Shared keys in a computerized system

• US 9,531,536 B2
• Filed: 03/04/2015
• Issued: 12/27/2016
• Est. Priority Date: 03/04/2015
• Status: Active Grant

• Current Assignee: SSH Communications Security Oyj
• Original Assignee: SSH Communications OYJ
• Inventors: Hernandez, Roman, Teiste, Marko, Huima, Antti, Linnakangas, Tommi
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US14/638,722
• Publication Number:
  US 20160261407A1
• Time in Patent Office: 664 Days
• Field of Search: 380/282
• US Class Current: 1/1
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

Methods and apparatuses for managing keys in a computerized system are disclosed. A key is determined as a shared key, a key being a shared key when information of the key can be shared by a plurality of entities or would be shared by a plurality of entities as a result of a requested key management operation. A shared key operation is then performed based on the determining.

Claims

1. A method for managing keys in a computerized system, the method comprising:

detecting a request for a key management operation in association with a private key;

determining whether the private key is a shared private key, wherein a private key is a shared private key when at least one of the private key is usable by a plurality of entities, and is available for use by a plurality of entities, as a result of the requested key management operation, and

performing a shared private key operation instead of, or in addition to, the requested key management operation on the private key when it is determined that the private key is a shared private key.

2. The method according to claim 1, further comprising displaying information regarding the shared private key.

3. The method according to claim 2, further comprising displaying at least one of:

a notice that the private key is or will become a shared private key,

an identity of at least one entity using the private key,

a number of locations of the shared private key,

a list of locations of the shared private key,

a number of trust relationships associated with the shared private key, and

a prompt to use another key or to relocate the shared private key from a shared location.

4. The method according to claim 1, wherein the shared private key operation includes causing changes to a private key in at least one entity using the private key.

5. The method according to claim 1, wherein the shared private key operation includes relocating the private key from a shared location to another location.

6. The method according to claim 5, where the private key is relocated to a local directory from a file system serving a plurality of hosts.

7. The method according to claim 1, wherein the shared private key operation includes preventing a requested key management operation to proceed.

8. The method according to claim 1, wherein the shared private key operation includes at least one of removing an authorization of a private key and blacklisting a private key.

9. The method according to claim 1, wherein the determining that the private key is a shared private key comprises determining at least one of:

the private key is associated with at least two hosts,

the private key is associated with at least two user accounts,

a host using the private key is linked to a file system for storing directories of a plurality of hosts,

the private key is located in a shared location, and

a command resulting in sharing of the private key.

10. The method according to claim 1, wherein the private key is stored in a file system serving a plurality of hosts.

11. The method according to claim 1, further comprising triggering a different shared private key operation for different shared private keys.

12. An apparatus for management of keys, the apparatus comprising at least one processor, and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus to:

detect a request for a key management operation in association with a private key;

determine that the private key is a shared private key, wherein a private key is a shared private key when at least one of the private key is usable by a plurality of entities, is available for use by a plurality of entities, as a result of the requested key management operation, and

cause a shared key operation to be performed on the private key instead of, or in addition to, the requested key management operation when it is determined that the private key is a shared private key.

13. The apparatus according to claim 12, wherein the apparatus is further configured to cause a display of information regarding the shared private key.

14. The apparatus according to claim 13, wherein the display comprises at least one of:

a notification that the private key is or will become a shared private key,

an identity of at least one entity using the private key,

a number of locations of the shared private key,

a list of locations of the shared private key,

a number of trust relationships associated with the shared private key,

a prompt to use another key, and

a prompt to relocate the shared private key from a shared location.

15. The apparatus according to claim 12, wherein the apparatus is further configured to, when a private key is a shared private key, cause at least one of:

a change to a private key in at least one entity using the shared private key,

a relocation of the private key from a shared location to another location,

a relocation of the private key to a local directory from a file system serving a plurality of hosts,

a prevention of a requested key management operation to proceed,

a removal of an authorization of a private key, and

a blacklisting of a private key.

16. The apparatus according to claim 12, wherein the apparatus is further configured to determine that the private key is a shared private key in response to a determination of at least one of:

the private key is associated with at least two hosts,

the private key is associated with at least two user accounts,

a host using the private key is linked to a file system for storing directories of a plurality of hosts,

the private key is located in a shared location, and

a command resulting in sharing of the private key.

17. The apparatus according to claim 12, wherein the apparatus is further configured to trigger a different shared private key operation for different shared private keys.

18. The apparatus according to claim 12, further comprising a key management server.