Secure key storage systems, methods and apparatuses

• US 9,397,982 B2
• Filed: 06/27/2013
• Issued: 07/19/2016
• Est. Priority Date: 06/28/2012
• Status: Active Grant

• Current Assignee: OLogN Technologies AG
• Original Assignee: OLogN Technologies AG
• Inventors: Ignatchenko, Sergey
• Primary Examiner(s): Gelagay, Shewaye
• Assistant Examiner(s): NGUYEN, TRONG H
• Application Number:
  US13/928,925
• Publication Number:
  US 20140006788A1
• Time in Patent Office: 1,118 Days
• Field of Search: 713156-158, 713/173, 713/175, 713/178, 713/180
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

The systems, methods and apparatuses described herein provide a computing environment that manages private key storage. An apparatus according to the present disclosure may comprise a first non-volatile storage for storing a private root key for signing digital certificates, an input device for receiving manual input from an operator, a communication interface consisting of a one-way transmitter for transmitting information from the apparatus, and a processor. The processor may be configured to retrieve the private root key from the first non-volatile storage, receive information for a new digital certificate through the input device, generate the new digital certificate according to the received information, sign the new digital certificate using the private root key and transmit the new digital certificate from the apparatus using the transmitter.

Claims

1. An apparatus, comprising:

a first non-volatile storage for storing a plurality of private root key of a certificate authority for signing digital certificates;

an input device for receiving manual input from an operator;

a communication interface consisting of a one-way transmitter for transmitting information from the apparatus; and

a processor configured to;

select a private root key from the plurality of private root keys according to the manual input received through the input device;

retrieve the selected private root key from the first non-volatile storage;

receive information for a new digital certificate through the input device;

generate the new digital certificate according to the received information;

sign the new digital certificate using the private root key; and

transmit the new digital certificate from the apparatus using the transmitter.

2. The apparatus of claim 1, further comprising:

a timer, and

a second non-volatile storage for storing a certificate revocation list (CRL); and

wherein the processor is further configured to;

retrieve the CRL;

add a timestamp generated by the timer to the retrieved CRL;

sign the retrieved CRL using the private root key; and

transmit the signed CRL through the transmitter from the apparatus.

3. The apparatus of claim 2, wherein the processor is further configured to append one or more error detection codes, error correction codes, or both to the signed CRL.

4. The apparatus of claim 2, wherein the processor is further configured to add a timestamp to the retrieved CRL, sign the retrieved CRL and transmit the signed CRL at regular intervals.

5. The apparatus of claim 2, wherein the processor is further configured to transmit the signed CRL at regular intervals.

6. The apparatus of claim 1, wherein the processor is further configured to transmit the new digital certificate at regular intervals.

7. The apparatus of claim 1, wherein the processor is further configured to transmit, via the transmitter, a message containing information regarding the apparatus'"'"'s recent activity to a monitoring service for analyzing and monitoring activities of the apparatus.

8. A system, comprising:

a first device, comprising;

a first non-volatile storage for storing a plurality of private root key of a certificate authority for signing digital certificates;

an input device for receiving manual input from an operator;

a communication interface consisting of a one-way transmitter for transmitting information from the first device to a second device; and

a processor configured to select a private root key from the plurality of private root keys according to the manual input received through the input device and generate new digital certificates to be transmitted to the second device; and

the second device, comprising;

a receiver coupled to the transmitter of the first device; and

a communication port for establishing a two-way communication channel with an external network.

9. The system of claim 8, wherein, to generate new digital certificates to be transmitted to the second device, the processor of the first device is configured to:

retrieve the private root key from the first non-volatile storage;

receive information for a new digital certificate through the input device;

generate the new digital certificate according to the received information;

sign the new digital certificate; and

transmit the new digital certificate from the first device to the second device using the transmitter.

10. The system of claim 8, wherein the first device further comprises:

a timer, and

a second non-volatile storage for storing a certificate revocation list (CRL); and

wherein the processor is further configured to;

retrieve the CRL;

add a timestamp generated by the timer to the retrieved CRL;

sign the retrieved CRL using the private root key; and

transmit the signed CRL through the transmitter from the apparatus.

11. The system of claim 10, wherein the processor is further configured to append one or more error detection codes, error correction codes, or both to the signed CRL.

12. The system of claim 11, wherein the second device is configured to perform error detections and corrections appended to the signed CRL and distribute the signed CRL to client devices.

13. The system of claim 10, wherein the processor is further configured to add a timestamp to the retrieved CRL, sign the retrieved CRL and transmit the signed CRL at regular intervals.

14. The system of claim 8, wherein the processor is further configured to transmit, via the transmitter and the second device, a message containing information regarding the first device'"'"'s recent activity to a monitoring service for analyzing and monitoring activities of the first device.

15. A system, comprising:

a first device, comprising;

a first non-volatile storage for storing a plurality of private root key of a certificate authority for signing digital certificates;

an input device for receiving manual input from an operator;

a first transceiver for communication with a second device; and

a processor configured to;

receive a new digital certificate request;

verify that the new digital certificate request is valid;

select a private root key from the plurality of private root keys according to the manual input received through the operator;

retrieve the selected private root key from the first non-volatile storage;

generate the new digital certificate according to the new digital certificate request;

sign the new digital certificate using the private root key; and

transmit the new digital certificate from the first device to the second device using a transmitter; and

the second device, comprising;

a second transceiver coupled to the first transceiver of the first device, wherein the first and second transceivers are coupled together by a non-routable, point-to-point connection; and

a communication port for establishing a two-way communication channel with an external network.

16. The system of claim 15, wherein the first device further comprises:

a timer, and

a second non-volatile storage for storing a certificate revocation list (CRL); and

wherein the processor is further configured to;

receive an update CRL request;

verify that the update CRL request is valid;

retrieve the CRL;

add a timestamp generated by the timer to the retrieved CRL;

sign the retrieved CRL using the private root key; and

transmit the signed CRL through the transmitter from the apparatus.

17. The system of claim 15, wherein the update CRL request is signed by more than one remote operator and the processor is further configured to verify that each remote operator signing the update CRL request has a valid operator'"'"'s digital signature.

18. The system of claim 15, wherein the new digital certificate request is signed by more than one remote operator and the processor is further configured to verify that each remote operator signing the new digital certificate request has a valid operator'"'"'s digital signature.

19. The system of claim 15, wherein verifying that the new digital certificate request is valid comprises verifying that a remote operator signing the new digital certificate request has a valid operator'"'"'s digital signature.

20. A computer-implemented method, comprising:

storing, in a first non-volatile storage of a first device, a plurality of private root key of a certificate authority for signing digital certificates;

receiving manual input from an operator for information about a new digital certificate;

select a private root key from the plurality of private root keys according to the manual input received from the operator;

retrieving the selected private root key from the first non-volatile storage;

generating the new digital certificate according to the received information;

signing the new digital certificate using the private root key; and

transmitting the new digital certificate from the first device to a second device connected to the first device by a one-way connection.

21. The computer-implemented method of claim 20, further comprising:

storing a certificate revocation list (CRL) at the first device;

retrieving the CRL;

adding a timestamp generated by a timer to the retrieved CRL;

signing the retrieved CRL using the private root key; and

transmitting the signed CRL to the second device.

22. The computer-implemented method of claim 21, further comprising appending one or more error detection codes, error correction codes, or both to the signed CRL.

23. The computer-implemented method of claim 22, further comprising performing, at the second device, error detections and corrections appended to the signed CRL and distributing the signed CRL to client devices.

24. The computer-implemented method of claim 21, further comprising adding a timestamp to the retrieved CRL, signing the retrieved CRL and transmitting the signed CRL at regular intervals.

25. The computer-implemented method of claim 21, wherein transmitting the signed CRL comprises transmitting the signed CRL at regular intervals.

26. The computer-implemented method of claim 20, wherein transmitting the new digital certificate comprises transmitting the new digital certificate at regular intervals.

27. The computer-implemented method of claim 20, further comprising transmitting a message containing information regarding the first device'"'"'s recent activity to a monitoring service for analyzing and monitoring activities of the first device.

28. A computer-implemented method, comprising:

storing, in a first non-volatile storage of a first device, a plurality of private root key of a certificate authority for signing digital certificates;

receiving a new digital certificate request;

verifying the new digital certificate request is valid;

select a private root key from the plurality of private root keys according to a manual input received through an operator;

retrieving the selected private root key from the first non-volatile storage;

generating the new digital certificate according to the new digital certificate request;

signing the new digital certificate using the private root key; and

transmitting the new digital certificate from the first device to a second device by a non-routable, point-to-point connection.

29. The computer-implemented method of claim 28, further comprising:

receiving an update certificate revocation list (CRL) request;

verifying that the update CRL request is valid;

retrieving the CRL;

adding a timestamp generated by a timer to the retrieved CRL;

signing the retrieved CRL using the private root key; and

transmitting the signed CRL from the first device to the second device.

30. The computer-implemented method of claim 29, further comprising verifying that each remote operator signing the update CRL request has a valid operator'"'"'s digital signature.

31. The computer-implemented method of claim 28, further comprising verifying that each remote operator signing the new digital certificate request has a valid operator'"'"'s digital signature.

32. The computer-implemented method of claim 28, wherein verifying that the new digital certificate request is valid comprises verifying that a remote operator signing the new digital certificate request has a valid operator'"'"'s digital signature.