Traceable key block-chain ledger

Patent metadata

Field	Value
Publication number	US-11956357-B2
Application number	US-202318219144-A
Country	US
Kind code	B2
Filing date	Jul 7, 2023
Priority date	Dec 29, 2017
Publication date	Apr 9, 2024
Grant date	Apr 9, 2024

Abstract

Techniques are shown for key management using a traceable key blockchain. A first block corresponding to a cryptographic key is generated on the blockchain, and the first block is securely modified to include metadata describing a key source for the cryptographic key. A second block corresponding to a first key transaction with the cryptographic key is generated on the blockchain, the second block is linked to the first block, and the second block is securely modified to include metadata describing the first key transaction with the cryptographic key.

First claim

What is claimed is:

1. A computer-implemented method comprising:
generating a first block on a blockchain, the first block corresponding to a cryptographic key;
securely modifying the first block to include metadata describing a key source for the cryptographic key;
generating a second block on the blockchain, the second block corresponding to a first key transaction with the cryptographic key;
linking the second block to the first block; and
securely modifying the second block to include metadata describing the first key transaction with the cryptographic key.

2. The computer-implemented method of claim 1 , wherein securely modifying the second block comprises modifying the second block using at least one of a blockchain emend and amend functionality to include metadata describing the first key transaction with the cryptographic key.

3. The computer-implemented method of claim 1 , the method further comprising:
detecting an attack on data or a system associated with the cryptographic key;
using metadata of one or more blocks in the blockchain to trace the cryptographic key to a point of attack;
determining a block corresponding to the point of attack; and
generating an alert indicating the point of attack with metadata from the block corresponding to the point of attack.

4. The computer-implemented method of claim 1 , wherein the first key transaction with the cryptographic key comprises rotating the cryptographic key; and wherein the metadata describing the first key transaction comprises metadata describing rotation of the cryptographic key.

5. The computer-implemented method of claim 1 , wherein the metadata describing the first key transaction includes one or more selected from the following: data the cryptographic key was applied to; an operation performed on the cryptographic key; a library utilizing the cryptographic key; a machine where an operation was performed on the cryptographic key; and a machine where the cryptographic key resides.

6. The computer-implemented method of claim 1 , the method further comprising:
generating a third block on the blockchain, the third block corresponding to a second key transaction with the cryptographic key;
linking the third block to the second block; and
securely modifying the third block to include metadata describing the second key transaction with the cryptographic key.

7. The computer-implemented method of claim 1 , the method further comprising:
broadcasting the second block to a plurality of nodes, causing a validation solution for the second block to computed in one of the plurality of nodes; and
broadcasting the validation solution for the second block to at least one other of the plurality of nodes to validate the second block on the blockchain.

8. A system comprising:
one or more processors; and
one or more memory devices in communication with the one or more processors, the one or more memory devices having computer-readable instructions stored thereupon that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
generating a first block on a blockchain, the first block corresponding to a cryptographic key;
securely modifying the first block to include metadata describing a key source for the cryptographic key;
generating a second block on the blockchain, the second block corresponding to a first key transaction with the cryptographic key;
linking the second block to the first block; and
securely modifying the second block to include metadata describing the first key transaction with the cryptographic key.

9. The system of claim 8 , wherein securely modifying the second block comprises modifying the second block using at least one of a blockchain emend and amend functionality to include metadata describing the first key transaction with the cryptographic key.

10. The system of claim 8 , wherein the operations further comprise:
detecting an attack on data or a system associated with the cryptographic key;
using metadata of one or more blocks in the blockchain to trace the cryptographic key to a point of attack;
determining a block corresponding to the point of attack; and
generating an alert indicating the point of attack with metadata from the block corresponding to the point of attack.

11. The system of claim 8 , wherein the first key transaction with the cryptographic key comprises rotating the cryptographic key; and wherein the metadata describing the first key transaction comprises metadata describing rotation of the cryptographic key.

12. The system of claim 8 , wherein the metadata describing the first key transaction includes one or more selected from the following: data the cryptographic key was applied to; an operation performed on the cryptographic key; a library utilizing the cryptographic key; a machine where an operation was performed on the cryptographic key; and a machine where the cryptographic key resides.

13. The system of claim 8 , wherein the operations further comprise:
generating a third block on the blockchain, the third block corresponding to a second key transaction with the cryptographic key;
linking the third block to the second block; and
securely modifying the third block to include metadata describing the second key transaction with the cryptographic key.

14. The system of claim 8 , wherein the operations further comprise:
broadcasting the second block to a plurality of nodes, causing a validation solution for the second block to computed in one of the plurality of nodes; and
broadcasting the validation solution for the second block to at least one other of the plurality of nodes to validate the second block on the blockchain.

15. One or more non-transitory computer storage media having computer executable instructions stored thereon that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
generating a first block on a blockchain, the first block corresponding to a cryptographic key;
securely modifying the first block to include metadata describing a key source for the cryptographic key;
generating a second block on the blockchain, the second block corresponding to a first key transaction with the cryptographic key;
linking the second block to the first block; and
securely modifying the second block to include metadata describing the first key transaction with the cryptographic key.

16. The one or more non-transitory computer storage media of claim 15 , wherein securely modifying the second block comprises modifying the second block using at least one of a blockchain emend and amend functionality to include metadata describing the first key transaction with the cryptographic key.

17. The one or more non-transitory computer storage media of claim 15 , wherein the operations further comprise:
detecting an attack on data or a system associated with the cryptographic key;
using metadata of one or more blocks in the blockchain to trace the cryptographic key to a point of attack;
determining a block corresponding to the point of attack; and
generating an alert indicating the point of attack with metadata from the block corresponding to the point of attack.

18. The one or more non-transitory computer storage media of claim 15 , wherein the first key transaction with the cryptographic key comprises rotating the cryptographic key; and wherein the metadata describing the first key transaction comprises metadata describing rotation of the cryptographic key.

19. The one or more non-transitory

Assignees

• Ebay Inc

Inventors

• Chan Michael J T
• Embry Sean R
• Chamorro Derek A
• Kaul Anuj
• Chadha Sahil
• Firke Nikhil

Classifications

• H04L9/0863

  involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067) · CPC title

• H04L9/50 Primary

  using hash chains, e.g. blockchains or hash trees · CPC title

• H04L9/0894 Primary

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• G06F21/64 Primary

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• H04L9/002

  Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441) · CPC title