Cloud Key Management System

• US 20140050317A1
• Filed: 01/03/2013
• Published: 02/20/2014
• Est. Priority Date: 08/16/2012
• Status: Active Grant

• Current Assignee: CAMX Outdoors Incorporated, DigiCert Incorporated
• Original Assignee: DigiCert Incorporated
• Inventors: Sabin, Jason Allen
• Granted Patent: US 9,350,536 B2
• Time in Patent Office: Days
• US Class Current: 380/44
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

This invention uses a cloud-based key management system to store, retrieve, generate, and perform other key operations. The cloud-based system ensures security of the keys while preventing their loss or destruction. Using this invention, a company can now manage, audit, and maintain control and security around their keys. Security event auditing permits evaluation of the operations to ensure that each step is completely securely.

Claims

1. A method for key management comprising:

Receiving a request for key services,

Identifying a tenant location on a cloud-based system,

Performing a key service on a cloud-based system.

2. A method according to claim 1 where the request is received through a key agent.

3. A method according to claim 1 further comprising evaluating the request'"'"'s authorization for the key service.

4. A method according to claim 1 further comprising an identity service that verifies identity of the requester.

5. A method according to claim 1 where the key service is performed by a server manager receiving instructions through the multi-tenancy manager.

6. A method according to claim 1 where the key service requires access to a segmented location on a cloud-based system.

7. A method according to claim 6 where the segmented location is associated with a requester.

8. A method according to claim 1 where information about the key service is provided to the key agent.

9. A method according to claim 8 where the information comprises a digital certificate.

10. A method according to claim 8 where the information comprises a key.

11. A method according to claim 8 where the information comprises security events about the key service.

12. A method according to claim 1 where the key services are performed in accordance with a key policy.

13. A method according to claim 1 where the key service comprises creating a key.

14. A method according to claim 13 where the key is created by a key provisioner.

15. A method according to claim 13 where the key is encrypted and stored on a segmented location of a cloud-based system.

16. A method according to claim 1 further comprising creating at least one security event related to the key-related service.

17. A method according to claim 16 further comprising transmitting at least one security event to a security events database.

18. A method according to claim 1 where the performance of the key services are evaluated by a key validator.

19. A method for generating keys comprising:

Receiving communication from a key agent through a secure tunnel,

Generating a key on a cloud-based system, and

Storing the key in an encrypted format on a cloud-based system.

20. A method according to claim 19 further comprising validating the identity of a requester.

21. A method according to claim 19 where the key is generated on a tenant location.

22. A method according to claim 21 where the tenant location is selected by a multi-tenant manager.

23. A method according to claim 19 where the key is encrypted using a key provided by the key agent.

24. A process for key management comprising:

A requester,

A request for a key service, and

A cloud-based key service comprising a multi-tenancy manager and a server manager.

25. A process according to claim 24, further comprising a key agent that transfers the request for a key service to the cloud-based service.

26. A process according to claim 24, further comprising an encrypted key store.

27. A process according to claim 24, further comprising a key validator.

28. A process according to claim 24, further comprising a security event collector.

29. A process according to claim 24, further comprising an identity service.

30. A process according to claim 24, further comprising a key validator.

31. An apparatus for providing cloud-based key services comprising:

A processor and

Memory storing computer executable instructions that, when executed by the processor, cause the apparatus to at least;

Accept requests for a key service remotely from a requester,

Validate a request for a key service,

Perform a key service request, and

Verify that the key service is performed correctly.

32. An apparatus according to claim 31 where the memory further causes the apparatus to create security events that are stored in a database.

33. An apparatus according to claim 31 where the memory further causes the apparatus to store a key in an encrypted store.

34. An apparatus according to claim 31 where the key service comprises generating keys.