System, method and apparatus for cryptography key management for mobile devices

• US 9,425,958 B2
• Filed: 08/05/2005
• Issued: 08/23/2016
• Est. Priority Date: 08/05/2005
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Vennelakanti, Ravigopal, Fernandes, Savio
• Primary Examiner(s): LESNIEWSKI, VICTOR D
• Application Number:
  US11/996,588
• Publication Number:
  US 20080209221A1
• Time in Patent Office: 4,036 Days
• Field of Search: 380/277, 380/278, 380/286, 713/169, 713/171, 713/172, 713/182, 713/185, 726/6, 726/29
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04W 12/0433 Key management protocols
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A technique that binds encryption and decryption keys using a UID, a UDID, and a Pswd to a client mobile device in an enterprise. In one example embodiment, this is achieved by creating a new user account using the UID and the DPswd in an inactive state and communicating the UID and the DPswd to an intended user using a secure communication medium by an administrator. The intended user then logs into a cryptography key management system using the UID and the DPswd via a client mobile device. The UDID associated with the client mobile device is then hashed to create a H(UDID). The H(UDID) is then sent to the cryptography key management system by a local key management application module. The H(UDID) is then authenticated by the cryptography key management system. An encryption/decryption key is then assigned for the client mobile device.

Claims

1. A method comprising binding encryption and decryption keys using a unique user identifier (UID), a unique device identifier (UDID), and a user password (Pswd) to a client mobile device in an enterprise cryptography key management system, wherein binding the encryption and decryption keys comprises:

requesting the UDID from the client mobile device by the cryptography key management system;

receiving a hashed unique device identifier H(UDID) encrypted by the Pswd by the cryptography key management system from a key management application module included on the client mobile device; and

associating the H(UDID) with the user account, comprising;

decrypting the encrypted H(UDID) by the cryptography key management system using the Pswd;

if decryption fails, then terminating communication with the client mobile device; and

if the decryption is successful, then validating integrity of the decrypted H(UDID) by comparing the H(UDID) sent by the key management application module with other H(UDID)s in the cryptography key management system to ensure that the H(UDID) is unique for the client mobile device; and

registering a cryptography/data recovery key for the associated client mobile device with the enterprise using the cryptography/data recovery key, the UID, the H(UDID), and a unique key identifier (KeyID),

wherein registering the cryptography/data recovery key for the associated client mobile device with the enterprise comprises, upon validating that the H(UDID) exists for the UID;

storing the data recovery key and the KeyID associated with the UDID by the cryptography key management system,

encrypting the KeyID using a symmetric cryptography key derived from the Pswd to obtain a password-encrypted KeyID and sending the password-encrypted KeyID to the key management application module by the cryptography key management system, and

decrypting the password-encrypted KeyID using a symmetric cryptography key derived from the password to obtain the KeyID and storing the obtained KeyID by the key management application module.

2. The method of claim 1, wherein binding the encryption and decryption keys using the UID, the UDID, and the Pswd further comprises:

creating a new user account using the UID and a default password (DPswd) in an inactive state in the cryptography key management system by an administrator;

communicating the UID and the DPswd to an intended user using a secure communication medium by the administrator;

logging into the cryptography key management system using the UID and the DPswd via the client mobile device by the intended user upon authenticating the DPswd by the cryptography key management system;

changing the DPswd to a new password (NewPswd) by the intended user;

sending the NewPswd that is encrypted by a cryptography key derived from the DPswd to the cryptography key management system; and

replacing the DPswd with the NewPswd if the NewPswd satisfies enterprise password security requirements.

3. The method of claim 2, wherein the cryptography/data recovery key is selected from a group consisting of a symmetric cryptography key and an asymmetric cryptography key.

4. The method of claim 2, wherein sending the H(UDID) obtained using the UDID associated with the client mobile device to the cryptography key management system by a key management application module and associating the H(UDID) with the user account comprises:

hashing the UDID of the client mobile device to create the H(UDID);

encrypting the H(UDID) using the Pswd;

sending the password encrypted H(UDID) of the client mobile device along with the UID to the cryptography key management system by the key management application module; and

on successful validation, associating the H(UDID) with the user account in a secure key database.

5. The method of claim 4, wherein sending the password encrypted H(UDID) of the client mobile device along with the UID to the cryptography key management system by the key management application module comprises:

obtaining the UDID from the client mobile device;

forming the hash of the UDID by using a hash algorithm;

sending the password encrypted H(UDID) along with the UID to the cryptography key management system over a secure communication channel;

authenticating the H(UDID) sent by the key management application module;

if authentication fails, then terminating communication with the client mobile device; and

if the authentication is successful, then allowing a desired operation requested by the intended user.

6. The method of claim 2, wherein registering the cryptography/data recovery key for the associated client mobile device with the enterprise using the cryptography/data recovery key, the UID, the H(UDID), and the KeyID further comprises:

requesting the UID, the cryptography/data recovery key, and the Pswd upon connecting the client mobile device by the key management application module from an intended user;

determining the UDID associated with the client mobile device by the key management application module;

hashing the UDID by the key management application module to create the H(UDID);

encrypting the H(UDID) along with the cryptography/data recovery key using a symmetric cryptography key derived from the Pswd;

sending the encrypted H(UDID) along with the UID and the cryptography/data recovery key to the cryptography key management system by the key management application module;

passing the UID and requesting the stored Pswd;

returning the Pswd associated with the UID upon validating the passed UID by the cryptography key management system;

decrypting the H(UDID) and the cryptography/data recovery key using the returned Pswd;

if decryption is unsuccessful, then stopping the registering of the data recovery key;

if decryption is successful, then establishing a mutual authentication;

generating a KeyID and passing the H(UDID), the data recovery key, and the KeyID.

7. The method of claim 6, wherein decrypting the H(UDID) and the cryptography/data recovery key using the returned Pswd upon successful validation of the UID by the key management system comprises:

determining whether the encrypted H(UDID) and the cryptography/data recovery key can be decrypted using a symmetric cryptography key derived from the returned Pswd; and

in response to a determination that the encrypted H(UID) and the cryptography/data recovery key can be decrypted, decrypting H(UDID) and the cryptography/data recovery key using a symmetric cryptography key derived from the returned Pswd.

8. A method comprising changing a user password (Pswd) in a cryptography key management system via a client mobile device using a unique user identifier (UID), a unique device identifier (UDID), a unique key identifier, a current password (Pswd), and a new password (NewPswd), the method further comprising:

requesting the UID, the Pswd and the NewPswd from an intended user via the client mobile device;

determining the UDID associated with the client mobile device;

hashing the UDID (H(UDID)) by a key management application module included on the client mobile device;

encrypting the hashed UDID and the NewPswd using a symmetric cryptography key derived from the Pswd to obtain a password-encrypted H(UDID) and an encrypted NewPswd;

sending the password-encrypted H(UDID) and the encrypted NewPswd to the cryptography key management system by the key management application module and requesting a change in the Pswd;

connecting the key management application module to a secure key database via a valid user role by the cryptography key management system upon a successful validation of the UID and returning the Pswd for the UID to the cryptography key management system by the secure key database;

decrypting the password-encrypted H(UDID) and the encrypted NewPswd using a symmetric cryptography key derived from the Pswd to obtain the H(UDID) and the NewPswd by the cryptography key management system; and

determining whether the decryption of the password-encrypted H(UDID) and the encrypted NewPswd was successful, comprising;

if decryption fails, then terminating communication with the client mobile device; and

if the decryption is successful, then validating integrity of the decrypted H(UDID) by comparing the H(UDID) sent by the key management application module with an H(UDID) already stored in the cryptography key management system for the UID; and

registering a cryptography/data recovery key for the client mobile device using the cryptography/data recovery key, the UID, the H(UDID), and a unique key identifier (KeyID), comprising, upon validating that the H(UDID) exists for the UID;

storing the data recovery key and the KeyID associated with the UDID,

encrypting the KeyID using a symmetric cryptography key derived from the NewPswd to obtain a password-encrypted KeyID and sending the password-encrypted KeyID to the key management application module by the cryptography key management system, and

decrypting the password-encrypted KeyID using a symmetric cryptography key derived from the NewPswd to obtain the KeyID and storing the obtained KeyID by the key management application module.

9. The method of claim 8 wherein changing the Pswd via the client mobile device using the UID, the UDID, the Pswd, and the NewPswd further comprises:

establishing a client authentication by the cryptography key management system and storing the NewPswd associated with the UDID and UID in the secure key database upon a successful decryption.

10. An article comprising:

a non-transitory computer readable storage medium having instructions that, when executed by a processor cause the processor to;

bind encryption and decryption keys using a unique user identifier (UID), a unique device identifier (UDID), and a user password (Pswd) to a client mobile device in an enterprise cryptography key management system, wherein to bind the encryption and decryption keys, the instructions are to cause the processor to;

request the UDID from the client mobile device by the cryptography key management system;

send a hashed unique device identifier H(UDID) encrypted by the Pswd along with the UID to the cryptography key management system by a key management application module included on the client mobile device;

associate the H(UDID) with the user account, comprising;

decrypting the encrypted H(UDID) by the cryptography key management system using the Pswd;

if decryption fails, then terminating communication with the client mobile device; and

if the decryption is successful, then validating integrity of the decrypted H(UDID) by comparing the H(UDID) sent by the key management application module with other H(UDID)s in the cryptography key management system to ensure that the H(UDID) is unique for the client mobile device; and

register a cryptography/data recovery key for the associated client mobile device with the enterprise using the cryptography/data recovery key, the UID, the H(UDID), and a unique key identifier (KeyID),

wherein to register the cryptography/data recovery key for the associated client mobile device, the instructions are to cause the processor to, upon validating that the H(UDID) exists for the UID;

store the data recovery key and the KeyID associated with the UDID,

encrypt the KeyID using a symmetric cryptography key derived from the Pswd to obtain a password-encrypted KeyID and send the password-encrypted KeyID to the key management application module, and

decrypt the password-encrypted KeyID using a symmetric cryptography key derived from the password to obtain the KeyID and store the obtained KeyID by the key management application module.

11. The article of claim 10, wherein to bind the encryption and decryption keys using the UID, the UDID, and the Pswd, the instructions are further to cause the processor to:

create a new user account using the UID and a default password (DPswd) in an inactive state in the cryptography key management system by an administrator;

communicate the UID and the DPswd to an intended user using a secure communication medium by the administrator;

log into the cryptography key management system using the UID and the DPswd via the client mobile device by the intended user upon authenticating the default password by the cryptography key management system;

change the DPswd to a new password (NewPswd) by the intended user;

send the NewPswd, encrypted by a cryptography key derived from the DPswd to the cryptography key management system; and

replace the DPswd with the NewPswd if the NewPswd satisfies enterprise password security requirements.

12. The article of claim 11, wherein the cryptography/data recovery key is selected from a group consisting of a symmetric cryptography key and an asymmetric cryptography key.

13. The article of claim 11, wherein to send the H(UDID) obtained using the UDID associated with the client mobile device to the cryptography key management system by a key management application module and associating the H(UDID) with the user account, the instructions are to cause the processor to:

hash the UDID of the client mobile device to create the H(UDID);

encrypt the H(UDID) using the Pswd;

send the password encrypted H(UDID) of the client mobile device along with the UID to the cryptography key management system by the key management application module; and

on successful validation associating the H(UDID) with the user account in the secure key database.

14. The article of claim 13, wherein to send the password encrypted H(UDID) of the client mobile device along with the UID to the cryptography key management system by the key management application module, the instructions are to cause the processor to:

obtain the UDID from the client mobile device;

form the H(UDID) from the UDID by using a hash algorithm;

send the password encrypted H(UDID) along with the UID to the cryptography key management system over a secure communication channel;

authenticate the H(UDID) sent by the key management application module;

if authentication fails, then terminate communication with the client mobile device; and

if the authentication is successful, then allow a desired operation requested by the intended user.

15. The article of claim 11, wherein to register the cryptography/data recovery key for the associated client mobile device with the enterprise using the cryptography/data recovery key, the UID, the H(UDID), and the KeyID, the instructions are further to cause the processor to:

request the UID, the cryptography/data recovery key, and the Pswd upon connecting the client mobile device by the key management application module from an intended user;

determine a UDID associated with the client mobile device by the key management application module;

hash the UDID by the key management application module to create the H(UDID);

encrypt the H(UDID) along with the cryptography/data recovery key using a symmetric cryptography key derived from the Pswd;

send the encrypted H(UDID) along with the UID and the cryptography/data recovery key to the cryptography key management system by the key management application module;

pass the UID and request the stored Pswd;

return the Pswd associated with the UID upon validating the passed UID by the cryptography key management system;

decrypt the encrypted H(UDID) and the cryptography/data recovery key using the returned Pswd;

if decryption is unsuccessful, then stop the registering of the data recovery key;

if decryption is successful, then establish a mutual authentication; and

generate a KeyID and pass the H(UDID), the data recovery key, and the KeyID.

16. The article of claim 15, wherein to decrypt the encrypted H(UDID) and the cryptography/data recovery key using the returned Pswd upon successful validation of the UID by the key management system, the instructions are to cause the processor to:

determine whether the encrypted H(UDID) and the cryptography/data recovery key can be decrypted using a symmetric cryptography key derived from the returned Pswd; and

in response to a determination that the encrypted H(UDID) and the cryptography/data recovery key can be decrypted, decrypt H(UDID) and the cryptography/data recovery key using a symmetric cryptography key derived from the returned Pswd.

17. A cryptography key management apparatus, comprising:

a cryptography key management system that allows a user to create a new user account with the system and register with the system, allows the registered user to register a new client mobile device with the system, allows the registered user to register a cryptography/data recovery key with the system and associate/bind it with the client mobile device in the system, allows the registered user to request a cryptography key for encryption for the client mobile device from the system, allows the registered user to request a registered cryptography/data recovery key for decryption for the client mobile device from the system, allows the registered user to change its password/authentication tokens in the system, allows the registered user to decrypt the data stored encrypted on a removable media if the mobile device on which the encryption performed is lost or unavailable and allows an administrator to create and manage user accounts in the key management system;

a secure key database coupled to the cryptography key management system to store the registered user account information, the registered cryptography/data recovery key information and information binding the cryptography/data recovery key with the registered client mobile device and the registered user, wherein the user account information comprises a unique user identifier (UID), a unique device identifier (UDID) of the registered client mobile device, password (Pswd)/authentication tokens stored in encrypted format and the account state,

wherein to bind encryption and decryption keys using the UID, the UDID, and the Pswd to the client mobile device, the cryptography key management system is to;

request the UDID from the client mobile device;

receive a hashed unique device identifier H(UDID) encrypted by the Pswd along with the UID from a key management application module included on the client mobile device; and

associate the H(UDID) with the user account, comprising;

decrypt the encrypted H(UDID) by the cryptography key management system using the Pswd;

if decryption fails, terminate communication with the client mobile device; and

if the decryption is successful, validate integrity of the decrypted H(UDID) by comparing the H(UDID) sent by the key management application module with other H(UDID)s in the cryptography key management system to ensure that the H(UDID) is unique for the client mobile device; and

wherein to register the cryptography/data recovery key for the client mobile device, upon validating that the H(UDID) exists for the UID, the cryptography key management system is to;

store the data recovery key and a unique key identifier (KeyID) associated with the UDID,

encrypt the KeyID using a symmetric cryptography key derived from the Pswd to obtain a password-encrypted KeyID and send the password-encrypted KeyID to the key management application module, and

decrypt the password-encrypted KeyID using a symmetric cryptography key derived from the password to obtain the KeyID and store the obtained KeyID by the key management application module.

18. The apparatus of claim 17, wherein the cryptography key management system creates a new user account using the UID and a default password (DPswd) in an inactive state, wherein the UID and the DPswd is communicated to the intended user using a secure communication medium, wherein the intended user logs into the cryptography key management system using the UID and the DPswd via the client mobile device upon authenticating the DPswd by the cryptography key management system, wherein the user changes the DPswd to a new password (NewPswd), wherein the NewPswd is encrypted by a cryptography key derived from the DPswd and sent to the cryptography key management system, and wherein the DPswd is replaced with the NewPswd if the NewPswd satisfies enterprise requirements associated with a password strength stored in the secure key database.

19. The apparatus of claim 17, wherein the cryptography key management system authenticates the H(UDID), wherein the cryptography key management system terminates the communication with the client mobile device if the authentication fails, and wherein the cryptography key management system allows a desired operation by the intended user if the authentication is successful.