MANAGING KEY ROTATIONS WITH MULTIPLE KEY MANAGERS

• US 20170141916A1
• Filed: 11/16/2015
• Published: 05/18/2017
• Est. Priority Date: 11/16/2015
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: Zhang, Fengping
• Granted Patent: US 9,735,961 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method, a device, and a non-transitory storage medium are provided to generate and transmit a request to obtain a resource object stored in a clustered network database that stores keys; determine based on a value of the resource object carried in a response, whether permission to update the keys is permitted, wherein a first value of the resource object grants permission and a second value of the resource object does not grant permission; determine whether any of the keys expired in response to receiving permission, wherein other network devices configured to update the keys are prevented from updating the keys while the network device is granted permission; generate a new key for each key of the keys that expired; and store the new key for each key; and release the resource object back to the clustered network database.

Claims

1. A method comprising:

generating, by a network device, a request to obtain a resource object stored in a clustered network database that stores keys;

transmitting, by the network device, the request to the clustered network database;

receiving, by the network device, a response to the request;

determining, by the network device, based on a value of the resource object carried in the response, whether permission to update the keys is permitted, wherein a first value of the resource object grants permission to update the keys and a second value of the resource object does not grant permission to update the keys, wherein the first value and the second value are different;

determining, by the network device, whether any of the keys expired in response to determining that the value of the resource object corresponds to the first value indicating that permission is granted to update the keys, and wherein other network devices that are configured to update the keys are prevented from updating the keys stored in the clustered network database while the network device is granted permission to update the keys;

generating, by the network device, a new key for each key of the keys that expired, in response to determining that one or more of the keys expired;

storing, by the network device, the new key for each key of the one or more of the keys at the clustered network database; and

releasing, by the network device, the resource object back to the clustered network database.

2. The method of claim 1, wherein determining whether any of the keys expired comprises:

selecting key expiration data, which is stored at the clustered network database, which indicates dates and timestamps that new keys can be generated;

comparing the key expiration data to a current date and time based on the selecting; and

determining whether the key expiration data is before, equal to, or subsequent to the current date and time based on the comparing.

3. The method of claim 1, further comprising:

determining that permission to update the keys is not granted based on the value of the resource object, wherein the value of the resource object corresponds to the second value.

4. The method of claim 1, wherein the generating comprises:

generating a new key identifier that uniquely identifies the new key;

generating a new key value of the new key;

generating key creation data that indicates when the new key is generated; and

generating key expiration data.

5. The method of claim 4, wherein the network device and the other network devices operate independently from each other, and wherein storing the new key further comprises:

storing the new key identifier, the new key value, the key creation data, and the key expiration data for each of the one or more keys at the clustered network database.

6. The method of claim 1, wherein the clustered network database includes multiple key stores, and wherein the resource object is stored in each of the key stores.

7. The method of claim 1, further comprising:

storing the value of the resource object as the second value while the network device has permission to update the keys.

8. The method of claim 7, further comprising:

storing the value of the resource object as the first value in response to the releasing;

receiving a key request, from a validation server of a toll-free data service, that requests whether any key used by the validation server has been updated since a last key request was received from the validation server inquiring whether any key has been updated;

querying, by the network device, the network clustered database as to whether any new key has been generated in response to receiving the key request; and

transmitting, by the network device, a key response that includes the new key to the validation server, based on a result of the querying that the new key has been updated since the last key request.

9. A network device comprising:

a communication interface;

a memory, wherein the memory stores instructions; and

a processor, wherein the processor executes the instructions to;

generate a request to obtain a resource object stored in a clustered network database that stores keys;

transmit, via the communication interface, the request to the clustered network database;

receive, via the communication interface, a response to the request;

determine based on a value of the resource object carried in the response, whether permission to update the keys is permitted, wherein a first value of the resource object grants permission to update the keys and a second value of the resource object does not grant permission to update the keys, wherein the first value and the second value are different;

determine whether any of the keys expired in response to a determination that the value of the resource object corresponds to the first value indicating that permission is granted to update the keys, and wherein other network devices that are configured to update the keys are prevented from updating the keys stored in the clustered network database while the network device is granted permission to update the keys;

generate a new key for each key of the keys that expired, in response to determining that one or more of the keys expired;

store the new key for each key of the one or more of the keys at the clustered network database; and

release the resource object back to the clustered network database.

10. The network device of claim 9, wherein when making the determination of whether any of the keys expired, the processor further executes the instructions to:

select key expiration data, which is stored at the clustered network database, that indicates dates and timestamps that new keys can be generated;

compare the key expiration data to a current date and time based on a selection; and

determine whether the key expiration data is before, equal to, or subsequent to the current date and time based on a result of a comparison.

11. The network device of claim 9, the processor further executes the instructions to:

determine that permission to update the keys is not granted based on the value of the resource object, wherein the value of the resource object corresponds to the second value.

12. The network device of claim 9, wherein when generating the new key, the processor further executes the instructions to:

generate a new key identifier that uniquely identifies the new key;

generate a new key value of the new key;

generate key creation data that indicates when the new key is generated; and

generate key expiration data that indicates when the new key is to expire.

13. The network device of claim 12, wherein when generating the new key identifier and the new key value, the processor further executes the instructions to:

generate the new key identifier and the new key value based on a random algorithm.

14. The network device of claim 12, wherein when storing the new key, the processor further executes the instructions to:

store the new key identifier, the new key value, the key creation data and the key expiration data for each of the one or more keys at the clustered network database, and wherein the processor further executes the instructions to;

receive, via the communication interface, a key request, from a validation server of a toll-free data service, that requests whether any key used by the validation server has been updated since a last key request was received from the validation server inquiring whether any key has been updated;

query the network clustered database as to whether any new key has been generated in response to a receipt of the key request; and

transmit, via the communication interface, a key response that includes the new key to the validation server, based on a result of a query that the new key has been updated since the last key request.

15. The network device of claim 12, wherein when generating the key expiration data, the processor further executes the instructions to:

generate a first date and a first timestamp indicating an expiration for each of the keys; and

generate a second date and a second timestamp indicating when a subsequent new key can be generated for each of the keys, wherein the first date and the first timestamp indicates a time subsequent to the second date and the second timestamp.

16. A non-transitory, computer-readable storage medium storing instructions executable by a processor of a computational device, which when executed cause the computational device to:

generate a request to obtain a resource object stored in a clustered network database that stores keys;

transmit the request to the clustered network database;

receive a response to the request;

determine based on a value of the resource object stored carried in the response, whether permission to update the keys is permitted, wherein a first value of the resource object grants permission to update the keys and a second value of the resource object does not grant permission to update the keys, wherein the first value and the second value are different;

determine whether any of the keys expired in response to a determination that the value of the resource object corresponds to the first value indicating that permission is granted to update the keys, and wherein other network devices that are configured to update the keys are prevented from updating the keys stored in the clustered network database while the network device is granted permission to update the keys;

generate a new key for each key of the keys that expired, in response to determining that one or more of the keys expired;

store the new key for each key of the one or more of the keys at the clustered network database; and

release the resource object back to the clustered network database.

17. The non-transitory, computer-readable storage medium of claim 16, wherein the instructions to generate the new key further comprise instructions to:

generate a new key identifier that uniquely identifies the new key;

generate a new key value of the new key;

generate key creation data that indicates when the new key is generated; and

generate key expiration data that indicates when the new key is to expire.

18. The non-transitory, computer-readable storage medium of claim 16, wherein the instructions to determine whether any of the keys expired further comprise instructions to:

select key expiration data pertaining to the keys;

compare the key expiration data to a current date and time; and

determine whether the key expiration data is before, equal to, or subsequent to the current date and time based on a result of a comparison.

19. The non-transitory, computer-readable storage medium of claim 18, wherein the key expiration data includes a first date and a first timestamp that indicates an expiration for each of the keys, and a second date and a second timestamp that indicates when a new key can be generated, wherein the first date and the first timestamp indicate a time subsequent to the second date and the second timestamp.

20. The non-transitory, computer-readable storage medium of claim 19, wherein the instructions further comprise instructions to:

monitor a time period to access the clustered network database;

compare the time period to a threshold value;

determine whether the time period exceeds the threshold value as a result of a comparison between the time period and the threshold value, wherein when the time period does not exceed the threshold value, the instructions to determine whether any of the keys expired further comprises instructions to;

determine that the current date and time is before the second date and the second timestamp for at least one of the one or more of the keys;

calculate a time difference between the current date and time and the second date and the second timestamp;

determine whether the time difference is below a time difference threshold value; and

wherein the instructions to generate the new key further comprise instructions to;

generate the new key for the at least one of the one or more keys in response to a determination that the time difference is below the time difference threshold value.