System and method for centralized key distribution

• US 9,608,814 B2
• Filed: 09/10/2014
• Issued: 03/28/2017
• Est. Priority Date: 09/10/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Duo Security Incorporated (Cisco Systems, Inc.)
• Inventors: Oberheide, Jon, Song, Douglas
• Primary Examiner(s): Rahman, Mahfuzur
• Assistant Examiner(s): VICTORIA, NARCISO F
• Application Number:
  US14/482,829
• Publication Number:
  US 20150074408A1
• Time in Patent Office: 930 Days
• Field of Search: 380/279
• US Class Current: 1/1
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A system and method for distributing key pair credentials that includes receiving a public key message at a key master service, wherein the public key message originates from a first client application; associating a key identifier with the public key; storing the public key at the key master service indexed at least by a key identifier; receiving a request for a public key from an outside service, wherein the request specifies a key identifier; and responding to the request with a public key according to the key identifier.

Claims

1. A method for distributing credentials among electronic devices on a computer network comprising:

at a first client application operating on a first electronic device, instantiating an account in the first client application, wherein the account is instantiated independently of a pre-existing account on an outside service, wherein instantiating the account in the first client application includes activating the first client application prior to performing a secondary factor of authentication in a two-factor authentication for a transaction involving the pre-existing account at the outside service;

generating a key message, comprising a first cryptographic key, at the first client application;

receiving the key message at a key master service;

associating a key identifier with the first cryptographic key of the key message;

storing the first cryptographic key as non-transitory data in a computer database at the key master service indexed at least by the key identifier;

wherein storing the first cryptographic key comprises storing the first cryptographic key with an expiration condition, wherein the expiration condition is conditional, at least in part, on a number of requests attempting to access the first cryptographic key;

receiving a request for a cryptographic key from the outside service, wherein the request specifies a key identifier; and

responding to the request according to the key identifier;

wherein, responding to the request comprises responding to the request by preventing access to the first cryptographic key after the expiration condition is satisfied;

wherein preventing access to the first cryptographic key comprises disassociating the first cryptographic key and the key identifier.

2. The method of claim 1, wherein the expiration condition is conditional, at least in part, on a time-based expiration window.

3. The method of claim 1, wherein the key message includes authentication credentials;

and wherein the request includes authentication credentials; and

further comprising authenticating the request and allowing the request if the authentication credentials are verified.

4. A method of distributing credentials, the method comprising:

implementing one of a first mode or a second mode for distributing a cryptographic key, wherein;

(i) the first mode includes, at a key master service;

(a) receiving a key message;

(b) associating a key identifier with a cryptographic key of the key message;

(c) storing the cryptographic key indexed at least by the key identifier;

(d) receiving a request for the cryptographic key from an outside service, wherein the request specifies the key identifier; and

(e) according to the key identifier, responding to the request for the cryptographic key by either providing the cryptographic key or not providing the cryptographic key; and

(ii) the second mode includes, at the key master service;

(f) receiving a request for a private key and a public key identifier, wherein a cryptographic public key is stored and indexed at least by the public key identifier;

(g) providing the private key and the public key identifier to a device having a specific client application operating thereon; and

implementing the first mode or the second mode based on technical attributes of the device having the specific client application operating thereon.

5. The method of claim 4, further comprising:

generating, at the client application, a key pair including the cryptographic key of the key message and a matching private key.

6. The method of claim 4, further comprising:

generating, at the key master service, a key pair including the cryptographic public key and the private key;

according to the second mode, receiving a request for the cryptographic public key from an outside service, wherein the request specifies the public key identifier; and

according to the public key identifier, responding to the request for the cryptographic key by either providing the cryptographic key or not providing the cryptographic key.