Scalable and Secure Key Management For Cryptographic Data Processing

• US 20100254537A1
• Filed: 04/06/2009
• Published: 10/07/2010
• Est. Priority Date: 04/06/2009
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: BUER, Mark, QI, Zheng
• Granted Patent: US 8,411,867 B2
• Time in Patent Office: Days
• US Class Current: 380/279
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

A method and system for secure and scalable key management for cryptographic processing of data is described herein. In the method, a General Purpose Cryptographic Engine (GPE) receives key material via a secure channel from a key server and stores the received Key encryption keys (KEKs) and/or plain text keys in a secure key cache. When a request is received from a host to cryptographically process a block of data, the requesting entity is authenticated using an authentication tag included in the request. The GPE retrieves a plaintext key or generate a plaintext using a KEK if the authentication is successful, cryptographically processes the data using the plaintext key and transmits the processed data. The system includes a key server that securely provides encrypted keys and/or key handles to a host and key encryption keys and/or plaintext keys to the GPE.

Claims

1. A method of secure key handling and cryptographic processing of data, comprising:

receiving a request in a cryptography engine from an entity to cryptographically process a block of data, the request including a key handle, wherein the key handle includes an authentication tag and an index;

authenticating the requesting entity using the authentication tag;

referencing a plaintext key from a plurality of plaintext keys using the index if the requesting entity is authenticated successfully;

cryptographically processing the block of data using the plaintext key; and

transmitting the processed data.

2. The method of claim 1, wherein authenticating further comprises using a shared secret to authenticate the requesting entity.

3. The method of claim 1, wherein authenticating further comprises using a one time password to authenticate the requesting entity.

4. The method of claim 1, further comprising, prior to receiving a request to cryptographically process data, receiving the plurality of plaintext keys via a secure communications channel from a key server.

5. The method of claim 4, further comprising storing the received plaintext keys in a secure key cache.

6. A method of secure and scalable key management and cryptographic processing of data, comprising:

receiving a request in a cryptography engine from an entity to cryptographically process a block of data, the request including an encrypted key and an associated key handle, wherein the key handle includes an authentication tag and an index;

authenticating the requesting entity using the authentication tag;

referencing a first key encryption key from a plurality of stored key encryption keys using index if the requesting entity is authenticated successfully;

decrypting the encrypted key using the first key encryption key to generate a plaintext key;

cryptographically processing the block of data using the plaintext key; and

transmitting the encrypted or decrypted data to the requesting entity.

7. The method of claim 6, wherein authenticating further comprises using a shared secret to authenticate the requesting entity.

8. The method of claim 6, wherein authenticating further comprises using a one time password to authenticate the requesting entity.

9. The method of claim 6, further comprising, prior to receiving a request to cryptographically process data, receiving a plurality of key encryption keys (KEKs) via a secure channel from a key server and storing the key encryption keys in a secure key cache.

10. The method of claim 9, further comprising receiving the plurality of key encryption keys using a key management protocol.

11. A general purpose cryptographic engine (GPE) for secure key management and cryptographic processing of data, comprising:

a secure memory configured to store a plurality of plaintext keys;

a security processing unit coupled to the processor and configured to receive a request from a requesting entity to cryptographically process a block of data, the request including a key handle, wherein the key handle includes an authentication tag and an index that enables retrieval of a plaintext key from the secure memory; and

a key manager coupled to the security processing unit and configured to authenticate the requesting entity based on the authentication tag and to retrieve a plaintext key based on the index if the host is authenticated successfully;

wherein the security processing unit is further configured to cryptographically process the block of data using the retrieved plaintext key and to transmit the processed data.

12. The system of claim 11, wherein the GPE and the requesting entity are on the same device.

13. The system of claim 11, wherein the key manager is configured to authenticate the requesting entity using a shared secret.

14. The system of claim 11, wherein the key manager is configured to authenticate the requesting entity using a one time password.

15. A general purpose cryptographic engine (GPE) for secure and scalable key management and cryptographic processing of data, comprising:

a secure memory configured to store a plurality of key encryption keys (KEKs);

a security processing unit coupled to the processor and configured to receive a request from a requesting entity coupled to the GPE to cryptographically process a block of data, wherein the request includes an encrypted key and a key handle, wherein the key handle includes an authentication tag and an index to enable retrieval of a key encryption key in the secure memory, the key encryption key configured to enable decryption of the encrypted key; and

a key manager coupled to the security processing unit and configured to authenticate the requesting entity based on the authentication tag, to retrieve the first key encryption key based on the index if host authentication is successful and decrypt the encrypted key using the first key encryption key to generate a plaintext key;

wherein the security processing unit is configured to cryptographically process the block of data using the plaintext key to generate processed data and to transmit the processed data.

16. The system of claim 15, wherein the requesting entity and the GPE are on the same device.

17. The system of claim 15, wherein the key manager is configured to authenticate the requesting entity using a shared secret.

18. The system of claim 15, wherein the key manager is configured to authenticate the requesting entity using a one time password.