System and methods for opportunistic cryptographic key management on an electronic device

• US 9,774,448 B2
• Filed: 10/27/2014
• Issued: 09/26/2017
• Est. Priority Date: 10/30/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Duo Security Incorporated (Cisco Systems, Inc.)
• Inventors: Oberheide, Jon, Song, Douglas
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): BEHESHTI SHIRAZI, SAYED ARESH
• Application Number:
  US14/524,758
• Publication Number:
  US 20160352516A1
• Time in Patent Office: 1,065 Days
• Field of Search: 380 44
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

A system and method for opportunistic cryptographic key management includes generating a security capability assessment on a first electronic device based on security capabilities of the device, selecting a key management mode based on the security capability assessment, generating a cryptographic key based on the key management mode, and storing the cryptographic key based on the key management mode.

Claims

1. A method for cryptographic key generation and management comprising:

configuring a first computing device to select a cryptographic key management mode, wherein selecting the cryptographic key management mode includes dynamically selecting the cryptographic key management mode according to an option prioritization, wherein option prioritization defines a priority of available key management modes and is based on cryptographic key management policy rules;

prior to generating a cryptographic key for use by the first computing device, generating by the first computing device a security capability score of the first computing device, wherein the security capability score is based on a combination of hardware capabilities, platform enabled capabilities, and qualitative capabilities of the first computing device, wherein the security capability score is generated in part based on indirectly determined capabilities;

in response to generating the security capability score, automatically selecting the cryptographic key management mode comprising a generation mode and a storage mode, wherein the generation mode is one of an on-device generation mode, a remote cloud generation mode, and a second computing device generation mode, wherein the storage mode is one of a hardware security mode, a platform security mode, and a secured storage mode;

determining by the first computing device whether to generate the cryptographic key on the first computing device based on the security capability score of the first computing device and the selected key management mode, wherein;

(i) if the security capability score of the first computing device satisfies a threshold, then generating the cryptographic key on the first computing device, and

(ii) if the security capability score of the first computing device does not satisfy the threshold, then generating the cryptographic key at a remote cloud service or at a second computing device; and

storing the cryptographic key based on the key management mode;

selectively allowing and disallowing retrieval or use of the cryptographic key based on the selected cryptographic key management mode and a security measure.

2. The method of claim 1, further comprising providing key access based on the key management mode.

3. The method of claim 2, further comprising providing an administrator control panel;

wherein the administrator control panel can be used to modify key management parameters.

4. The method of claim 1, wherein the cryptographic key comprises a private key of an asymmetric key pair.

5. The method of claim 1, wherein the hardware capabilities comprise presence of a hardware security module.

6. The method of claim 1, wherein the qualitative capabilities comprise device processing speed.

7. The method of claim 1, wherein the indirect capabilities are determined indirectly through use of a lookup database.

8. The method of claim 1, wherein generating the cryptographic key comprises determining that the security capability score is above the threshold before generating the cryptographic key.

9. The method of claim 1, wherein selecting the key management mode comprises selecting generation mode from a set of modes comprising an on-device generation mode, a cloud generation mode, and a second device generation mode.

10. The method of claim 1, further comprising providing key access, wherein providing key access comprises enabling key access through use of an authentication method gate.

11. The method of claim 10, wherein the authentication method gate requires use of a decoupled operating system.

12. The method of claim 1, further comprising enforcing key policies based on security measures.

13. The method of claim 1, wherein generating the cryptographic key comprises using an Internet-connected key generation computing server or generating a random number using a hardware random number generation source and generating by a computer processor the cryptographic key using the random number.