Client services for applied key management systems and processes

• US 9,967,289 B2
• Filed: 03/11/2016
• Issued: 05/08/2018
• Est. Priority Date: 03/12/2015
• Status: Active Grant

• Current Assignee: Fornetix LLC
• Original Assignee: Fornetix LLC
• Inventors: White, Charles, Edwards, Stephen
• Primary Examiner(s): Reza, Mohammad W
• Application Number:
  US15/067,814
• Publication Number:
  US 20160269364A1
• Time in Patent Office: 788 Days
• Field of Search: 713165
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Embodiments described herein relate to apparatuses and methods for enabling applied key management operations at a client including establishing a data connection with a file kernel driver of the client to enable the applied key management operation, receiving a request pertaining to encryption key data, relaying the request pertaining to the encryption key data to an applied key management system, and receiving a response regarding the request from the applied key management system based on at least one policy of the applied key management system.

Claims

1. A method for enabling an applied key management operation at a client, the method comprising:

establishing a data connection with a file kernel driver of the client to enable the applied key management operation;

receiving from the file kernel driver a request pertaining to encryption key data;

relaying the request pertaining to the encryption key data to an applied key management system; and

receiving a response to the request from the applied key management system based on at least one policy of the applied key management system,

wherein the file kernel driver is configured to substitute a key file with a link to invoke the applied key management operation; and

wherein the link to invoke the applied key management operation causes the applied key management operation to be executed in response to a file access operation being executed on an encryption key material.

2. The method of claim 1, wherein the request comprises a request to register the encryption key data with the applied key management system.

3. The method of claim 1, wherein the request comprises a request to send the encryption key data.

4. The method of claim 3, further comprising:

retrieving the encryption key data from a local key store at the client; and

sending the encryption key data.

5. The method of claim 1, wherein the request comprises a request for recertification or for rekeying.

6. The method of claim 1, wherein the encryption key data comprises one of a certificate, a key store, a symmetric key, or an asymmetric key.

7. The method of claim 1, further comprising:

receiving a key that complies with the at least one policy from the applied key management server; and

relaying the key to an application plugin at the client for data encryption.

8. The method of claim 1, further comprising closing the connection with the file kernel driver after receiving the response from the applied key management system.

9. The method of claim 1, wherein the established connection with the file kernel driver is a Netlink connection.

10. The method of claim 1, wherein the response comprises a denial of the request based on the at least one policy of the applied key management system.

17. The system of claim 1, wherein the processor is further configured to:

receive a key that complies with the at least one policy from the applied key management server; and

relay the key to an application plugin at the client for data encryption.

18. The system of claim 17, wherein the processor is further configured to close the connection with the file kernel driver after receiving the response from the applied key management system.

19. The system method of claim 17, wherein the established connection with the file kernel driver is a Netlink connection.

21. The method of claim 1, wherein the applied key management operation comprises at least one of:

opening a Netlink connection with the file kernel driver, when the file access operation is an Open operation;

retrieving encryption key information, when the file access operation is a Read operation;

registering encryption key information, when the file access operation is a Write operation;

or

closing the Netlink connection with the file kernel driver, when the file access operation is a Close operation.

11. A system for enabling applied key management operations at a client, the system comprising:

a memory; and

a processor configured to;

establish a data connection with a file kernel driver of the client to enable the applied key management operation;

receive a request pertaining to encryption key data;

relay the request pertaining to the encryption key data to an applied key management system; and

receive a response to the request from the applied key management system based on at least one policy of the applied key management system,

wherein the file kernel driver is configured to substitute a key file with a link to invoke the applied key management operation; and

wherein the link to invoke the applied key management operation causes the applied key management operation to be executed in response to a file access operation being executed on an encryption key material.

12. The system of claim 11, wherein the request comprises a request to register the encryption key data with the applied key management system.

13. The system of claim 11, wherein the request comprises a request to send the encryption key data.

14. The system of claim 13, wherein the processor is further configured to:

retrieve the encryption key data from a local key store at the client; and

send the encryption key data.

15. The system of claim 11, wherein the request comprises a request for recertification or for rekeying.

16. The system of claim 11, wherein the encryption key data comprises one of a certificate, a key store, a symmetric key, or an asymmetric key.

20. The system of claim 11, wherein the response comprises a denial of the request based on the at least one policy of the applied key management system.