Methods and systems for secure key delivery

• US 20080019526A1
• Filed: 06/06/2006
• Published: 01/24/2008
• Est. Priority Date: 06/06/2006
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Fu, Christina, Kwan, Nang Kon, Parkinson, Steven William
• Granted Patent: US 8,098,829 B2
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

An embodiment pertains generally to a method of delivering keys in a server. The method includes generating a subject key pair, where the subject key pair includes a subject public key and a subject private key. The method also includes retrieving a storage key and encrypting the subject private key with the storage key as a wrapped storage private key. The method further includes storing the wrapped storage private key.

Claims

1. A method of delivering keys in-a server, the method comprising:

generating a subject key pair wherein the subject key pair includes a subject public key and a subject private key;

retrieving a storage key;

encrypting the subject private key with the storage key as a wrapped storage private key and

storing the wrapped storage private key.

2. The method of claim 1, further comprising:

generating a storage session key; and

encrypting the storage session key with the storage key as a wrapped storage key.

3. The method of claim 2, storing the wrapped storage key.

4. The method of claim 1, further comprising of determining an identification number associated with a token.

5. The method of claim 4, further comprising:

deriving a key encryption key based on a server master key and the identification number;

generating the key transport session key; and

encrypting the key transport session key with the key encryption key to arrive at a first wrapped key transport session key.

6. The method of claim 5, further comprising:

retrieving a server transport key; and

encrypting the key transport session key with the server transport key as a second wrapped key transport session key.

7. The method of claim 6, further comprising of forwarding the second wrapped key transport session key to a data recovery manager module.

8. The method of claim 7, further comprising:

decrypting the second wrapped key transport session key with a complementary private key of the server transport key to retrieve the key transport session key; and

encrypt the subject private key with key transport session key to arrive at the wrapped private key.

9. The method of claim 8, further comprising of forwarding the wrapped private key to the the token.

10. The method of claim 1, further comprising of transmitting a certificate enrollment request and information related to the subject public key to the certificate authority module.

11. The method of claim 1, further comprising of forwarding any generated certificates to a token.

12. An apparatus comprising of means for performing the method of claim 1.

13. A computer-readable medium comprising computer-executable instructions for performing the method of claim 1.

14. A system for delivering keys, the system comprising:

a token;

a security client configured to manage the token; and

a security server configured to interface with the security client, wherein the security server is configured to generate a subject key pair, wherein the subject key pair includes a subject public key and a subject private key, retrieve a storage key, encrypt the subject private key with the storage key as a wrapped storage private key, and store the wrapped storage private key.

15. The system of claim 14, wherein the security client further comprises:

a token processing gateway configured to manage the interface between the security client and the security client;

a key service module configured to interface with the token processing gateway;

a certificate authority module configured to interface with the token processing gateway and to generate certificates; and

.

a data recovery manager (DRM) module configured to interface with the token processing gateway and configured to maintain a database of private keys, wherein the DRM module is configured to store the wrapped private key.

16. The system of claim 15, wherein the key service module is further configured to generate the key transport session key and derive a key encryption key based on a master server key and identification number associated with the token.

17. The system of claim 16, wherein the key service module is configured to encrypt the key transport session key with the key encryption key to arrive at a first wrapped key transport session key.

18. The system of claim 17, wherein the key service module is further configured to retrieve a server transport key and encrypt the key transport session key with the server transport key to arrive at a second wrapped key transport session key.

19. The system of claim 18, wherein the key service module is further configured to forward the first and second wrapped key transport session keys to the token processing gateway.

20. The system of claim 19, wherein the token processing gateway is further configured to forward the second wrapped key transport session key to the DRM module.

21. The system of claim 20, wherein the DRM module is further configured to generate the subject key pair.

22. The system of claim 21, wherein the DRM module is configured to store the wrapped storage private key and wrapped storage key in a database maintained by the DRM module.

23. The system of claim 21, wherein the DRM module is further configured to decrypt the second wrapped key transport session key with a complementary private key of the server transport key to retrieve the key transport session key and encrypt the subject private key with key transport session key to arrive at the wrapped private key.

24. The system of claim 23, wherein the DRM module is further configured to forward the wrapped subject private key to the token processing gateway.

25. The system of claim 15, wherein the token processing gateway is further configured to transmit a certificate enrollment request and information related to the subject public key to the certificate authority module.

26. The system of claim 25, wherein the token processing gateway is further configured to forward any generated certificates to the token at the security client.