Architecture for asymmetric crypto-key storage

• US 20060182283A1
• Filed: 02/14/2005
• Published: 08/17/2006
• Est. Priority Date: 02/14/2005
• Status: Abandoned Application

• Current Assignee: VMware, Inc. (Broadcom, Inc.)
• Original Assignee: TriCipher, Inc. (Broadcom, Inc.)
• Inventors: Ganesan, Ravi, Schoppert, Brett Jason, Sandhu, Ravinderpal Singh, deSa, Colin Joseph, Bellare, Mihir
• Application Number:
  US11/055,987
• Publication Number:
  US 20060182283A1
• Time in Patent Office: Days
• US Class Current: 380/286
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Techniques for securing an asymmetric crypto-key having a public key and a split private key with multiple private portions are provided. A first one of multiple factors is stored. All of the factors are under the control of a user and all are required to generate a first private portion of the split private key. The first private portion not stored in a persistent state. A second private portion of the split private key under control of an entity other than the user is also stored. The first private portion and the second private portion are combinable to form a complete private portion.

Claims

1. A method for securing an asymmetric crypto-key having a public key and a split private key with multiple private portions, comprising:

storing a first one of multiple factors, all of which are under the control of a user, required to generate a first private portion of the split private key, the first private portion not stored in a persistent state; and

storing a second private portion of the split private key under control of an entity other than the user;

wherein the first private portion and the second private portion are combinable to form a complete private portion.

2. The method of claim 1, wherein the first factor is stored at a first location, and further comprising:

storing, at a second location different than the first location, a second one of the multiple factors.

3. The method of claim 1, wherein:

the first factor is stored on one of i) a computing device associated with the user, and ii) removable media configured to communicate with the user computing device.

4. The method of claim 1, wherein a second one of the multiple factors is not stored in a persistent state.

5. The method of claim 4, wherein the second factor is generated based upon a user password.

6. The method of claim 1, wherein generation of the first private portion based upon the multiple factors includes cryptographically combining the multiple factors.

7. The method of claim 1, wherein:

the asymmetric crypto-key is a first asymmetric crypto-key; and

the first factor is a private key of a second asymmetric crypto-key different than the first asymmetric crypto-key.

9. The method of claim 1, further comprising:

storing the public key under control of an entity other than the user.

10. The method of claim 1, wherein:

the multiple factors are a first set of multiple factors; and

a third private portion of the split private key is based upon a second set of multiple factors.

8. The method of 1, further comprising:

generating the first private portion based upon the multiple factors, including the stored first factor;

non-persistently storing the generated first private portion for a limited time period; and

during the limited time period applying the stored first private portion to authenticate the user multiple times.

11. A system for securing an asymmetric crypto-key having a public key and a split private key with multiple private portions, comprising:

a first data repository configured to store one of multiple factors, all of which are under control of a user, required to generate a first private portion of the split private key, the first private portion not stored in a persistent state and

a second data repository configured to store a second private portion of the split private key, the second portion under control of an entity other than the user;

wherein the first private portion and the second private portion are combinable to form a complete private portion.

12. The system of claim 11, further comprising:

a third data repository configured to store a second one of the multiple factors, the third data repository different than the first data repository.

13. The system of claim 11, wherein:

the first data repository is one of i) a drive associated with a user computing device, and ii) removable media configured to communicate with the user'"'"'s computing device.

14. The system of claim 11, wherein a second one of the multiple factors is not stored in a persistent state.

15. The system of claim 14, further comprising:

a processor, in communication with the first data repository, configured to generate the second factor based upon a user password.

16. The system of claim 11, further comprising:

a processor, in communication with the first data repository, configured cryptographically combine the multiple factors to generate the first private portion.

17. The system of claim 11, wherein:

the asymmetric crypto-key is a first asymmetric crypto-key; and

the first factor is a private key of a second asymmetric crypto-key different than the first asymmetric crypto-key.

18. The system of claim 11, wherein:

a generated first private portion is non-persistently stored for a limited time period after generation; and

during the limited time the stored first private portion is applied to authenticate the user multiple times.

19. The system of claim 11, further comprising:

a third data repository under control of an entity other than the user and configured to store the public key.

20. The system of claim 11, wherein:

the multiple factors are a first set of multiple factors; and

a third private portion of the split private key is based upon a second set of multiple factors.