Secrets management using key agreement

Patent metadata

Field	Value
Publication number	US-11265156-B2
Application number	US-202016938715-A
Country	US
Kind code	B2
Filing date	Jul 24, 2020
Priority date	Jul 24, 2020
Publication date	Mar 1, 2022
Grant date	Mar 1, 2022

Abstract

A client system may generate a new key pair for a secrets management process. The client may generate a shared secret using the private key of the new key pair and a public key of a secrets management server. Using the shared secret, the client may derive an encryption key and encrypt a data payload for subsequent decryption by the secrets management server. Upon encryption of the data payload, the client may erase the private key. Subsequently, the client or an associated client may call the secrets management server for decryption of the data payload. The secrets management server may derive the encryption key using the public key associated with the encrypted payload and the private key of the secrets management server and use the encryption key to decrypt the data payload for use by the client or an associated client.

First claim

What is claimed is:

1. A method for securing data, comprising:
generating, at a client, a key pair including a public key and a private key for securing a data payload by a secrets management server;
generating, at the client, a shared secret that is shared with the secrets management server using the private key and a public key associated with the secrets management server;
deriving an encryption key using the shared secret;
encrypting the data payload using the encryption key;
causing the encrypted data payload to be decrypted by the secrets management server, wherein the secrets management server is configured to derive the encryption key for decrypting the data payload using the shared secret; and
erasing the private key from memory of the client in response to encrypting the data payload using the encryption key.

2. The method of claim 1 , further comprising:
generating a new key pair for each secret of a plurality of secrets; and
erasing, in response to generating a new shared secret for each secret, each respective private key of the new key pair for each secret of the plurality of secrets, the erasing resulting in the respective private key being a one-time use key.

3. The method of claim 2 , further comprising:
generating the new shared secret with each respective private key and the public key associated with the secrets management server before each respective private key is erased; and
deriving a new encryption key for the new shared secret for each secret of the plurality of secrets, wherein a respective data payload for a respective secret is encrypted using the new encryption key.

4. The method of claim 1 , further comprising:
receiving, at the client and from a user device, a request to perform secret management of the data payload, wherein the encrypted data payload is encrypted based at least in part on receiving the request.

5. The method of claim 1 , wherein generating the shared secret comprises:
generating the shared secret using an Elliptic-Curve Diffie-Hellman (ECDH) protocol, wherein the ECDH protocol uses the public key associated with the secrets management server and the private key to derive the shared secret at the client and uses a private key associated with the public key of the secrets management server and the public key of the client to derive the shared secret at the secrets management server.

6. The method of claim 1 , wherein generating the key pair comprises:
generating an elliptic curve key pair using elliptic curve key derivation techniques.

7. The method of claim 1 , wherein deriving the encryption key comprises:
deriving the encryption key using a key derivation function that uses the shared secret as an input.

8. The method of claim 1 , wherein encrypting the data payload using the encryption key comprises:
encrypting the data payload using an advanced encryption standard (AES), a Galois/Counter Mode (GCM) protocol, or a combination thereof.

9. An apparatus for securing data, comprising:
a processor,
memory coupled with the processor; and
instructions stored in the memory and executable by the processor to cause the apparatus to:
generate, at a client, a key pair including a public key and a private key for securing a data payload by a secrets management server;
generate, at the client, a shared secret that is shared with the secrets management server using the private key and a public key associated with the secrets management server;
derive an encryption key using the shared secret;
encrypt the data payload using the encryption key;
cause the encrypted data payload to be decrypted by the secrets management server, wherein the secrets management server is configured to derive the encryption key for decrypting the data payload using the shared secret; and
erase the private key from memory of the client in response to encrypting the data payload using the encryption key.

10. The apparatus of claim 9 , wherein the instructions are further executable by the processor to cause the apparatus to:
generate a new key pair for each secret of a plurality of secrets; and
erase, in response to generating a new shared secret for each secret, each respective private key of the new key pair for each secret of the plurality of secrets, the erasing resulting in the each respective private key being a one-time use key.

11. The apparatus of claim 10 , wherein the instructions are further executable by the processor to cause the apparatus to:
generate the new shared secret with each respective private key and the public key associated with the secrets management server before each respective private key is erased; and
derive a new encryption key for the new shared secret for each secret of the plurality of secrets, wherein a respective data payload for a respective secret is encrypted using the new encryption key.

12. The apparatus of claim 9 , wherein the instructions are further executable by the processor to cause the apparatus to:
receive, at the client and from a user device, a request to perform secret management of the data payload, wherein the encrypted data payload is encrypted based at least in part on receiving the request.

13. The apparatus of claim 9 , wherein the instructions to generate the shared secret are executable by the processor to cause the apparatus to:
generate the shared secret using an Elliptic-Curve Diffie-Hellman (ECDH) protocol, wherein the ECDH protocol uses the public key associated with the secrets management server and the private key to derive the shared secret at the client and uses a private key associated with the public key of the secrets management server and the public key of the client to derive the shared secret at the secrets management server.

14. The apparatus of claim 9 , wherein the instructions to generate the key pair are executable by the processor to cause the apparatus to:
generate an elliptic curve key pair using elliptic curve key derivation techniques.

15. A non-transitory computer-readable medium storing code for securing data, the code comprising instructions executable by a processor to:
generate, at a client, a key pair including a public key and a private key for securing a data payload by a secrets management server;
generate, at the client, a shared secret that is shared with the secrets management server using the private key and a public key associated with the secrets management server;
derive an encryption key using the shared secret;
encrypt the data payload using the encryption key;
cause the encrypted data payload to be decrypted by the secrets management server, wherein the secrets management server is configured to derive the encryption key for decrypting the data payload using the shared secret; and
erase the private key from memory of the client in response to encrypting the data payload using the encryption key.

16. The non-transitory computer-readable medium of claim 15 , wherein the instructions are further executable to:
generate a new key pair for each secret of a plurality of secrets; and
erase, in response to generating a new shared secret for each secret, each respective private key of the new key pair for each secret of the plurality of secrets, the erasing resulting in the respective private key being a one-time use key.

17. The non-transitory computer-readable medium of claim 16 , wherein the instructions are further executable to:
generate the new shared secret with each respective private key and the public key associated with the secrets management server before each respective private key is erased;

Assignees

• Salesforce Com Inc

Inventors

• Peddada Prasad
• Elgamal Taher
• Johnson Aaron Marcus

Classifications

• H04L9/3066

  involving algebraic varieties, e.g. elliptic or hyper-elliptic curves · CPC title

• H04L9/0637

  Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM] · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L9/0841 Primary

  involving Diffie-Hellman or related key agreement protocols · CPC title