System and method for managing cryptographic keys

• US 9,379,890 B1
• Filed: 12/07/2015
• Issued: 06/28/2016
• Est. Priority Date: 12/07/2015
• Status: Active Grant

• Current Assignee: Workiva Inc.
• Original Assignee: Workiva Inc.
• Inventors: Blakely, Benjamin Alan, Sullivan, Matthew Edward, Wesner, Michael Bryan
• Primary Examiner(s): Zaidi, Syed
• Application Number:
  US14/961,113
• Time in Patent Office: 204 Days
• Field of Search: 380/277, 380/281
• US Class Current: 1/1
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

In various implementations, a first device retrieves, from a memory, encrypted data encrypted using a first key. The first device transmits, to a second device, a request for an encrypted first key, where the encrypted first key is generated by encrypting the first key using a second key. The first device receives the encrypted first key. The first device transmits, to an identity and access management device (IAM), a request for an encrypted second key, where the encrypted second key is generated by encrypting the second key using a third key. The first device receives the encrypted second key. The first device decrypts the encrypted second key using the third key, decrypts the encrypted first key using the decrypted second key, and decrypts the encrypted data using the decrypted first key. The first device deletes, from its cache, the decrypted first key after a period of time.

Claims

1. A method implemented on a first computing device, the method comprising:

retrieving, from a memory, encrypted data encrypted using a first key;

retrieving, from the memory, a fourth key;

transmitting, to a second computing device, a request for an encrypted first key, wherein the encrypted first key is generated by encrypting the first key using a second key;

receiving, from the second computing device, the encrypted first key;

transmitting, to an identity and access management device (IAM), a request for an encrypted second key, wherein the encrypted second key is generated by encrypting the second key using a third key;

receiving, from the IAM, the encrypted second key;

transmitting, to the second computing device, a request for an encrypted third key, wherein the encrypted third key is generated by encrypting the third key using the fourth key;

receiving, from the second computing device, the encrypted third key;

decrypting the encrypted third key using the fourth key;

decrypting the encrypted second key using the third key;

decrypting the encrypted first key using the decrypted second key;

decrypting the encrypted data using the decrypted first key; and

deleting, from a cache of the first computing device, the decrypted first key after a period of time.

2. The method of claim 1, wherein the fourth key is an asymmetric cryptographic key.

3. The method of claim 1, wherein:

the encrypted third key is stored in a hardware security module; and

the hardware security module is only accessible via the second computing device.

4. The method of claim 1, wherein:

the encrypted first key is stored in a hardware security module; and

the hardware security module is only accessible via the second computing device.

5. The method of claim 1, wherein:

the first computing device comprises an application server; and

the second computing device comprises a cryptographic key management server.

6. The method of claim 1, wherein:

the first key is a symmetric cryptographic key;

the second key is an asymmetric cryptographic key; and

the third key is a symmetric cryptographic key.

7. A method implemented on a system comprising an application server, a cryptographic key management server (KMS), and an identity and access management device (IAM), the method comprising:

retrieving, by the application server from a memory, encrypted data that is encrypted using a first key;

retrieving, by the application server from the memory, a fourth key;

transmitting, from the application server to the KMS, a request for an encrypted first key, wherein the encrypted first key is generated by encrypting the first key using a second key;

transmitting, from the KMS to the application server, the encrypted first key;

transmitting, from the application server to the IAM, a request for an encrypted second key, wherein the encrypted second key is generated by encrypting the second key using a third key;

transmitting, from the IAM to the application server, the encrypted second key;

transmitting, from the application server to the KMS, a request for an encrypted third key, wherein the encrypted third key is generated by encrypting the third key using the fourth key;

transmitting, from the KMS to the application server, the encrypted third key;

decrypting, by the application server, the encrypted third key using the fourth key;

decrypting, by the application server, the encrypted second key using the third key;

decrypting, by the application server, the encrypted first key using the decrypted second key;

decrypting, by the application server, the encrypted data using the decrypted first key; and

deleting, from a cache of the application server, the decrypted first key after a period of time.

8. The method of claim 7, wherein the fourth key is an asymmetric cryptographic key.

9. The method of claim 7, wherein the system further comprises a hardware security module (HSM) only accessible via the KMS, and the encrypted third key and the encrypted first key are stored in the HSM.

10. The method of claim 7, further comprising:

at the KMS;

determining whether the encrypted first key is stored in a cache of the KMS;

based on the determination that the encrypted first key is not stored in the cache of the KMS, transmitting, to a hardware security module (HSM), a request for the encrypted first key;

receiving, from the HSM, the encrypted first key; and

storing the encrypted first key in the cache of the KMS.

11. The method of claim 7, wherein:

the first key is a symmetric cryptographic key;

the second key is an asymmetric cryptographic key; and

the third key is a symmetric cryptographic key.