Unified storage and management of cryptographic keys and certificates

• US 9,288,050 B1
• Filed: 09/25/2014
• Issued: 03/15/2016
• Est. Priority Date: 09/25/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Krishnan, Subramanian, Panchal, Nikunj R.
• Primary Examiner(s): Das, Chameli
• Application Number:
  US14/496,387
• Publication Number:
  US 20160094346A1
• Time in Patent Office: 537 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Cryptographic resources, such as those including PGP keys and certificates, are transformed such that they are understood by certificate repositories, such as in a format understood by the JAVA tools of JAVA KEYSTORE (JKS). JAVA is one example of a general-purpose computer programming language that is concurrent, class-based, object-oriented. JAVA KEYSTORE is one example of a repository of security certificates, such as authorization certificates and public key certificates, used for instance in SSL encryption. The transformation of the cryptographic resources is completed such that the necessary metadata for retrieving the original cryptographic resources, or artifacts thereof, are retained. In that way, cryptographic resources are effectively hidden within the certificate repository until needed. The security program applies an algorithm to generate keys for JKS storage such that the keys “masquerade” in a JKS canonical format until the time in which the resources are needed to be in a PGP canonical format.

Claims

1. A computer program product comprising a computer readable storage medium having stored thereon:

first program instructions programmed to receive a cryptographic resource including a first artifact in a first format having a first metadata set, the first format being a pretty good privacy (PGP) canonical format;

second program instructions programmed to convert the first artifact to a second artifact having a second format;

third program instructions programmed to store the second artifact in a repository; and

fourth program instructions programmed to, responsive to a request for the first artifact, create a third artifact based on the second artifact;

wherein;

the repository cannot store the first artifact, at least in part, because the first artifact is formatted according to the first format;

the second artifact being formatted according to the second format retains the first metadata set of the first artifact;

the repository configured to store the second artifact, at least in part, because the second artifact is formatted according to the second format;

the third artifact is a functional copy of the first artifact and the third artifact functionally replaces the first artifact;

the second format is a standard format of the repository; and

the first format and the second format are distinct formats.

2. The computer program product of claim 1, further comprising:

fifth program instructions programmed to encrypt a file using the third artifact.

3. The computer program product of claim 1, wherein:

the third artifact is formatted according to the first format;

the third artifact having the first metadata set.

4. The computer program product of claim 1, wherein:

the cryptographic resource is a pretty good privacy (PGP) key ring set;

the first artifact is a PGP key pair including a PGP private key and a PGP public key;

the first format is PGP format;

the second artifact is a key pair; and

the second format is selected from a group consisting of;

a secure socket layer (SSL) protocol and a transport layer security (TLS) protocol.

5. The computer program product of claim 4, further comprising:

fifth program instructions programmed to extract the PGP private key from a secret key ring; and

sixth program instructions programmed to extract the PGP public key from a public key ring;

wherein;

the program instructions programmed to convert the first artifact to a second artifact having a second format include;

program instructions to build an SSL certificate from a PGP certificate.

6. The computer program product of claim 4, wherein the repository is a JAVA KEYSTORE (JKS) repository.

7. A computer system comprising:

a processor(s) set; and

a computer readable storage medium;

wherein;

the processor set is structured, located, connected, and/or programmed to run program instructions stored on the computer readable storage medium; and

the program instructions include;

first program instructions programmed to receive a cryptographic resource including a first artifact in a first format having a first metadata set, the first format being a pretty good privacy (PGP) canonical format;

second program instructions programmed to convert the first artifact to a second artifact having a second format;

third program instructions programmed to store the second artifact in a repository; and

fourth program instructions programmed to, responsive to a request for the first artifact, create a third artifact based on the second artifact;

wherein;

the repository cannot store the first artifact, at least in part, because the first artifact is formatted according to the first format;

the second artifact being formatted according to the second format retains the first metadata set of the first artifact;

the repository configured to store the second artifact, at least in part, because the second artifact is formatted according to the second format; and

the third artifact is a functional copy of the first artifact and the third artifact functionally replaces the first artifact;

the second format is a standard format of the repository; and

the first format and the second format are distinct formats.

8. The computer system of claim 7, further comprising:

fifth program instructions programmed to encrypt a file using the third artifact.

9. The computer system of claim 7, wherein the third artifact is in the first format having the first metadata set.

10. The computer system of claim 7, wherein:

the cryptographic resource is a pretty good privacy (PGP) key ring set;

the first artifact is a PGP key pair including a PGP private key and a PGP public key;

the first format is PGP format;

the second artifact is a key pair; and

the second format is selected from a group consisting of;

a secure socket layer (SSL) protocol and a transport layer security (TLS) protocol.

11. The computer system of claim 10, further comprising:

fifth program instructions programmed to extract the PGP private key from a secret key ring; and

sixth program instructions programmed to extract the PGP public key from a public key ring;

wherein;

the program instructions programmed to convert the first artifact to a second artifact having a second format include;

program instructions to build an SSL certificate from a PGP certificate.

12. The computer system of claim 10, wherein the repository is a JAVA KEYSTORE (JKS) repository.