Cryptographic key management

Patent metadata

Field	Value
Publication number	US-11101997-B2
Application number	US-201916458733-A
Country	US
Kind code	B2
Filing date	Jul 1, 2019
Priority date	Jul 1, 2019
Publication date	Aug 24, 2021
Grant date	Aug 24, 2021

Abstract

Cryptographic key provisioning by determining future cryptographic key demand according to historic key demand and key access requirements, determining cryptographic key provisioning resources for the future cryptographic key demand, and providing cryptographic keys, prior to the determined future cryptographic key demand using the cryptographic key provisioning resources.

First claim

What is claimed is:

1. A computer implemented method for cryptographic key provisioning, the method comprising:
determining future cryptographic key demand according to historic key demand and key access requirements;
determining cryptographic key provisioning resources for the future cryptographic key demand;
provisioning cryptographic keys having a defined life-cycle, according to a user location; and
providing cryptographic keys prior to the future cryptographic key demand using the cryptographic key provisioning resources.

2. The computer implemented method according to claim 1 , further comprising:
identifying non-compliant system activity associated with cryptographic key demand, wherein the non-compliant system activity is not associated with the future cryptographic key demand; and
refusing to provide a cryptographic key in response to the non-compliant system activity.

3. The computer implemented method according to claim 1 , further comprising:
provisioning cryptographic keys according to a ranking function.

4. The computer implemented method according to claim 3 , wherein the ranking function is selected from the group consisting of: active time of a requesting entity, number of requests by the entity, average key usage time, and compliance level of the entity.

5. The computer implemented method according to claim 1 , further comprising provisioning cryptographic keys according to a threshold limit.

6. The computer implemented method according to claim 5 , wherein the threshold limit is based at least in part on a factor selected from the group consisting of: an entity ranking, and a total number of entities.

7. A computer program product for cryptographic key provisioning, the computer program product comprising one or more computer readable storage devices and stored program instructions on the one or more computer readable storage devices, the stored program instructions comprising:
program instructions for determining future cryptographic key demand according to historic key demand and key access requirements;
program instructions for determining cryptographic key provisioning resources for the future cryptographic key demand;
program instructions for provisioning cryptographic keys having a defined life-cycle, according to a user location and
program instructions for providing cryptographic keys prior to the future cryptographic key demand using the cryptographic key provisioning resources.

8. The computer program product according to claim 7 , the stored program instructions further comprising:
program instructions for identifying a non-compliant system activity associated with cryptographic key demand, wherein the non-compliant system activity is not associated with the future cryptographic key demand; and
program instructions for refusing to provide a cryptographic key in response to the non-compliant system activity.

9. The computer program product according to claim 7 , the stored program instructions further comprising program instructions for provisioning cryptographic according to a ranking function.

10. The computer program product according to claim 9 , wherein the ranking function is selected from the group consisting of: active time of a requesting entity, number of requests by the entity, average key usage time, and compliance level of the entity.

11. The computer program product according to claim 7 , the stored program instructions further comprising program instructions for provisioning cryptographic keys according to a threshold limit.

12. The computer program product according to claim 11 , wherein the threshold limit is based at least in part upon a factor selected from the group consisting of: an entity ranking, and a total number of entities.

13. A computer system for cryptographic key provisioning, the computer system comprising:
one or more computer processors;
one or more computer readable storage devices; and
program instructions stored on the one or more computer readable storage devices for execution by the one or more computer processors, the stored program instructions comprising:
program instructions for determining future cryptographic key demand according to historic key demand and key access requirements;
program instructions for determining cryptographic key provisioning resources for the future cryptographic key demand;
program instructions for provisioning cryptographic keys having a defined life-cycle, according to a user location; and
program instructions for providing cryptographic keys prior to the future cryptographic key demand using the cryptographic key provisioning resources.

14. The computer system according to claim 13 , the stored program instructions further comprising:
program instructions for identifying a non-compliant system activity associated with cryptographic key demand, wherein the non-compliant system activity is not associated with the future cryptographic key demand; and
program instructions for refusing to provide a cryptographic key in response to the non-complaint system activity.

15. The computer system according to claim 13 , the stored program instructions further comprising program instructions for provisioning cryptographic according to a ranking function.

16. The computer system according to claim 15 , wherein the ranking function is selected from the group consisting of: active time of a requesting entity, number of requests by the entity, average key usage time, and compliance level of the entity.

17. The computer system according to claim 13 , the stored program instructions further comprising program instructions for provisioning cryptographic keys according to a threshold limit.

Assignees

• IBM

Inventors

• Valecha Vinod A
• Bansal Rinkesh I
• Panchal Sanjay B
• Thaker Chintan

Classifications

• H04L9/0894 Primary

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/0872

  using geo-location information, e.g. location data, time, relative position or proximity to other entities · CPC title

• H04L9/0861 Primary

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L9/088

  Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068) · CPC title