Method and apparatus for lightweight rekeying of a master key in a single sign-on system

• US 20020122553A1
• Filed: 03/01/2001
• Published: 09/05/2002
• Est. Priority Date: 03/01/2001
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kao, I-Lung, Wilson, George Conerly
• Application Number:
  US09/798,298
• Publication Number:
  US 20020122553A1
• Time in Patent Office: Days
• US Class Current: 380/28
• CPC Class Codes: H04L 2209/04 Masking or blinding
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

A method, system, apparatus, and computer program product are presented for significantly decreasing the computational effort for a rekeying process without sacrificing the security of a single sign-on system. For each user, a “minor” key is created when the user'"'"'s account within the single sign-on system is created; the user'"'"'s minor key is used to encrypt and decrypt the user'"'"'s target passwords. However, to protect the confidentiality of a user'"'"'s minor key, the minor key is not stored directly. Instead, a storage key is generated by masking a user'"'"'s minor key with the master key in an appropriate manner, e.g., using the user'"'"'s minor key and the master key as inputs to an exclusive-OR function to generate the storage key. A user'"'"'s storage key can then be stored without compromising the user'"'"'s minor key or the master key, and the user'"'"'s minor key can be efficiently regenerated using the storage key and the master key.

Claims

1. A method for securing data elements within a database, the method comprising the steps of:

generating a minor key;

encrypting a data element using the minor key;

storing the encrypted data element in the database;

retrieving a master key;

encoding the minor key with the master key to generate an encoded minor key; and

storing the encoded minor key.

2. The method of claim 1 wherein the encoded minor key is generated in accordance with an encoding function that accepts the minor key and the master key as inputs to the encoding function.

3. The method of claim 2 wherein the encoding function is a bitwise operation against the minor key and the master key.

4. The method of claim 3 wherein the encoding function is an exclusive-OR function.

5. The method of claim 1 wherein the master key and the minor key are DES (Data Encryption Standard) keys.

6. The method of claim 1 wherein the encoded minor key is associatively stored with the encoded data element in the database.

7. The method of claim 1 wherein the data element is a password.

8. The method of claim 1 further comprising:

retrieving the master key;

retrieving the encoded minor key;

decoding the encoded minor key with the master key to regenerate the minor key;

retrieving the encrypted data element from the database; and

decrypting the encrypted data element using the minor key to regenerate the data element.

9. The method of claim 1 further comprising:

retrieving the master key;

retrieving the encoded minor key;

decoding the encoded minor key with the master key to regenerate the minor key;

generating a second master key;

encoding the minor key using the second master key to generate a second encoded minor key; and

storing the second encoded minor key.

10. The method of claim 9 wherein the second encoded minor key is associatively stored with the encoded data element in the database.

11. A method for securely managing target passwords, wherein the target passwords provide access to target resources within a data processing system, the method comprising the steps of:

generating a minor key for a user of the data processing system, wherein the user has a plurality of target passwords;

encrypting the plurality of target passwords using the minor key;

storing the plurality of encrypted target passwords in a database;

retrieving a master key;

encoding the minor key with the master key to generate an encoded minor key; and

storing the encoded minor key.

12. The method of claim 11 further comprising:

generating a minor key for each user of the data processing system; and

encoding the minor key for each user with the master key.

13. The method of claim 11 further comprising:

retrieving a set of target passwords associated with a second user, wherein each user of the data processing system has a set of target passwords; and

encrypting the set of target passwords using the minor key of the second user.

14. The method of claim 11 further comprising:

retrieving the master key;

retrieving the encoded minor key;

decoding the encoded minor key with the master key to regenerate the minor key;

retrieving an encrypted target password from the database; and

decrypting the encrypted target password using the minor key to regenerate the target password.

15. The method of claim 11 further comprising:

retrieving the master key;

retrieving the encoded minor key;

decoding the encoded minor key with the master key to regenerate the minor key;

generating a second master key;

encoding the minor key using the second master key to generate a second encoded minor key; and

storing the second encoded minor key.

17. The computer program product of claim 16 further comprising:

instructions for generating the encoded minor key in accordance with an encoding function that accepts the minor key and the master key as inputs to the encoding function.

18. The computer program product of claim 17 wherein the encoding function is a bitwise operation against the minor key and the master key.

19. The computer program product of claim 18 wherein the encoding function is an exclusive-OR function.

20. The computer program product of claim 16 wherein the master key and the minor key are DES (Data Encryption Standard) keys.

21. The computer program product of claim 16 further comprising:

instructions for associatively storing the encoded minor key with the encoded data element in the database.

22. The computer program product of claim 16 wherein the data element is a password.

23. The computer program product of claim 16 further comprising:

instructions for retrieving the master key;

instructions for retrieving the encoded minor key;

instructions for decoding the encoded minor key with the master key to regenerate the minor key;

instructions for retrieving the encrypted data element from the database; and

instructions for decrypting the encrypted data element using the minor key to regenerate the data element.

24. The computer program product of claim 16 further comprising:

instructions for retrieving the master key;

instructions for retrieving the encoded minor key;

instructions for decoding the encoded minor key with the master key to regenerate the minor key;

instructions for generating a second master key;

instructions for encoding the minor key using the second master key to generate a second encoded minor key; and

instructions for storing the second encoded minor key.

25. The computer program product of claim 24 further comprising:

instructions for associatively storing the second encoded minor key with the encoded data element in the database.

27. The computer program product of claim 26 further comprising:

instructions for generating a minor key for each user of the data processing system; and

instructions for encoding the minor key for each user with the master key.

28. The computer program product of claim 26 further comprising:

instructions for retrieving a set of target passwords associated with a second user, wherein each user of the data processing system has a set of target passwords; and

instructions for encrypting the set of target passwords using the minor key of the second user.

29. The computer program product of claim 26 further comprising:

instructions for retrieving the master key;

instructions for retrieving the encoded minor key;

instructions for decoding the encoded minor key with the master key to regenerate the minor key;

instructions for retrieving an encrypted target password from the database; and

instructions for decrypting the encrypted target password using the minor key to regenerate the target password.

30. The computer program product of claim 26 further comprising:

instructions for retrieving the master key;

instructions for retrieving the encoded minor key;

instructions for decoding the encoded minor key with the master key to regenerate the minor key;

instructions for generating a second master key;

instructions for encoding the minor key using the second master key to generate a second encoded minor key; and

instructions for storing the second encoded minor key.

16. A computer program product in a computer-readable medium for use in a data processing system for securing data elements within a database, the computer program product comprising:

instructions for generating a minor key;

instructions for encrypting a data element using the minor key;

instructions for storing the encrypted data element in the database;

instructions for retrieving a master key;

instructions for encoding the minor key with the master key to generate an encoded minor key; and

instructions for storing the encoded minor key.

26. A computer program product in a computer-readable medium for use in a data processing system for securely managing target passwords, wherein the target passwords provide access to target resources within the data processing system, the computer program product comprising:

instructions for generating a minor key for a user of the data processing system, wherein the user has a plurality of target passwords;

instructions for encrypting the plurality of target passwords using the minor key;

instructions for storing the plurality of encrypted target passwords in a database;

instructions for retrieving a master key;

instructions for encoding the minor key with the master key to generate an encoded minor key; and

instructions for storing the encoded minor key.

31. An apparatus for securing data elements within a database, the apparatus comprising:

generating means for generating a minor key;

encrypting means for encrypting a data element using the minor key;

first storing means for storing the encrypted data element in the database;

retrieving means for retrieving a master key;

encoding means for encoding the minor key with the master key to generate an encoded minor key; and

second storing means for storing the encoded minor key.

32. An apparatus for securely managing target passwords, wherein the target passwords provide access to target resources within a data processing system, the apparatus comprising:

generating means for generating a minor key for a user of the data processing system, wherein the user has a plurality of target passwords;

encrypting means for encrypting the plurality of target passwords using the minor key;

first storing means for storing the plurality of encrypted target passwords in a database;

retrieving means for retrieving a master key;

encoding means for encoding the minor key with the master key to generate an encoded minor key; and

second storing means for storing the encoded minor key.