US 2019/0297064 A1Published application

Key identifiers in an obliviousness pseudorandom function (oprf)-based key management service (kms)

AssigneeInternational Business Machines Corporation

InventorsJason K. Resch, Hugo M. Krawczyk, Mark D. Seaborn, Nataraj Nagaratnam, Erlander Lo

Life of this patent

Estimating the term…

Loading patent…

Abstract

A computing device includes an interface configured to interface and communicate with a communication system, a memory that stores operational instructions, and processing circuitry operably coupled to the interface and to the memory that is configured to execute the operational instructions to perform various operations. The computing device generates a sub-key identifier based on a data ID, which is based on unique ID value(s) associated with an encrypted data object, and a requester secret. The computing device processes the sub-key identifier in accordance with an Oblivious Pseudorandom Function (OPRF) blinding operation to generate a blinded input and an Oblivious Key Access Request (OKAR). The computing device transmits the OKAR to another computing device (e.g., Key Management System (KMS) service) and receives a blinded sub-key therefrom. The computing device processes the blinded sub-key in accordance with an OPRF unblinding operation to generate the key and accesses secure data thereby.

Claims20

Dependent claims

A computing device comprising:

an interface configured to interface and communicate with a communication system;
memory that stores operational instructions;
and
processing circuitry operably coupled to the interface and to the memory, wherein the processing circuitry is configured to execute the operational instructions to:
generate a data identifier (ID) based at least one unique ID value associated with an encrypted data object that is encrypted based on a key;
generate a sub-key ID based on the data ID and a requester secret;
process the sub-key ID based on a blinding key in accordance with an Oblivious Pseudorandom Function (OPRF) blinding operation to generate a blinded input;
generate an Oblivious Key Access Request (OKAR) based on the blinded input;
transmit, via the communication system, the OKAR to another computing device that is associated with a Key Management System (KMS) service;
receive, via the communication system and from the another computing device that is associated with the KMS service, a blinded sub-key, wherein the blinded sub-key is based on processing of the OKAR based on an Oblivious Pseudorandom Function (OPRF) using an OPRF secret;
process the blinded sub-key based on the blinding key in accordance with an OPRF unblinding operation to generate the key that is associated with the encrypted data object;
and
access secure information based on the key.

10 more elements

A computing device comprising:

an interface configured to interface and communicate with a communication system;
memory that stores operational instructions;
and
processing circuitry operably coupled to the interface and to the memory, wherein the processing circuitry is configured to execute the operational instructions to:
generate a data identifier (ID) based at least one unique ID value associated with an encrypted data object that is encrypted based on a key;
generate a sub-key ID based on the data ID and a requester secret;
process the sub-key ID based on a blinding key in accordance with an Oblivious Pseudorandom Function (OPRF) blinding operation to generate a blinded input;
generate an Oblivious Key Access Request (OKAR) based on the blinded input, an OPRF key ID (OKI) that specifies an Oblivious Pseudorandom Function (OPRF) secret of a plurality of OPRF secrets of a Key Management System (KMS) service, and a challenge to be used by the KMS service to verify at least one of identity of the KMS service or correctness of operation of the KMS service;
transmit, via the communication system, the OKAR to another computing device that is associated with the KMS service;
receive, via the communication system and from the another computing device that is associated with the KMS service, a blinded sub-key and a response to the challenge, wherein the blinded sub-key is based on processing of the OKAR based on the OPRF using the OPRF secret that is specified in the OKAR;
determine whether the response to the challenge compares favorably to the challenge;
based on a determination that the response to the challenge compares favorably to the challenge, process the blinded sub-key based on the blinding key in accordance with an OPRF unblinding operation to generate the key that is associated with the encrypted data object;
and
access secure information based on the key.

11 more elements

A method for execution by a computing device, the method comprising:

generating a data identifier (ID) based at least one unique ID value associated with an encrypted data object that is encrypted based on a key;
generating a sub-key ID based on the data ID and a requester secret;
processing the sub-key is based on a blinding key in accordance with an Oblivious Pseudorandom Function (OPRF) blinding operation to generate a blinded input;
generating an Oblivious Key Access Request (OKAR) based on the blinded input;
transmitting, via an interface configured to interface and communicate with a communication system and via the communication system, the OKAR to another computing device that is associated with a Key Management System (KMS) service;
receiving, via the interface and via the communication system and from the another computing device that is associated with the KMS service, a blinded sub-key, wherein the blinded sub-key is based on processing of the OKAR based on an Oblivious Pseudorandom Function (OPRF) using an OPRF secret;
processing the blinded sub-key based on the blinding key in accordance with an OPRF unblinding operation to generate the key that is associated with the encrypted data object;
and
accessing secure information based on the key.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/926,883Filed 20 Mar 2018
Published: 26 Sep 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification9 codes

H04L 9/008
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: involving homomorphic…
H04L 63/06
Network architectures or network communication protocols for network security: for supporting key management in a packet data network
H04L 9/0656
Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3: pseudorandom key sequence…
H04L 9/0869
Generation of secret information including derivation or calculation of cryptographic keys or passwords: involving random numbers or seeds