Method and apparatus for managing a key management system

• US 20030163433A1
• Filed: 02/25/2002
• Published: 08/28/2003
• Est. Priority Date: 02/25/2002
• Status: Active Grant

• Current Assignee: DEXA Systems Incorporated
• Original Assignee: Schlumberger Technology Corporation (Schlumberger NV)
• Inventors: Syed, Jameel ur Rahman, Lam, Chui-Shan Teresa
• Granted Patent: US 7,251,635 B2
• Time in Patent Office: Days
• US Class Current: 705/71
• CPC Class Codes: G06Q 10/103 Workflow collaboration or project management
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

A network system for key management, including a server, a key management system providing process logic for key management system management located on the server, a key management system storage providing a secure data storage for the key management system, an application using the key management system to manage an application key, and an interface providing a means for managing the key management system.

Claims

1. A network system for key management, comprising:

a server;

a key management system providing process logic for key management system management located on the server;

a key management system storage providing a secure data storage for the key management system;

an application using the key management system to manage an application key;

and

an interface providing a means for managing the key management system.

2. The network system of claim 1, further comprising:

a client computer operatively connected to the server, wherein the client computer comprises a user interface to manage the key management system.

3. The network system of claim 1, wherein the key management storage is located on the server.

4. The network system of claim 1, wherein the key management storage is located on a second server operatively connected to the server.

5. The network system of claim 1, wherein the interface comprises a graphical user interface.

6. The network system of claim 5, wherein the graphical user interface is integrated into a web browser.

7. The network system of claim 2, wherein the user interface comprises a graphical user interface.

8. The network system of claim 7, wherein the graphical user interface is integrated into a web browser.

9. The network system of claim 2, wherein the client computer and the server are connected using an encrypted connection.

10. The network system of claim 1, wherein the key management system further comprises:

a memory storing data within the key management system;

a hashing module hashing a key encryption key;

an encryption module decrypting data; and

a serialization module de-serializing data obtained from the memory, the encryption module, and the serialization module.

11. The network system of claim 1, wherein the key management system further comprises:

a memory storing data within the key management system;

a hashing module hashing a key encryption key;

an encryption module decrypting data and encrypting data; and

a serialization module de-serializing and serializing data obtained from the memory, the encryption module, and the serialization module.

12. The key management system of claim 10, further comprising:

an encoding module for encoding data.

13. The key management system of claim 10, wherein the hashing module uses an MD5 hashing function.

14. The key management system of claim 10, wherein the encryption module further comprises a key generation tool.

15. The key management system of claim 14, wherein the key generation tool comprises a symmetric algorithm.

16. The key management system of claim 14, wherein the key generation tool comprises an asymmetric algorithm.

17. The key management system of claim 11, further comprising:

an encoding module for encoding data.

18. The key management system of claim 11, wherein the hashing module uses an MD5 hashing function.

19. The key management system of claim 11, wherein the encryption module further comprises a key generation tool.

20. The key management system of claim 19, wherein the key generation tool comprises a symmetric algorithm.

21. The key management system of claim 19, wherein the key generation tool comprises an asymmetric algorithm.

22. The key management system of claim 1, wherein the interface comprises a means for changing a key encryption key.

23. The key management system of claim 1, wherein the interface comprises means for starting the key management system.

24. The key management system of claim 1, wherein the interface comprises means for initializing the key management system.

25. The key management system of claim 1, wherein the interface comprises means for diagnosing problems with the key management system.

26. A network system for key management, comprising:

a server;

a key management system providing process logic for key management system initialization located on the server;

a key management system storage providing a secure data storage for the key management system;

an application using the key management system to manage an application key;

an interface providing a means for inputting data into the key management system; and

a client computer operatively connected to the server, wherein the client computer comprises a user interface to manage the key management system.

27. A method for retrieving a value secured in a key management system comprising:

receiving a request for the value secured in the key management system;

searching for a key corresponding to the value in a decoded key list; and

retrieving a tuple corresponding to the value, if the key corresponding to the value is in the decoded key list.

28. The method of claim 27, wherein the key management storage is located on a second server.

29. The method of claim 27, wherein the key management system interface comprises a graphical user interface.

30. A method for retrieving a value secured in a key management system comprising:

receiving a request for the value secured in the key management system;

retrieving a serialized file from a key management system storage;

de-serializing the serialized file producing a de-serialized file;

decoding an encoded key list in the de-serialized file to produce a decoded key list;

searching for a key corresponding to the value in the decoded key list;

inputting a key encryption key into the key management system;

hashing the key encryption key to produce a key encryption key hash;

comparing the key encryption key hash to a hashed key encryption key in the de-serialized file;

decrypting a secret token in the de-serialized file using the key encryption key if the key encryption key hash is equal to the hashed key encryption key in the de-serialized file to produce at least one tuple;

storing the at least one tuple in a data structure within the key management system; and

retrieving the tuple corresponding to the value, if the key corresponding to the value is in the decoded key list.

31. The method of claim 30, further comprising:

searching a local file system, if the key corresponding to the value is not in the decoded key list.

32. A method for changing an existing key encryption key, comprising:

entering the existing key encryption key;

entering a new key encryption key;

de-serializing a serialized file producing a de-serialized file;

hashing the existing key encryption key producing a hashed key encryption key;

comparing the hashed key encryption key to a key encryption key hash in the de-serialized file;

decrypting a secret token using the existing key encryption key if the hashed key encryption key equals the key encryption key hash producing a tuple;

encrypting the tuple using the new key encryption key producing a new secret token;

hashing the new key encryption key producing a new hashed key encryption key; and

serializing the new hashed key encryption key and the new secret token to produce a new serialized file.

33. An apparatus for retrieving a value secured in a key management system comprising:

means for receiving a request for the value secured in the key management system;

means for searching for a key corresponding to the value in a decoded key list; and

means for retrieving a tuple corresponding to the value, if the key corresponding to the value is in the decoded key list.

34. A apparatus for retrieving a value secured in a key management system comprising:

means for receiving a request for the value secured in the key management system;

means for retrieving a serialized file from a key management system storage;

means for de-serializing the serialized file producing a de-serialized file;

means for decoding an encoded key list in the de-serialized file to produce a decoded key list;

means for searching for a key corresponding to the value in the decoded key list;

means for inputting a key encryption key into the key management system;

means for hashing the key encryption key to produce a key encryption key hash;

means for comparing the key encryption key hash to a hashed key encryption key in the de-serialized file;

means for decrypting a secret token in the de-serialized file using the key encryption key if the key encryption key hash is equal to the hashed key encryption key in the de-serialized file to produce at least one tuple;

means for storing the at least one tuple in a data structure within the key management system; and

means for retrieving the tuple corresponding to the value, if the key corresponding to the value is in the decoded key list.

35. An apparatus for changing an existing key encryption key, comprising:

means for entering the existing key encryption key;

means for entering a new key encryption key;

means for de-serializing a serialized file producing a de-serialized file;

means for hashing the existing key encryption key producing a hashed key encryption key;

means for comparing the hashed key encryption key to a key encryption key hash in the de-serialized file;

means for decrypting a secret token using the existing key encryption key if the hashed key encryption key equals the key encryption key hash producing a tuple;

means for encrypting the tuple using the new key encryption key producing a new secret token;

means for hashing the new key encryption key producing a new hashed key encryption key; and

means for serializing the new hashed key encryption key and the new secret token to produce a new serialized file.