SECURE KEY MANAGEMENT

• US 20130039494A1
• Filed: 10/15/2012
• Published: 02/14/2013
• Est. Priority Date: 05/04/2011
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Frehr, Carsten D., Kelly, Michael J., Dames, Elizabeth A., Arnold, Todd W., Kisley, Richard V., Smith, Eric B., Kerr, Kenneth B., Rossman, Eric D.
• Granted Patent: US 9,306,745 B2
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

According to one embodiment, a method for implementing secure key management is provided. The method includes populating a section of information associated with a key, the section being populated with information relating to how the key was created. The method also includes populating the section with information relating to how the key was acquired by a secure module; and binding the section to the key, wherein the key is encrypted.

Claims

1. A method for secure key management, comprising:

populating a section of information associated with a key, the section of information being populated with information relating to how the key was created;

populating the section of information with information relating to how the key was acquired by a secure module; and

binding the section of information to the key, wherein the key is encrypted.

2. The method of claim 1, wherein populating the section of information associated with the key comprises populating a key control information section of a key token, the key token including the key.

3. The method of claim 2, wherein the key control information section comprises a key management field.

4. The method of claim 2, wherein the key control information section and the key are located in the key token outside the secure module and the key control information section is not encrypted when outside the secure module.

5. The method of claim 1, comprising enabling an action for the key based on at least one of the information relating to the how the key was created and information relating to how the key was acquired.

6. The method of claim 1, wherein the section of information comprises extensible fields.

7. The method of claim 1, wherein populating the section of information occurs within the secure module.

8. The method of claim 1, wherein populating the section of information with information relating to how the key was acquired by the secure module occurs as the key is received by the secure module.

9. The method of claim 1, wherein populating the section of information with information relating to how the key was created comprises one of importing the information related to how the key was created as the key is imported into the secure module or populating the information related to how the key was created as the key is created in the secure module.