Cryptographic key generation and storage

Patent metadata

Field	Value
Publication number	US-11451387-B2
Application number	US-201917250089-A
Country	US
Kind code	B2
Filing date	May 2, 2019
Priority date	May 24, 2018
Publication date	Sep 20, 2022
Grant date	Sep 20, 2022

Abstract

A computer implemented method of generating cryptographic keys for a plurality of hardware security modules (HSMs), the method including generating a plurality of cryptographic keys for use by the HSMs in providing cryptography functions, wherein the cryptographic keys are generated based on numerical data generated by a hardware random number generator; and storing the generated cryptographic keys in a secure key store, such that a key in the key store utilized by an HSM is flagged as utilized to prevent other HSMs utilizing the same key, so as to provide a rate of generation and storage of the cryptographic keys unconstrained by the resources of any HSM.

First claim

The invention claimed is:

1. A computer implemented method of generating cryptographic keys for a plurality of hardware security modules (HSMs), the method comprising:
generating a plurality of cryptographic keys for use by the plurality of HSMs in providing cryptography functions, wherein the plurality of cryptographic keys are generated based on numerical data generated by a hardware random number generator; and
storing the generated plurality of cryptographic keys in a secure key store, such that a key in the secure key store utilized by an HSM is flagged as utilized to prevent other HSMs from utilizing the same key, so as to provide a rate of generation and storage of the cryptographic keys unconstrained by resources of any HSM, wherein a key in the key store is utilized by a consuming HSM by storing the key in the consuming HSM at times when the HSM is operating in a low utilization state relative to an average utilization state of the HSM.

2. The method of claim 1 , wherein the storing is achieved by invoking a storage function of the HSM, and the key is flagged as utilized when the key is so stored in the consuming HSM.

3. The method of claim 1 , wherein the hardware random number generator operates based on a statistically random entropy data source originating from natural phenomena.

4. The method of claim 3 , wherein the natural phenomena include one or more of: one or more statistically random noise signals; or quantum phenomena.

5. The method of claim 4 , wherein the quantum phenomena are photoelectric effects.

6. A computer system comprising:
a processor and memory storing computer program code for generating cryptographic keys for a plurality of hardware security modules (HSMs) by:
generating a plurality of cryptographic keys for use by the plurality of HSMs in providing cryptography functions, wherein the plurality of cryptographic keys are generated based on numerical data generated by a hardware random number generator; and
storing the generated plurality of cryptographic keys in a secure key store, such that a key in the secure key store utilized by an HSM is flagged as utilized to prevent other HSMs from utilizing the same key, so as to provide a rate of generation and storage of the cryptographic keys unconstrained by resources of any HSM, wherein a key in the key store is utilized by a consuming HSM by storing the key in the consuming HSM at times when the HSM is operating in a low utilization state relative to an average utilization state of the HSM.

7. A non-transitory computer-readable storage medium storing a computer program element comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer system to perform the method as claimed in claim 1 .

Assignees

• British Telecommunicatiosn Plc
• British Telecomm

Inventors

• Daniel Joshua
• Sajjad Ali

Classifications

• H04L9/0869 Primary

  involving random numbers or seeds · CPC title

• G06F7/588

  Random number generators, i.e. based on natural stochastic processes · CPC title

• H04L9/0877 Primary

  using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM] · CPC title

• H04L9/0897

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title