US 2022/0029790 A1 · SECRETS MANAGEMENT USING KEY AGREEMENT

Abstract

A client system may generate a new key pair for a secrets management process. The client may generate a shared secret using the private key of the new key pair and a public key of a secrets management server. Using the shared secret, the client may derive an encryption key and encrypt a data payload for subsequent decryption by the secrets management server. Upon encryption of the data payload, the client may erase the private key. Subsequently, the client or an associated client may call the secrets management server for decryption of the data payload. The secrets management server may derive the encryption key using the public key associated with the encrypted payload and the private key of the secrets management server and use the encryption key to decrypt the data payload for use by the client or an associated client.

Claims20

Dependent claims

A method for securing data, comprising:

generating, at a client, a key pair including a public key and a private key for securing a data payload by a secrets management server;
generating, at the client, a shared secret that is shared with the secrets management server using the private key and a public key associated with the secrets management server;
deriving an encryption key using the shared secret;
encrypting the data payload using the encryption key;
causing the encrypted data payload to be decrypted by the secrets management server, wherein the secrets management server is configured to derive the encryption key for decrypting the data payload using the shared secret;
and
erasing the private key from memory of the client in response to encrypting the data payload using the encryption key.

4 more elements

An apparatus for securing data, comprising:

a processor,
memory coupled with the processor;
and
instructions stored in the memory and executable by the processor to cause the apparatus to:
generate, at a client, a key pair including a public key and a private key for securing a data payload by a secrets management server;
generate, at the client, a shared secret that is shared with the secrets management server using the private key and a public key associated with the secrets management server;
derive an encryption key using the shared secret;
encrypt the data payload using the encryption key;
cause the encrypted data payload to be decrypted by the secrets management server, wherein the secrets management server is configured to derive the encryption key for decrypting the data payload using the shared secret;
and
erase the private key from memory of the client in response to encrypting the data payload using the encryption key.

8 more elements

A non-transitory computer-readable medium storing code for securing data, the code comprising instructions executable by a processor to:

generate, at a client, a key pair including a public key and a private key for securing a data payload by the secrets management server;
generate, at the client, a shared secret that is shared with the secrets management server using the private key and a public key associated with the secrets management server;
derive an encryption key using the shared secret;
encrypt the data payload using the encryption key;
cause the encrypted data payload to be decrypted by the secrets management server, wherein the secrets management server is configured to derive the encryption key for decrypting the data payload using the shared secret;
and
erase the private key from memory of the client in response to encrypting the data payload using the encryption key.

4 more elements

Dependencies are inferred from the claim text.

Secrets management using key agreement

Life of this patent

Secrets management using key agreement

Life of this patent

Abstract

Claims20