Decentrialized key management system and method

Patent metadata

Field	Value
Publication number	US-2021359866-A1
Application number	US-202016885480-A
Country	US
Kind code	A1
Filing date	May 28, 2020
Priority date	May 15, 2020
Publication date	Nov 18, 2021
Grant date	—

Abstract

A decentralized key management system according to an embodiment of the present disclosure includes a bootstrap for generating a key and obtaining a certificate corresponding to the generated key, a memory for receiving the key and the certificate from the bootstrap and storing the key and the certificate, a container, in response to a mount command of the bootstrap, for reading the key and the certificate from the memory and being mounted with the key and the certificate, and a controller for generating the bootstrap, and deleting the bootstrap after the container mounts the key and the certificate.

First claim

1 : A decentralized key management system comprising:
a bootstrap for generating a key and obtaining a certificate corresponding to the generated key; a memory for receiving the key and the certificate from the bootstrap and storing the key and the certificate; a container, in response to a mount command of the bootstrap, for reading the key and the certificate from the memory and being mounted with the key and the certificate; and a controller for generating the bootstrap, and deleting the bootstrap after the container mounts the key and the certificate.

2 : The decentralized key management system of claim 1 , further comprising:
a storage for receiving the key and the certificate from the bootstrap and storing the key and the certificate.

3 : The decentralized key management system of claim 2 , wherein the memory and the storage are accessible only through the bootstrap except when the container reads the key and the certificate from the memory.

4 : The decentralized key management system of claim 2 , wherein the bootstrap encrypts the key, and provides the encrypted key to the storage, and provides the key without the encryption to the memory.

5 : The decentralized key management system of claim 2 , wherein the controller regenerates the bootstrap to restore at least one of the key and the certificate when the at least one of the key and the certificate stored in the memory is deleted.

6 : The decentralized key management system of claim 5 , wherein the regenerated bootstrap reads the at least one of the key and the certificate from the storage and stores again the at least one of the key and the certificate in the memory; and
the container, in response to a mount command of the regenerated bootstrap, reads and mounts the at least one of the key and the certificate stored again in the memory.

7 : The decentralized key management system of claim 6 , wherein the controller deletes the regenerated bootstrap after the container mounts the at least one of the key and the certificate stored again in the memory.

8 : The decentralized key management system of claim 1 , wherein the controller, in response to a node generating request from a client device, generates the bootstrap; and
the container configures a node of a blockchain network and performs authentication of the node using the mounted key and certificate.

9 : The decentralized key management system of claim 8 , further comprising,
a storage for receiving the key and the certificate from the bootstrap and storing the key and the certificate, wherein the controller regenerates the bootstrap if there is a request to restore a node from a client device after deleting the bootstrap; the regenerated bootstrap reads the key and the certificate from the storage and stores again the key and the certificate in the memory; and the container, in response to a mount command of the regenerated bootstrap, reads the key and the certificate stored again in the memory and is remounted with the key and the certificate, and restores the node using the re-mounted key and the certificate.

10 : The decentralized key management system of claim 9 , wherein the controller deletes the regenerated bootstrap after the container restores the node.

11 : The decentralized key management system of claim 1 , wherein the bootstrap generates a pair of asymmetric encryption keys, and obtains the certificate from a certificate issuer using a public key of the pair of asymmetric encryption keys; and
the key is a private key among the pair of asymmetric encryption keys.

12 : A decentralized key management method performed by a computing device, comprising:
generating a bootstrap; generating a key using the bootstrap and obtaining a certificate corresponding to the generated key; storing the key and the certificate in a memory; mounting the key and the certificate stored in the memory to a container; and deleting the bootstrap after mounting the key and the certificate.

13 : The decentralized key management method of claim 12 , further comprising:
regenerating the bootstrap in response to a request to restore at least one of the key and certificate; reading the key and the certificate stored in a storage using the regenerated bootstrap and storing again the key and the certificate in the memory; re-mounting the key and the certificate stored again in the memory to the container; and deleting the regenerated bootstrap after mounting again the key and the certificate.

14 : A computer program for driving a decentralized key management system, the computer program comprising computer-executable code embodied on a computer readable recording medium for executing steps comprising:
generating a bootstrap; generating a key using the bootstrap, and obtaining a certificate corresponding to the generated key; storing the key and the certificate in a memory; mounting the key and the certificate stored in the memory to a container; and deleting the bootstrap after mounting the key and the certificate.

15 : The computer program of claim 14 , wherein the bootstrap is generated in response to a node generating request from a client device; and
the steps further comprises configuring a node of a blockchain network and performs authentication of the node using the mounted key and certificate.

16 : The computer program of claim 14 , wherein the steps further comprises:
storing the key and the certificate in a storage, regenerating the bootstrap if there is a request to restore a node from a client device after deleting the bootstrap; reading, with the regenerated bootstrap, the key and the certificate from the storage and storing again the key and the certificate in the memory; and in response to a mount command of the regenerated bootstrap, reading the key and the certificate stored again in the memory and remounting the key and the certificate on the container, and restoring the node using the re-mounted key and the certificate.

17 : The decentralized key management method of claim 12 , wherein the bootstrap is generated in response to a node generating request from a client device; and
the decentralized key management method further comprises configuring a node of a blockchain network and performs authentication of the node using the mounted key and certificate.

18 : The decentralized key management method of claim 12 , further comprising:
storing the key and the certificate in a storage, regenerating the bootstrap if there is a request to restore a node from a client device after deleting the bootstrap; reading, with the regenerated bootstrap, the key and the certificate from the storage and storing again the key and the certificate in the memory; and in response to a mount command of the regenerated bootstrap, reading the key and the certificate stored again in the memory and remounting the key and the certificate on the container, and restoring the node using the re-mounted key and the certificate.

Assignees

• Samsung Sds Co Ltd

Inventors

• Lee Hyo Jung
• Yoon Chang Suk
• Cho Jung Woo
• Kwon Young Woon
• Lee Kwang Cheol

Classifications

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L9/3263 Primary

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L9/0877

  using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM] · CPC title