-way connection, wherein the first device is inaccessible to the client device of the external network.

16. A computer-implemented method, comprising:

storing, in a first non-volatile storage of a first device, a root private key of a certificate authority for signing digital certificates;

receiving a new digital certificate request;

verifying the new digital certificate request is valid;

retrieving the root private key from the first non-volatile storage;

generating the new digital certificate according to the new digital certificate request;

signing the new digital certificate using the root private key; and

transmitting the new digital certificate from the first device to a client device of an external network via a second device by a non-routable, point-to-point connection, wherein the first device is inaccessible to the client device of the external network.