Systems and methods for managing cryptographic keys

• US 9,397,827 B2
• Filed: 02/23/2012
• Issued: 07/19/2016
• Est. Priority Date: 09/14/2007
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: O'Hare, Mark S., Orsini, Rick L., Davenport, Roger S.
• Primary Examiner(s): SCHMIDT, KARI L
• Application Number:
  US13/403,142
• Publication Number:
  US 20120170750A1
• Time in Patent Office: 1,608 Days
• Field of Search: 380/277, 380/278, 713/166, 713/167, 709/212, 709/213
• US Class Current: 1/1
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

A common interface for managing cryptographic keys is provided. A request to manage a cryptographic key may be received in a first interface format, translated to a common interface format, and then executed remotely from the first interface. Return arguments may then be translated from the common interface format to a format compatible with the first interface and communicated securely to the first interface. The cryptographic keys may be used in connection with a secure data parser that secures data by randomly distributing data within a data set into two or more shares.

Claims

1. A method for managing cryptographic keys, the method comprising:

receiving at a common interface by using a hardware processor a first request from a first interface in a first interface format to manage at least one cryptographic key stored remote from the first interface, wherein the common interface is useable of recognizing a plurality of interface formats including the first interface format;

translating the first request from the first interface format to a common interface format;

in response to determining that a first authentication token associated with the first interface is not available, authenticating the first request by at least verifying that the first request originated from an authorized source and storing an authentication token for the first request, wherein the authentication token is usable to authenticate a subsequent request associated with the first interface;

in response to determining that a first authentication token associated with the first interface is available, bypassing the authenticating step;

accessing the at least one cryptographic key from a key store;

executing the first translated. request in the common interface format;

translating at least one return argument of the request from the common interface format to the first interface format; and

sending the at least one return argument from the common interface to the first interface.

2. The method of claim 1 wherein executing the translated request comprises retrieving the at least one cryptographic key.

3. The method of claim 1 wherein executing the translated request comprises generating the at least one cryptographic key.

4. The method of claim 1 wherein executing the translated request comprises deleting the at least one cryptographic key.

5. The method of claim 1 wherein executing the translated request comprises storing the at least one cryptographic key in a key store.

6. The method of claim 1 wherein executing the translated request comprises storing the at least one cryptographic key on removable media.

7. The method of claim 1 further comprising securing a data set using the at least one cryptographic key, wherein securing the data set comprises:

encrypting the data set using the at least one cryptographic key;

generating a random or pseudo-random value;

distributing, based, at least in part, on the random or pseudorandom value, encrypted data in the data set into two or more shares; and

storing the two or more shares separately on at least one data depository.

8. The method of claim 7 wherein storing the two or more shares separately on at least one data depository comprises storing the two or more shares on at least two geographically separated data depositories.

9. The method of claim 1 wherein the at least one return argument of the executed request comprises at least one cryptographic key.

10. The method of claim 1 further comprising transmitting the at least one return argument to the first interface over a secure communications path.

11. The method of claim 1 wherein authenticating the request comprises implementing an authentication protocol or cryptographic handshake.

12. The method of claim 1 wherein authenticating the request comprises verifying a cryptographic signature associated with the request.

13. The method of claim 1 further comprising validating the authentication token.

14. The method of claim 13 wherein validating the authentication token comprises enforcing an expiration date or expiration time associated with the authentication token.