Trust-anchoring of cryptographic objects
AssigneeInternational Business Machines Corporation
InventorsMartin Schmatz, Navaneeth Rameshan, Patricia M. Sagmeister
Life of this patent
Estimating the term…
Abstract
A method manages cryptographic objects (COs). The method includes accessing an entropy-based random number and instructing to store this random number. The method includes generating one or more COs based on a deterministic algorithm that causes to interact with a security module (SM), such as a hardware security module (HSM), to generate a seed according to both a reference key of the SM and the random number accessed. A random number generator is seeded with the generated seed to generate the desired COs.
Claims29
A method of managing cryptographic objects, the steps being concurrently performed at each client of a set of clients communicating with a respective hardware security module (HSM), the method, at each client, comprising:
- concurrently at the clients, receiving entropy-based random numbers from one or more certificate authorities;
- accessing, by a first entity, an entropy-based random number generated by a second entity subsequent to receiving the entropy-based random numbers;
- instructing to store the random number on the first entity;
- and
- based on a deterministic algorithm:
- interacting with the HSM to generate a seed according to both a reference key of the HSM and the random number, the reference key of the HSM being one of residing in or derived by the HSM, the random number being stored in the HSM;
- and
- seeding a random number generator with the generated seed to generate one or more post-quantum secure cryptographic objects that are trust anchored to the reference key of the HSM.
A computerized system for managing cryptographic objects, the system comprising:
- a random number generator;
- storage means storing instructions;
- and
- a hardware processing means configured to execute said instructions being concurrently performed at each client of a set of clients communicating with a respective hardware security module (HSM), so as, at each client, to:
- concurrently at the clients, receive entropy-based random numbers from one or more certificate authorities;
- access an entropy-based random number as generated by a further computerized system subsequent to receiving the entropy-based random numbers;
- instruct to store the random number accessed as per said instructions on the computerized system;
- and
- based on a deterministic algorithm:
- interact with the HSM to generate a seed according to a random number accessed as per said instructions and a reference key of the HSM, the reference key of the HSM being one of residing in or derived by the HSM, the random number being stored in the HSM;
- and
- seed the random number generator with a seed as generated as per said instructions and generate one or more post-quantum secure cryptographic objects that are trust anchored to the reference key of the HSM.
A computer program product for managing cryptographic objects, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by one or more processors that are concurrently performed at each client of a set of clients communicating with a respective hardware security module (HSM), to cause, at each client, to:
- concurrently at the clients, receive entropy-based random numbers from one or more certificate authorities;
- access, by a first entity, an entropy-based random number generated by a second entity subsequent to receiving the entropy-based random numbers;
- instruct to store this random number on the first computerized device entity;
- and
- based on a deterministic algorithm:
- interact with the HSM to generate a seed according to the random number accessed and a reference key of the HSM, the reference key of the HSM being one of residing in or derived by the HSM, the random number being stored in the HSM;
- and
- seed a random number generator with the generated seed to generate one or more post-quantum secure cryptographic objects that are trust anchored to the reference key of the HSM.
A method of managing cryptographic objects, the steps being concurrently performed at each client of a set of clients communicating with a respective hardware security module (HSM), the method, at each client, comprising:
- accessing, by a first entity, an entropy-based random number generated by a second entity;
- instructing to store the random number on the first entity;
- and
- based on a deterministic algorithm:
- interacting with the HSM to generate a seed according to both a reference key of the HSM and the random number, the reference key of the HSM being one of residing in or derived by the HSM, the random number being stored in the HSM;
- seeding a random number generator with the generated seed to generate one or more post-quantum secure cryptographic objects that are trust anchored to the reference key of the HSM;
- at each client, using one or each of the one or more post-quantum secure cryptographic objects generated to perform a cryptographic operation;
- after using said one or each of the one or more post-quantum secure cryptographic objects generated to perform said cryptographic operation, deleting said one or more of the cryptographic objects;
- and
- receiving random numbers at the clients from one or more certificate authorities, wherein said random numbers correspond to random numbers as initially accessed by the clients, so as for the clients to be able to regenerate the same one or more cryptographic objects as previously generated.
A computerized system for managing cryptographic objects, the system comprising:
- a random number generator;
- storage means storing instructions;
- and
- a hardware processing means configured to execute said instructions being concurrently performed at each client of a set of clients communicating with a respective hardware security module (HSM), so as, at each client, to:
- access an entropy-based random number generated by a second entity;
- instruct to store the random number on the first entity;
- and
- based on a deterministic algorithm:
- interact with the HSM to generate a seed according to both a reference key of the HSM and the random number, the reference key of the HSM being one of residing in or derived by the HSM, the random number being stored in the HSM;
- seed a random number generator with the generated seed to generate one or more post-quantum secure cryptographic objects that are trust anchored to the reference key of the HSM;
- at each client, use one or each of the one or more post-quantum secure cryptographic objects generated to perform a cryptographic operation;
- after using said one or each of the one or more post-quantum secure cryptographic objects generated to perform said cryptographic operation, delete said one or more of the cryptographic objects;
- and
- receive random numbers at the clients from one or more certificate authorities, wherein said random numbers correspond to random numbers as initially accessed by the clients, so as for the clients to be able to regenerate the same one or more cryptographic objects as previously generated.
A computer program product for managing cryptographic objects, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by one or more processors that are concurrently performed at each client of a set of clients communicating with a respective hardware security module (HSM), to cause, at each client, to:
- access, by a first entity, an entropy-based random number generated by a second entity;
- instruct to store the random number on the first entity;
- and
- based on a deterministic algorithm:
- interact with the HSM to generate a seed according to both a reference key of the HSM and the random number, the reference key of the HSM being one of residing in or derived by the HSM, the random number being stored in the HSM;
- seed a random number generator with the generated seed to generate one or more post-quantum secure cryptographic objects that are trust anchored to the reference key of the HSM;
- at each client, use one or each of the one or more post-quantum secure cryptographic objects generated to perform a cryptographic operation;
- after using said one or each of the one or more post-quantum secure cryptographic objects generated to perform said cryptographic operation, delete said one or more of the cryptographic objects;
- and
- receive random numbers at the clients from one or more certificate authorities, wherein said random numbers correspond to random numbers as initially accessed by the clients, so as for the clients to be able to regenerate the same one or more cryptographic objects as previously generated.
Dependencies are inferred from the claim text.