System and Method for Enterprise Security Including Symmetric Key Protection

• US 20080008316A1
• Filed: 07/05/2006
• Published: 01/10/2008
• Est. Priority Date: 07/05/2006
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Pilipchuk, Denis
• Granted Patent: US 8,175,269 B2
• Time in Patent Office: Days
• US Class Current: 380/45
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A system and method for enterprise security including symmetric key protection. In accordance with an embodiment, the system provides a higher level of protection against unauthorized key disclosure by encrypting randomly generated seed data used for key generation, and using digital signatures and asymmetric encryption.

Claims

1. A computer executable method for deploying a symmetric key in a software application comprising the steps of:

installing a software application in a computer system;

generating an application-base-secret wherein the application-base-secret is accessible by all installations of the software application;

generating an application-keypair wherein the application-keypair is accessible by all installations of the software application;

generating an instance-base-secret wherein the instance-base-secret is accessible by only one installation of the software application;

encrypting the instance-base-secret using the private key from the application-keypair;

generating an instance-keypair wherein the instance-keypair is accessible by only one installation of the software application;

creating a digital certificate using the public key from the instance-keypair;

creating a digital signature of the encrypted instance-base-secret with the private key of the instance-keypair; and

removing the private key of the instance-keypair from the installation of the software application so that the encrypted instance-base-secret and the digital signatures of the instance-base-secret is read-only.

2. The method of claim 1 wherein the symmetric key is derived by combining the application-base-secret and the instance-base-secret.

3. The method of claim 1 wherein the application-base-secret is embedded in the software application'"'"'s source code.

4. The method of claim 1 wherein the application-keypair is embedded in the software application'"'"'s source code.

5. The method of claim 1 wherein the digital certificate is periodically verified by checking it against a certificate authority.