KEY USAGE POLICIES FOR CRYPTOGRAPHIC KEYS

• US 20120281839A1
• Filed: 05/04/2011
• Published: 11/08/2012
• Est. Priority Date: 05/04/2011
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Arnold, Todd W., Dames, Elizabeth A., Frehr, Carsten D., Kelly, Michael J., Kerr, Kenneth B., Kisley, Richard V., Rossman, Eric D., Smith, Eric B.
• Granted Patent: US 8,789,210 B2
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

A computer program product for secure key management is provided. The computer program product includes a tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for creating a token and populating the token with key material, and binding key control information to the key material. The key control information includes information relating to usage of the key material populating one or more key usage fields that define attributes that limit actions that may be performed with the key material.

Claims

1. A computer program product for secure key management, the computer program product comprising:

a tangible storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for;

creating a token and populating the token with key material; and

binding key control information to the key material, the key control information including;

information relating to usage of the key material populating one or more key usage fields that define attributes that limit actions that may be performed with the key material.

2. The method according to claim 1, wherein the key control information further comprises a key usage field count indicating a number of the key usage fields.

3. The method according to claim 2, wherein the number of the key usage fields is 1 to n.

4. The method according to claim 2, wherein each of the key usage fields comprises an independent set of indicators.

5. The method according to claim 4, wherein each indicator is used to indicate an action that may be performed with the key material.

6. The method according to claim 4, wherein each indicator is independent of the others.

7. The method according to claim 4, wherein a fixed set of indicators have indicators that are in use and indicators that are reserved, the reserved indicators being set to ‘

Not allowed’

.

8-14. -14. (canceled)

15. A system for secure key management, comprising:

a computer processor; and

an application configured to execute on the computer processor, the application implementing;

creation of a token and population of the token with key material; and

a binding of key control information to the key material, the key control information including;

information relating to usage of the key material populating one or more key usage fields that that define attributes that limit actions that may be performed with the key material.

16. The method according to claim 15, wherein the number of the key usage fields is 1 to n.

17. The method according to claim 15, wherein the key control information further comprises a key usage field count indicating a number of the key usage fields.

18. The method according to claim 15, wherein each of the key usage fields comprises an independent set of indicators.

19. The method according to claim 18, wherein each indicator is used to indicate an action that may be performed with the key material.

20. The method according to claim 18, wherein each indicator is independent of the others.

21. The method according to claim 18, wherein a fixed set of indicators have indicators that are in use and indicators that are reserved, the reserved indicators being set to ‘

Not allowed’

.