SERVER-CLIENT KEY ESCROW FOR APPLIED KEY MANAGEMENT SYSTEM AND PROCESS

• US 20160269179A1
• Filed: 03/10/2016
• Published: 09/15/2016
• Est. Priority Date: 03/13/2015
• Status: Active Grant

• Current Assignee: Fornetix LLC
• Original Assignee: Fornetix LLC
• Inventors: White, Charles, Brand, Joseph
• Granted Patent: US 10,965,459 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

Embodiments described herein relate to apparatuses and methods for registering and storing a local key associated with a local application of a communication device, including, but not limited to, receiving a request from the communication device to register and store the local key, evaluating the request based on at least one first policy, and sending the request to register and store the local key to a secure key storage.

Claims

1. A method for registering and storing a local key associated with a local application of a communication device, comprising:

sending a request to an applied key management system to register and store the local key at a secure key storage; and

receiving a response from the applied key management system, wherein registering and storing the local key at the secure key storage are authorized by at least one first policy.

2. The method of claim 1, wherein the local key is one or more of a locally-generated encryption key or locally-stored encryption key.

3. The method of claim 1, wherein the local key comprises one or more of a key file for secure data storage, key data for Secure Shell (SSH), or license key for an application.

4. The method of claim 1, wherein the secure key storage is one or more of a Hardware Security Module (HSM), key management server, or secure data storage.

5. The method of claim 1, wherein:

the request is sent over a network link; and

the response is received over the network link.

6. The method of claim 1, further comprising determining whether the local key needs to be registered and stored.

7. The method of claim 6, wherein determining whether the local key needs to be registered and stored comprises determining whether the local key has been previously registered and stored.

8. The method of claim 1, further comprising:

sending a recovery request to the applied key management system to recover the local key from the secure key storage; and

receiving the local key from the applied key management system, wherein recovering the local key from the secure key storage is authorized by at least one second policy.

9. A communication device, comprising:

a local key store;

a memory; and

a processor implementing a client interface;

wherein;

the client interface is configured to;

send a request to an applied key management system to register and store the local key at a secure key storage; and

receive a response from the applied key management system, wherein registering and storing the local key at the secure key storage are authorized by at least one first policy.

10. A non-transitory processor-readable medium having processor-readable instructions, such that, when executed, causes a processor to:

send a request to an applied key management system to register and store the local key at a secure key storage; and

receive a response from the applied key management system, wherein registering and storing the local key at the secure key storage are authorized by at least one first policy.

11. A method for registering and storing a local key associated with a local application of a communication device, comprising:

receiving a request from the communication device to register and store the local key;

evaluating the request based on at least one first policy; and

sending the request to register and store the local key to a secure key storage.

12. The method of claim 11, wherein:

the request is received from the communication device via a first network link; and

the request is sent to the secure key storage via a second network link.

13. The method of claim 11, wherein:

the request is received from the communication device via a first network link; and

the request is sent to the secure key storage locally.

14. The method of claim 11, wherein the request comprises one or more of key attributes of the local key, application identifier identifying the local application, user identifier identifying a user authorized to use the local key, device identifier identifying the communication device, or time at which the local key is collected.

15. The method of claim 14, wherein evaluating the request based on the at least one policy comprises evaluating one or more of the key attributes of the local key, application identifier identifying the local application, user identifier identifying a user authorized to use the local key, device identifier identifying the communication device, or time at which the local key may be collected based on the at least one first policy.

16. The method of claim 11, further comprising:

receiving a recovery request from the communication device, wherein the recovery request corresponds to recovering the local key from the secure key storage;

evaluating the recovery request based on at least one second policy;

sending the recovery request to the secure key storage;

receiving the local key from the secure key storage; and

sending the local key to the communication device.

17. The method of claim 16, wherein the recovery request received from the communication device comprises one or more of key attribute of the local key, application identifier identifying the local application associated with the local key, user identifier identifying a user authorized to use the local key, device identifier identifying the communication device, or time at which the local key is collected.

18. The method of claim 17, wherein evaluating the recovery request based on the at least one policy comprises evaluating one or more of the key attribute of the local key, application identifier identifying the local application associated with the local key, user identifier identifying a user authorized to use the local key, device identifier identifying the communication device, or time at which the local key is collected based on the at least one second policy.

19. An applied key management system, comprising:

a memory; and

a processor, the processor configured to;

receive a request from a communication device to register and store a local key;

evaluate the request based on at least one first policy; and

send the request to register and store the local key to a secure key storage.

20. A non-transitory processor-readable medium having processor-readable instructions, such that, when executed, causes a processor to:

receive a request from a communication device to register and store a local key;

evaluate the request based on at least one first policy; and

send the request to register and store the local key to a secure key storage.