Method and apparatus for provisioning node-locking confidential data
AssigneeARRIS Enterprises LLC
InventorsTat Keung CHAN, Alexander MEDVINSKY, Rafie SHAMSAASEF, Fariba BAREZ
Life of this patent
Estimating the term…
Abstract
A system and method for provisioning confidential data such as unique credentials is described. The technique initializes a whitebox cryptographic software module to a particular PKI client to soft-lock whitebox cryptographic operations to the particular PKI client and uniquely encrypting the credentials with a node-locking key (NLK) derivable from a digital certificate.
Claims14
A method of performing a cryptographic operation in a PKI client, a whitebox implementation, the method comprising:
- receiving an encoded global encryption key, a public key infrastructure (PKI) client-unique private key encrypted according to the global encryption key, and a digital certificate cryptographically associated with the private key;
- decrypting the encrypted private key according to the encoded global encryption key using a global whitebox decryptor;
- deriving node locking information from the digital certificate;
- uniquely re-encrypting the private key according to the node locking information by a locked whitebox encryptor locked to the PKI client according to a PKI client-unique ID;
- re-deriving the node locking information from the digital certificate;
- decrypting the re-encrypted private key according to the re-derived node locking information by a locked whitebox decryptor locked to the PKI client according to the PKI client-unique ID;
- and
- performing the cryptographic operation according to the decrypted private key.
A method of securely providing a PKI-client unique private key for performing a cryptographic operation, comprising:
- encrypting the private key according to a global encryption key Gk;
- encoding the global encryption key Gk;
- and
- providing the encoded global encryption key Gk and the globally encrypted private key to a PKI client for decryption by a global whitebox decryptor executing on the PKI client, re-encryption by a locked whitebox encryptor executing on the PKI client and locked to the PKI client before storage, and decryption by a locked whitebox decryptor executing on the PKI client and locked to the PKI client before retrieval and use of the private key to perform the cryptographic operation.
14-20. (canceled)
Dependencies are inferred from the claim text.