SYSTEM AND METHOD FOR AUTOMATED VALIDATION AND EXECUTION OF CRYPTOGRAPHIC KEY AND CERTIFICATE DEPLOYMENT AND DISTRIBUTION

• US 20090316907A1
• Filed: 06/19/2008
• Published: 12/24/2009
• Est. Priority Date: 06/19/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Haas, Robert, Iliadis, Ilias, Hu, Xiaoyu, Peck, John T., Hahn, Timothy J., Cachin, Christian, Pawlitzek, Rene
• Granted Patent: US 8,422,686 B2
• Time in Patent Office: Days
• US Class Current: 380/278
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

A method for automated validation and execution of cryptographic key and certificate deployment and distribution includes providing one or more keys; providing one or more key deployment points; and distributing the one or more keys to the one or more key deployment points in an automated manner based on a matrix or pattern mapping of each of the one or more keys to be distributed to each of the one or more key deployment points.

Claims

1. A method for implementing for automated validation and execution of cryptographic key and certificate deployment and distribution, the method comprising:

providing one or more keys or automatically generating one or more keys on demand during deployment;

providing one or more key deployment points; and

distributing the one or more keys to the one or more key deployment points in an automated manner based on a pattern-based mapping of each of the one or more keys to be distributed to each of the one or more key deployment points.

2. The method of claim 1, wherein a certificate is attached to certain ones of the one or more keys.

3. The method of claim 1, wherein mapping of each of the one or more keys to be distributed to each of the one or more key deployment points comprises creating a matrix that indicates to which of the one or more key deployment points each of the one or more keys are to be mapped to.

4. The method of claim 1, wherein distributing the one or more keys to the one or more key deployment points in an automated manner is performed using one or more deployment patterns, wherein each deployment contains three parts:

deployment source, deployment destination and the deployment pattern that represents a deployment requirement of the distribution of the one or more keys to the one or more key deployment points.

5. The method of claim 4, wherein the deployment patterns are from the group comprising secret shared, secret unique, private and public key shared, private and public key unique, private shared, public shared, private unique public shared.

6. The method of claim 4, wherein new deployment patterns can be added to existing ones of the deployment patterns or can be created with a composition of existing ones of the deployment patterns.

7. The method of claim 1, further comprising validating the distributing of the one or more keys to the one or more key deployment points against one or more rules.

8. The method of claim 1, further comprising validating the distributing of the one or more keys using the deployment matrix as a checking function to verify that what is found in a key deployment point is what is expected or supposed to be in the key deployment point.

9. The method of claim 1, further comprising modifying the distributing of the one or more keys to the one or more key deployment points by modifying at least one of the one or more keys, by modifying at least one of the one or more key deployment points, and/or by modifying the mapping of each of the one or more keys to be distributed to each of the one or more key deployment points.

10. The method of claim 1, further comprising using an algorithm of a delta calculation of a deployment matrix to determine the changes a key lifecycle manager must make to bring the key deployment points to be set up with the appropriate keys and/or certificates after a change of policy or after a change by an administrator.

11. A computer program product, comprising:

a computer readable computer program code for implementing for automated validation and execution of cryptographic key and certificate deployment and distribution; and

instructions for causing a computer to implement a method, the method further including;

providing one or more keys;

providing one or more key deployment points; and

distributing the one or more keys to the one or more key deployment points in an automated manner based on a mapping of each of the one or more keys to be distributed to each of the one or more key deployment points.

12. The computer program product of claim 11, wherein a certificate is attached to certain ones of the one or more keys.

13. The computer program product of claim 11, wherein mapping of each of the one or more keys to be distributed to each of the one or more key deployment points comprises creating a matrix that indicates to which of the one or more key deployment points each of the one or more keys are to be mapped to.

14. The computer program product of claim 11, wherein distributing the one or more keys to the one or more key deployment points in an automated manner is performed using one or more deployment patterns, wherein each deployment pattern represents a deployment pattern of the distribution of the one or more keys to the one or more key deployment points.

15. The computer program product of claim 14, wherein the deployment patterns are from the group comprising secret shared, secret unique, private and public key shared, private and public key unique, private shared, public shared, private unique public shared.

16. The computer program product of claim 14, wherein new deployment patterns are created by composing existing ones of the deployment patterns.

17. The computer program product of claim 11, further comprising validating the distributing of the one or more keys to the one or more key deployment points against one or more rules.

18. The computer program product of claim 11, further comprising modifying the distributing of the one or more keys to the one or more key deployment points by modifying at least one of the one or more keys, by modifying at least one of the one or more key deployment points, and/or by modifying the mapping of each of the one or more keys to be distributed to each of the one or more key deployment points.

19. A system for implementing for automated validation and execution of cryptographic key and certificate deployment and distribution, comprising:

a computing network including a processing device in communication with one or more computer memory storage devices; and

the computing network further configured to implement a method for automated validation and execution of cryptographic key and certificate deployment and distribution, the method further including;

providing one or more keys;

providing one or more key deployment points; and

distributing the one or more keys to the one or more key deployment points in an automated manner based on a mapping of each of the one or more keys to be distributed to each of the one or more key deployment points.

20. The system of claim 19, wherein a certificate is attached to certain ones of the one or more keys.

21. The system of claim 19, wherein mapping of each of the one or more keys to be distributed to each of the one or more key deployment points comprises creating a matrix that indicates to which of the one or more key deployment points each of the one or more keys are to be mapped to.

22. The system of claim 19, wherein distributing the one or more keys to the one or more key deployment points in an automated manner is performed using one or more deployment patterns, wherein each deployment pattern represents a deployment patterns of the distribution of the one or more keys to the one or more key deployment points.

23. The system of claim 22, wherein the patterns are from the group comprising secret shared, secret unique, private and public key shared, private and public key unique, private shared, public shared, private unique public shared.

24. The system of claim 19, further comprising validating the distributing of the one or more keys to the one or more key deployment points against one or more rules.

25. The system of claim 19, further comprising modifying the distributing of the one or more keys to the one or more key deployment points by modifying at least one of the one or more keys, by modifying at least one of the one or more key deployment points, and/or by modifying the mapping of each of the one or more keys to be distributed to each of the one or more key deployment points.