Object Signing Within a Cloud-based Architecture

• US 20140052994A1
• Filed: 08/12/2013
• Published: 02/20/2014
• Est. Priority Date: 08/16/2012
• Status: Active Grant

• Current Assignee: DigiCert Incorporated
• Original Assignee: DigiCert Incorporated
• Inventors: Sabin, Jason Allen
• Granted Patent: US 9,900,157 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

This invention uses a cloud-based architecture to sign objects by dynamically creating a cloud-based virtual machine with the ability to sign objects, perform network and object isolation, and encrypt and store keys generated by an object signing agent. Multi-user authentication is supported along with mobile access.

Claims

1. A system for cloud-based object signing comprising:

a. An object,

b. An object signing agent that can communicate with a cloud-based signing system,

c. A cloud-based system that can sign objects, and

d. A virtual machine created dynamically in response to a request for object signing.

2. A system according to claim 1 further comprising a signing key that is created after receiving a request for signing.

3. A system according to claim 1 further comprising a tenancy specific to the entity requesting the object signing where the virtual machine is created.

4. A system according to claim 1 further comprising a compliance engine.

5. A system according to claim 1 further compromising an identity service component.

6. A system according to claim 1 further comprising an object signing manager component.

7. A method for cloud-based signing comprising:

a. Receiving communication from an object signing agent,

b. Receiving an object that is designated for signature,

c. Creating a virtual space on a cloud server in response to a request for signing the object, and

d. Signing the object in the virtual space.

8. A method according to claim 7, further comprising authenticating the request for signing the object using.

9. A method according to claim 7, further comprising authenticating a plurality of approvals over the signing the object.

10. A method according to claim 8, where the authenticating a plurality of approvals occurs after signing the object.

11. A method according to claim 7, further comprising determining whether the object qualifies for signing using a compliance engine.

12. A method according to claim 11, where the determination of whether the object qualifies for signing is based on the information in a policy engine.

13. A method according to claim 7, further comprising generating a signing key in response to the request for signing the object

14. A method according to claim 13, where the signing key is stored in a tenancy specific to the entity requesting the object signing.

15. A method according to claim 7 where the virtual space is encrypted.

16. A method according to claim 15 where the signing key is created in the virtual space.

17. A method according to claim 7 where the virtual space is isolated within a dedicated space.

18. A method according to claim 7, further comprising removing the virtual space after the signing the object.

19. A method according to claim 18, where a key used to sign the object is destroyed as part of removing the virtual space.

20. A method according to claim 18 where a key used to sign the object is transferred to a separate location before removing the virtual space.