Systems and methods for detecting exposure of private keys
AssigneeSap SE
InventorUdo Klein
Life of this patent
Estimating the term…
Abstract
A system and method can include comparing entities associated with public certificates and private keys in a keystore to detect compromised private keys. This increases security of systems implementing public key cryptography over a network. The comparison can be triggered by a trigger event in one embodiment. If a private key belonging to a certificate authority is detected, a notification can be generated. Alternatively or in addition, a revocation request can be generated for public certificates corresponding to the compromised private key.
Claims20
A computer-implemented method for detecting compromised private keys, the method comprising:
- identifying, in a keystore of a computer device, a first identity corresponding to a public certificate associated with a certificate authority;
- identifying a second identity corresponding to a private key associated with a certificate authority in the keystore;
- determining if a match exists by comparing the first identity to the second identity;
- and
- generating, if the match exists, a notification that the private key has been compromised.
A tangible non-transitory computer-readable storage medium comprising instructions stored thereon for execution by a processor, the instructions causing the processor to perform a method comprising:
- retrieving at least one exempt identity from an exempt identity table;
- identifying, in a keystore of a computer device, at least a second identity corresponding to at least one private key associated with a certificate authority;
- comparing the at least one exempt identity to the second identity to determine if a match exists;
- and
- generating, if a match does not exist, a notification.
A system for detecting a compromised private key, the system comprising:
- a memory containing a first keystore;
- and
- a processor operatively coupled to the memory,
- wherein the processor performs stages including:
- identifying, in the first keystore, at least a first entity associated with at least one public certificate associated with a certificate authority;
- identifying at least a second entity corresponding to at least one private key associated with a certificate authority in the first keystore;
- comparing at least the first entity to the second entity to determine if a match exists;
- and
- generating, if a match exists, a notification.
Dependencies are inferred from the claim text.