Methods and systems for key escrow

• US 20080022088A1
• Filed: 06/06/2006
• Published: 01/24/2008
• Est. Priority Date: 06/06/2006
• Status: Abandoned Application

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Fu, Christina, Kwan, Nang Kon, Parkinson, Steven William
• Application Number:
  US11/446,956
• Publication Number:
  US 20080022088A1
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

An embodiment pertains generally to a method of storing keys. The method includes receiving a request for generating a subject private key at a token processing system and generating a subject key pair, where the subject key pair includes a subject public and the subject private key. The method also includes archiving the subject private key within the token processing system.

Claims

1. A method of storing keys, the method comprising:

receiving a request for generating a subject private key at a token management system;

generating a subject key pair, wherein the subject key pair includes a subject public and the subject private key; and

archiving the subject private key within the token management system.

2. The-method of claim 1, further comprising:

retrieving a storage key configured to be a private key type; and

generating a storage session key.

3. The method of claim 1, further comprising:

encrypting the subject private key with the storage session key to arrive at wrapped subject private key; and

encrypting the storage session key with the storage key to arrive at a wrapped storage session key.

4. The method of claim 1, further comprising:

deriving a key encryption key based on a server master key and a token identification;

generating a key transport session key; and

encrypting the key transport session key with the key encryption key to arrive at a first wrapped key transport session key.

5. The method of claim 4, further comprising retrieving a server transport key.

6. The method of claim 5, further comprising wrapping the key transport session key with the server transport key to arrive at a second wrapped key transport session key.

7. The method of claim 5, further comprising of forwarding the first wrapped key transport session key and the second wrapped key transport session key to a token processing unit.

8. The method of claim 7, further comprising:

decrypting the second wrapped key transport session key with a complementary key of the server transport key to obtain the key transport session key; and

encrypting the subject private key with the key transport session key to arrive at the wrapped private key.

9. The method of claim 8, further comprising forwarding the wrapped subject private key and the subject public key to a token.

10. The method of claim 5, further comprising:

forwarding a certificate enrollment request and information related to the subject public key to a certificate authority.

11. An apparatus comprising of means for performing the method of claim 1.

12. A computer-readable medium comprising computer-executable instructions for performing the method of claim 1.

13. A system for storing keys, the system comprising:

a token;

a security client configured to manage the token; and

a security server configured to interface with the security client, wherein the security server is configured to receive a request for generating a subject private key within the security server, generate a subject key pair, wherein the subject key pair includes a subject public and a subject private key, and to archive the subject private key in the security server.

14. The system of claim 13, wherein the security client further comprises:

a token processing gateway configured to manage the interface between the security client and the security server;

a key service module configured to interface with the token processing gateway;

a certificate authority module configured to interface with the token processing gateway and to generate certificates; and

a data recovery manager (DRM) module configured to interface with the token processing gateway and configured to maintain a database of private keys, wherein the DRM module is configured to store the subject'"'"'s private key.

15. The system of claim 14, wherein the key service module is further configured to generate the key transport session key and derive a key encryption key and wrap the key transport session key with the key encryption key to arrive at a first wrapped key transport session key.

16. The system of claim 15, wherein the key service module is further configured to retrieve a server transport key and wrap the key transport session key with the server transport key to arrive at a second wrapped key transport session key.

17. The system of claim 16, wherein the key service module is further configured to forward the KEK-wrapped key transport session key and the STK-wrapped key transport session key to the token processing gateway.

18. The system of claim 17, wherein the token processing gateway is further configured to forward the wrapped key transport session key and the key generation request to the DRM module.

19. The system of claim 18, wherein the DRM module is further configured to generate the subject key pair in response to receiving the key generation request.

20. The system of claim 19, wherein the DRM module is further configured to retrieve a storage key configured to be a private key type and generate a storage session key.

21. The system of claim 20, wherein the DRM module is further configured to encrypt the subject private key with the storage session key to arrive a wrapped subject private key and encrypt the storage session key with the storage key to arrive at a wrapped storage session key.

22. The system of claim 19, wherein the DRM module is further configured to. decrypt the second wrapped key transport session key with a complementary key of the server transport key and wrap the subject private key with key transport session key to arrive at the wrapped subject private key.

23. The system of claim 22, wherein the DRM module is further configured to forward the wrapped subject private key to the token processing gateway.

24. The system of claim 23, wherein the DRM module is further configured to forward the wrapped subject private key and the wrapped key transport session key to the token.

25. The system of claim 23, wherein the token processing gateway is further configured to transmit a certificate enrollment request and information related to the subject public key to the certificate authority module.

26. The system of claim 25, wherein the token processing gateway is further configured to forward generated certificates from the certificate authority module to the token at the security client.