SYSTEM AND METHOD FOR CENTRALIZED KEY DISTRIBUTION

• US 20150074408A1
• Filed: 09/10/2014
• Published: 03/12/2015
• Est. Priority Date: 09/10/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Duo Security Incorporated (Cisco Systems, Inc.)
• Inventors: Oberheide, Jon, Song, Douglas
• Granted Patent: US 9,608,814 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A system and method for distributing key pair credentials that includes receiving a public key message at a key master service, wherein the public key message originates from a first client application; associating a key identifier with the public key; storing the public key at the key master service indexed at least by a key identifier; receiving a request for a public key from an outside service, wherein the request specifies a key identifier; and responding to the request with a public key according to the key identifier.

Claims

1. A method for distributing credentials comprising:

receiving a key message at a key master service, wherein the key message originates from a first client application;

associating a key identifier with a first key of the key message;

storing the first key at the key master service indexed at least by a key identifier;

receiving a request for a key from an outside service, wherein the request specifies a key identifier; and

responding to the request with a key according to the key identifier.

2. The method of claim 1, further comprising, at the first client application:

creating a key pair, which includes a private key stored in the client application and the first key, wherein the first key is a public key, and transmitting the public key to the key master service through an application programming interface of the key master service.

3. The method of claim 1, further comprising, at the first client application, instantiating an account in the client application, wherein the account is instantiated independently of a pre-existing account on the outside service.

4. The method of claim 3, wherein instantiating an account comprises activating the client application to act as a secondary factor of authentication for an outside service account.

5. The method of claim 1, wherein the key identifier is a human transcribable code.

6. The method of claim 1, further comprising transmitting a message to a destination, wherein the message contains key event information.

7. The method of claim 6, wherein the message is a push notification to the client application confirming delivery of the first key to the outside service.

8. The method of claim 1, wherein storing the first key within the key master service comprises storing the first key with an expiration condition;

and further comprising, when the expiration condition is satisfied, removing the first key.

9. The method of claim 8, wherein the expiration condition is conditional, at least in part, on a time-based expiration window.

10. The method of claim 8, wherein the expiration condition is conditional, at least in part, on the number of requests attempting to access the first key.

11. The method of claim 1, wherein the key message includes authentication credentials;

and wherein the request includes authentication credentials; and

further comprising authenticating the request and allowing the request if the authentication credentials are verified.

12. A method for key pair distribution comprising:

receiving a key pair request at a key master service;

creating a key pair within the key master service, wherein the key pair includes a public key and a private key;

storing the public key at the key master service associated with a key identifier;

transmitting the private key and the key identifier in a response to the key request;

receiving a public key request from an outside service, wherein the public key request specifies a key identifier; and

responding to the public key request with a public key according to the key identifier.

13. The method of claim 12, wherein the key identifier is a human transcribable code.

14. The method of claim 12, further comprising transmitting a message to a destination, wherein the message includes key event information.

15. The method of claim 14, wherein the message is a push notification to the client application confirming delivery of the public key to the outside service.

16. The method of claim 12, wherein storing the public key within the key master service comprises storing the public key with an expiration condition;

and further comprising, when the expiration condition is satisfied, removing the public key.

17. The method of claim 16, wherein the expiration condition is conditional, at least in part, on a time-based expiration window.

18. The method of claim 16, wherein the expiration condition is conditional, at least in part, on the number of requests attempting to access the public key.

19. The method of claim 12, wherein the public key message includes authentication credentials;

and wherein the request includes authentication credentials; and

further comprising authenticating the request and allowing the request if the authentication credentials are verified.

20. A method for distributing key pair credentials comprising:

For each client instance from a set of client instances, creating a key pair, wherein a key pair includes a private key stored at the client instance and a public key;

receiving a set of public keys at a key service platform, wherein the key service platform is a network accessible computing platform that is remote from the plurality of client instances;

associating a unique key identifier with each of the set of public key;

storing the public key at the key master service indexed at least by the key identifier;

receiving a set of key requests from a set of outside services, wherein each key request specifies a key identifier;

processing the set of key requests to identify a public key for a key identifier specified in the key request; and

responding to the set of key requests with a public key response according to the key identifier.