Extending credential type to group Key Management Interoperability Protocol (KMIP) clients
AssigneeInternational Business Machines Corporation
InventorsBruce Arland Rich, John Thomas Peck, Gordon Kent Arnold
Life of this patent
Estimating the term…
Abstract
A key management protocol (such as KMIP) is extended to provide an extended credential type to pass information from clients to the server to enable the server to deduce pre-provisioned cryptographic materials for the individual clients. Preferably, KMIP client code communicates device information to a key management server in a value in the headers of KMIP requests that flow to the server. In this manner, KMIP requests are associated with pre-provisioned cryptographic materials for particular devices or device groups.
Claims25
A method operative in association with a key management server for processing device type information in a certificate authentication process, comprising:
- receiving a client request for key material, the client request including a client-side certificate, and a custom credential distinct from the client-side certificate and that encodes, as a data string, data identifying a device identifier unique within the key management server, and a device type;
- using the client-side certificate to authenticate the client;
- using the device identifier in the custom credential to attempt to identify the client, and using the device type to determine whether key material for the client has been provisioned;
- and
- serving the key material to the client when, based on the custom credential, the client has been identified by the device identifier and the key material for the client has been provisioned;
- wherein at least of the receiving, using and serving steps is carried out in software executing in a hardware element.
Apparatus associated with a key management server, comprising:
- a processor;
- computer memory holding computer program instructions that when executed by the processor perform a method comprising:
- receiving a client request for key material, the client request including a client-side certificate, and a custom credential distinct from the client-side certificate and that encodes, as a data string, data identifying a device identifier unique within the key management server, and a device type;
- using the client-side certificate to authenticate the client;
- using the device identifier in the custom credential to attempt to identify the client, and using the device type to determine whether key material for the client has been provisioned;
- and
- serving the key material to the client when, based on the custom credential, the client has been identified by the device identifier and the key material for the client has been provisioned.
A computer program product in a non-transitory computer readable medium for use in a data processing system associated with a key management server, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method comprising:
- receiving a client request for key material, the client request including a client-side certificate, and a custom credential distinct from the client-side certificate and that encodes, as a data string, data identifying a device identifier unique within the key management server, and a device type;
- using the client-side certificate to authenticate the client;
- using the device identifier in the custom credential to attempt to identify the client, and using the device type to determine whether key material for the client has been provisioned;
- and
- serving the key material to the client when, based on the custom credential, the client has been identified by the device identifier and the key material for the client has been provisioned.
Dependencies are inferred from the claim text.