Hybrid cryptographic key derivation

Patent metadata

Field	Value
Publication number	US-9798677-B2
Application number	US-201414521953-A
Country	US
Kind code	B2
Filing date	Oct 23, 2014
Priority date	Oct 23, 2014
Publication date	Oct 24, 2017
Grant date	Oct 24, 2017

Abstract

Cryptographic key management and usage is accomplished by employing a hybrid symmetric/asymmetric security context wherein seed values are associated with randomly generated cryptographic keys. A security context environment is maintained wherein cryptographic keys are reliably reproduced when needed.

First claim

What is claimed is:

1. A method for cryptographic key processing within a security context of at least one computing device, the method comprising:
obtaining a seed value comprising a number;
obtaining at least one generated cryptographic key comprising an initial cryptographic key wherein the initial cryptographic key is generated when a first KDF (key derivation function) is executed, and wherein the initial cryptographic key is obtained upon an initial introduction of the seed value to the security context of at least one computing device;
executing a second KDF comprising the initial cryptographic key as an input and a blob (binary large object) as an output wherein the blob comprises an encryption of the initial cryptographic key,
a designated KDF being the first KDF or the second KDF, the designated KDF utilizing an asymmetric key function,
a specified KDF being the first KDF or the second KDF that is not the designated KDF, the specified KDF utilizing a symmetric key function;

executing a function to generate a digested seed value utilizing the seed value as at least one input to the function;
associating the digested seed value with the blob; and
storing the digested seed value and the blob in a storage container in a manner wherein the digested seed value and the blob are associated in the storage container.

2. The method for cryptographic key processing of claim 1 , further comprising:
utilizing the digested seed value to search the storage container for a match comprising a stored digested seed value with the same value as the digested seed value used to search the storage container prior to obtaining the at least one generated cryptographic key;
retrieving from the storage container the blob associated with the stored digested seed value comprising a match when there exists a stored digested seed value stored in the storage container with the same value as the digested seed value used to search the storage container prior to obtaining the at least one generated cryptographic key; and
executing the second KDF comprising the seed value as an input to decrypt the blob and regenerate the initial cryptographic key.

3. The method for cryptographic key processing of claim 2 , further comprising utilizing the regenerated initial cryptographic key to decrypt encrypted data accessible to the at least one computing device.

4. The method for cryptographic key processing of claim 1 , wherein the first KDF utilizes the asymmetric key function that when executed generates the initial cryptographic key; and
wherein the second KDF utilizes the symmetric key function that when executed generates the blob.

5. The method for cryptographic key processing of claim 1 , wherein the function executed to generate a digested seed value comprises a one-way function wherein the seed value will not be output upon execution of the one-way function with the digested seed value as an input to the one-way function.

6. The method for cryptographic key processing of claim 1 , wherein the seed value comprises a random number that is made accessible to the security context of a computing device.

7. The method for cryptographic key processing of claim 1 , wherein the seed value comprises a random number that is generated by the security context of a computing device.

8. The method for cryptographic key processing of claim 1 , further comprising:
obtaining at least a second generated cryptographic key comprising a second cryptographic key wherein the second cryptographic key is generated when the first KDF is executed, wherein the second cryptographic key is obtained upon an initial introduction of the seed value to the security context of at least one computing device, and wherein the initial cryptographic key and the second cryptographic key are generated contemporaneously upon an execution of the first KDF;
executing the second KDF comprising the second cryptographic key as an input and a blob as an output wherein the blob comprises an encryption of the second cryptographic key;
utilizing the digested seed value to search the storage container for a match comprising a stored digested seed value with the same value as the digested seed value used to search the storage container prior to obtaining the initial cryptographic key and prior to obtaining the second cryptographic key;
retrieving from the storage container the blob associated with the stored digested seed value comprising a match when there exists a stored digested seed value stored in the storage container with the same value as the digested seed value used to search the storage container prior to obtaining the initial cryptographic key and prior to obtaining the second cryptographic key; and
executing the second KDF comprising the seed value as an input to decrypt the blob and regenerate the second cryptographic key.

9. The method for cryptographic key processing of claim 8 , further comprising utilizing the regenerated second cryptographic key to encrypt data accessible to the at least one computing device.

10. The method for cryptographic key processing of claim 9 , wherein the initial cryptographic key comprises a private key utilized for the decryption of encrypted data and wherein the second cryptographic key comprises a public key utilized for the encryption of data.

11. The method for cryptographic key processing of claim 8 , wherein the blob comprises an encryption of the initial cryptographic key with the second cryptographic key utilizing the seed value.

12. The method for cryptographic key processing of claim 8 , wherein the blob comprising the encryption of the initial cryptographic key is a first blob and the blob comprising the encryption of the second cryptographic key is a second blob and the first blob and the second blob are different blobs.

13. The method for cryptographic key processing of claim 1 , wherein the blob comprises an encryption of the initial cryptographic key utilizing the seed value.

14. The method for cryptographic key processing of claim 1 , further comprising:
creating at least one decoy digested seed value;
creating at least one decoy cryptographic key that comprises a format and a size that is representative of the initial cryptographic key and wherein the decoy cryptographic key comprises a value that is different than the initial cryptographic key;
executing the second KDF comprising the decoy cryptographic key as an input and a decoy blob as an output wherein the decoy blob comprises an encryption of the decoy cryptographic key;
associating the decoy digested seed value with the decoy blob; and
storing the decoy digested seed value and the decoy blob in the storage container in a manner wherein the decoy digested seed value and the decoy blob are associated in the storage container.

15. A method for cryptographic key effectuation within a hybrid security context of at least one computing device system comprising a storage container, the method comprising:
obtaining a seed value comprising a number;
executing a function to generate a digested seed value utilizing the seed value as at least one input to the function;
utilizing the digested seed value to search the storage container of at least one computing device system for a match comprising a stored digested seed value with the same value as the digested seed value used to search the storage container, wherein the storage container comprises stored associated data comprising a digested seed value and at least one blob (binary large object);
retrieving from the storage container the blob associated with the stored digested seed value comprising a match when there e

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Thom Stefan
• Shumow Daniel B

Classifications

• G06F2212/1052

  Security improvement · CPC title

• H04L9/0822 Primary

  using key encryption key · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L2209/24

  Key scheduling, i.e. generating round keys or sub-keys for block encryption · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title