Replacing keys in a computer system
AssigneeSSH Communications Security OYJ
InventorsKimmo Parviainen-Jalanko, Marko Teiste
Life of this patent
Estimating the term…
Abstract
A first private key used by a device is replaced by a second private key, the first private key having an associated public key. The second private key is secured based on the associated public key and communicated to replace the first private key at the device. The device receives the second private key. The first private key is secured by a secret, and the device uses the secret to decrypt the first private key. The second private key is then encrypted using the decrypt first private key.
Claims9
A method for replacing a first private key of a first asymmetric pair of public and private keys used by a device, wherein the first private key has an associated public key of the first asymmetric pair of public and private keys, the method comprising:
- assigning, within a device manager server, a second private key of a second asymmetric pair of public and private keys for replacing the first private key,
- encrypting, within the device manager server, the second private key based on the associated public key of the first asymmetric pair of public and private keys, and
- delivering from the device manager server to the device, over a communication network, the encrypted second private key to replace the first private key at the device for use in communication with at least one other device,
- wherein the device is a separate and external device from the device manager server, and
- wherein the encrypted second private key is encrypted based on the associated public key of the first asymmetric pair of public and private keys such that the encryption can only be decrypted with the first private key of the first asymmetric pair of public and private keys using a secret known by the user of the device and/or the device.
An apparatus comprising at least one processor, and at least one memory including computer program code, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus to:
- assign, within a device manager server, for a device with a first private key of a first asymmetric pair of public and private keys a second private key of a second asymmetric pair of public and private keys for replacing the first private key,
- encrypt, within the device manager server, the second private key based on a public key associated with the first private key,
- deliver from the device manager server to the device, over a communication network, the encrypted second private key to replace the first private key at the device for use in communication with at least one other device, and
- configured to generate a secret character string for encrypting the second private key of the second asymmetric pair of public and private keys and encrypt the secret character string by means of the associated public key of the first asymmetric pair of public and private keys,
- wherein the device is a separate and external device from the device manager server.
Dependencies are inferred from the claim text.