Structure of policies for evaluating key attributes of encryption keys
AssigneeFornetix LLC
InventorsStephen Edwards, Gary C. Gardner, Charles White
Life of this patent
Estimating the term…
Abstract
Examples described herein relate to apparatuses and methods for evaluating an encryption key based on policies for a policy operation, including, but not limited to, receiving user request for the policy operation, determining one or more of a node, group, client, or user associated with the user request, determining the policies associated with the one or more of the node, group, client, or user based on priority, and evaluating at least one key attribute of an encryption key based, at least in part, on the policies.
Claims22
A method for evaluating a security object based on policies for a policy operation, the method comprising:
- receiving, by a management request handler of a security object orchestration system, a user request for the policy operation;
- determining, by the management request handler, a plurality of policies associated with one or more of a node, a group, a client, or a user associated with the user request, where the determined plurality of policies associated with the one or more of the node, the group, the client, or the user, include at least two conflicting policies;
- determining, by the management request handler, whether one of the at least two conflicting policies has a narrower scope than the other policy of the at least two conflicting policies;
- and
- evaluating, by the management request handler, whether a cryptographic attribute of the security object is secure based, at least in part, on:
- the one of the at least two conflicting policies upon determining that the one of the at least two conflicting policies has the narrower scope than the other policy of the at least two conflicting policies, or
- each of the at least two conflicting policies upon determining that none of the at least two conflicting policies has the narrower scope than the other policy of the at least two conflicting policies;
- and
- distributing the security object to a device in response to determining that the cryptographic attribute of the security object is secure based on the evaluation by the management request handler, wherein the security object is used to encrypt data.
A key orchestration system for evaluating a security object based on policies for a policy operation, the system comprising:
- a memory;
- and
- a processor configured to:
- receive a user request for the policy operation;
- determine a plurality of policies associated with one or more of a node, a group, a client, or a user associated with the user request, where the determined plurality of policies associated with the one or more of the node, the group, the client, or the user, include at least two conflicting policies;
- determine whether one of the at least two conflicting policies has a narrower scope than the other policy of the at least two conflicting policies;
- and
- evaluate whether a cryptographic attribute of the security object is secure based, at least in part, on:
- the one of the at least two conflicting policies upon determining that the one of the at least two conflicting policies has the narrower scope than the other policy of the at least two conflicting policies, or
- each of the at least two conflicting policies upon determining that none of the at least two conflicting policies has the narrower scope than the other policy of the at least two conflicting policies;
- and
- distributing the security object to a device in response to determining that the cryptographic attribute of the security object is secure based on the evaluation by the processor, wherein the security object is used to encrypt data.
A non-transitory computer-readable medium of a management request handler of a key orchestration system comprising computer-readable instructions such that, when executed, causes a processor to:
- receive a user request for a policy operation;
- determine a plurality of policies associated with one or more of a node, a group, a client, or a user associated with the user request, where the determined plurality of policies associated with the one or more of the node, the group, the client, or the user, include at least two conflicting policies;
- determine whether one of the at least two conflicting policies has a narrower scope than the other policy of the at least two conflicting policies;
- and
- evaluate whether a cryptographic attribute of a security object is secure based, at least in part, on:
- the one of the at least two conflicting policies upon determining that the one of the at least two conflicting policies has the narrower scope than the other policy of the at least two conflicting policies, or
- each of the at least two conflicting policies upon determining that none of the at least two conflicting policies has the narrower scope than the other policy of the at least two conflicting policies;
- and
- distributing the security object to a device in response to determining that the cryptographic attribute of the security object is secure based on the evaluation by the processor, wherein the security object is used to encrypt data.
Dependencies are inferred from the claim text.