SHARED KEYS IN A COMPUTERIZED SYSTEM

• US 20160261407A1
• Filed: 03/04/2015
• Published: 09/08/2016
• Est. Priority Date: 03/04/2015
• Status: Active Grant

• Current Assignee: SSH Communications Security Oyj
• Original Assignee: SSH Communications Security Oyj
• Inventors: HERNANDEZ, Roman, TEISTE, Marko, HUIMA, Antti, LINNAKANGAS, Tommi
• Granted Patent: US 9,531,536 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

Methods and apparatuses for managing keys in a computerized system are disclosed. A key is determined as a shared key, a key being a shared key when information of the key can be shared by a plurality of entities or would be shared by a plurality of entities as a result of a requested key management operation. A shared key operation is then performed based on the determining.

Claims

1. A method for managing keys in a computerized system, the method comprising:

determining a key is a shared key, wherein a key is a shared key when information of the key can be shared by a plurality of entities or would be shared by a plurality of entities as a result of a requested key management operation, and

performing a shared key operation based on the determining.

2. The method according to claim 1, further comprising detecting a request for a key management operation in association with the key, and performing a shared key management operation when the key is a shared key.

3. The method according to claim 1, wherein the shared key operation comprises displaying information on the shared key.

4. The method according to claim 3, further comprising displaying at least one of a notice the key is or will become a shared key, identity of at least one entity sharing the key, number of locations of the shared key, a list of locations of the shared key, number of trust relationships associated with the shared key, a prompt to use another key or to relocate the shared key from a shared location.

5. The method according to claim 1, wherein the shared key operation includes causing changes to a key in at least one entity sharing information on the key.

6. The method according to claim 1, wherein the shared key operation comprises relocating at least one key from a shared location to another location.

7. The method according to claim 6, where the key is relocated to a local directory from a file system serving a plurality of hosts.

8. The method according to claim 1, wherein the shared key operation comprises preventing the key management operation to proceed.

9. The method according to claim 1, wherein the shared key operation comprises at least one of removing an authorization of a key and blacklisting a key.

10. The method according to claim 1, wherein the determining the key is a shared key comprises determining at least one of:

the key is associated with at least two hosts,

the key is associated with at least two user accounts,

a host associated with the key is linked to a file system for storing directories of a plurality of hosts,

the key is located in a shared location, and

a command resulting sharing of the key.

11. The method according to claim 1, wherein the key comprises an authorized key or a private key stored in a shared location.

12. The method according to claim 1, further comprising triggering a different shared key operation for different shared keys.

13. An apparatus for management of keys, the apparatus comprising at least one processor, and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus to:

determine a key is a shared key, wherein a key is a shared key when information of the key can be shared by a plurality of entities or would be shared by a plurality of entities as a result of a requested key management operation, and

cause a shared key operation based on the determining.

14. The apparatus according to claim 13, configured to detect a request for a key management operation in association with the key, and cause a shared key management operation when the key is a shared key.

15. The apparatus according to claim 13, configured to cause a display of information on the shared key.

16. The apparatus according to claim 15, wherein the display comprises at least one of a notification the key is or will become a shared key, an identity of at least one entity sharing the key, the number of locations of the shared key, a list of locations of the shared key, the number of trust relationships associated with the shared key, a prompt to use another key, and a prompt to relocate the shared key from a shared location.

17. The apparatus according to claim 13, configured to, when a key is s shared key, cause at least one of:

change to a key in at least one entity sharing information on the shared key,

relocation of at least one key from a shared location to another location,

relocation of at least one key to a local directory from a file system serving a plurality of hosts,

prevent a requested key management operation to proceed,

remove an authorization of a key, and

blacklist a key.

18. The apparatus according to claim 13, configured to determine the key is a shared key is response to determination of at least one of:

the key is associated with at least two hosts,

the key is associated with at least two user accounts,

a host associated with the key is linked to a file system for storing directories of a plurality of hosts,

the key is located in a shared location, and

a command resulting sharing of the key.

19. The apparatus according to claim 13, configured to trigger a different shared key operation for different shared keys.

20. The apparatus according to claim 13, comprising a key management server.