Method for managing hardware security server and apparatus therefor

Abstract

Methods, non-transitory computer-readable media, network traffic manager devices, and systems to assist in managing a hardware security server include receiving a request from a client. The request may include a unique numerical handle and a command for a hardware secure server. The unique numerical handle may be generated as a response to a previous request from the client. The method may further include searching a memory for a key handle mapped to the unique value handle and the hardware security server. The method may also include sending the request to the hardware security server having the key handle when the key handle is retrieved from memory during the search; and sending a response received from the hardware security server to the client. The response may be received as a result of sending the request to the hardware secure server.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. patent application No. 18 / 087,926, filed December 23, 2022, which is hereby incorporated by reference in its entirety. Technical Field

[0003] The present technology relates to methods and systems for managing hardware security servers. Background Art

[0004] The proposed technology involves a hardware security server proxy. This proxy provides a single interface to users on the front end, while implementing multiple implementations for multiple hardware security servers on the back end. The problem with hardware security servers is that different vendors or providers have different capabilities and application programming interfaces (APIs), which may require installing custom libraries for each hardware security server. Summary of the Invention

[0005] A method for establishing a connection to a server using a certificate, implemented in conjunction with a cloud service or network traffic management system including one or more network traffic management modules, server modules, or client modules, includes receiving a request from a client. The request may include a unique numerical handle and a command for a hardware security server. The unique numerical handle may be generated as a response to a previous request from the client. The method may further include searching a memory for a key handle that maps to the unique numerical handle and the hardware security server. The method may also include sending the request to the hardware security server having the key handle when the key handle is retrieved from the memory during the search; and sending a response received from the hardware security server to the client. The response may be received as a result of sending the request to the hardware security server.

[0006] A network traffic management device comprises: a memory including programming instructions stored thereon; and one or more processors configured to execute the stored programming instructions to receive a request from a client. The request may include a unique numerical handle and a command for a hardware security server. The unique numerical handle may be generated as a response to a previous request from the client. The network traffic manager device then searches the memory for a key handle that maps to the unique numerical handle and the hardware security server. The network traffic manager device then sends the request to the hardware security server having the key handle when the key handle is retrieved from the memory during the search; and sends a response received from the hardware security server to the client. The response may be received as a result of sending the request to the hardware security server.

[0007] A non-transitory computer-readable medium having stored thereon instructions for, the instructions comprising executable code that, when executed by one or more processors, causes the processor to receive a request from a client. The request may include a unique numerical handle and a command to a hardware security server. The unique numerical handle may be generated as a response to a previous request from the client. The network traffic manager device then searches a memory for a key handle that maps to the unique numerical handle and the hardware security server. The network traffic manager device then sends the request to the hardware security server having the key handle when the key handle is retrieved from the memory during the search; and sends a response received from the hardware security server to the client. The response may be received as a result of sending the request to the hardware security server.

[0008] A network traffic management system includes one or more traffic management modules; a server module; or a client module; a memory including programming instructions stored thereon; and one or more processors configured to execute the stored programming instructions to receive a request from a client. The request may include a unique numerical handle and a command for a hardware security server. The unique numerical handle may be generated as a response to a previous request from the client. The network traffic manager device then searches the memory for a key handle that maps to the unique numerical handle and the hardware security server. The network traffic manager device then sends the request to the hardware security server having the key handle when the key handle is retrieved from the memory during the search; and sends a response received from the hardware security server to the client. The response may be received as a result of sending the request to the hardware security server.

[0009] The present technology provides numerous advantages, including providing a method for connecting a proxy library to a client device on a front-end and using a virtual key table to map different back-end keys to multiple hardware security servers, a non-transitory computer-readable medium, a network traffic management device, and a network traffic management system. The present technology creates a method for improving the efficiency of managing hardware security servers. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 is a block diagram of an exemplary network traffic management system having a network traffic management device;

[0011] Figure 2 is a block diagram of an exemplary network traffic management device in communication with a client computing device and a hardware security server;

[0012] Figure 3 is a flow chart of an exemplary method for managing a hardware security server;

[0013] Figure 4 is a flow chart of an exemplary method for managing a hardware security server; and

[0014] Figure 5 is a diagram illustrating a method for managing a hardware security server using a data structure. DETAILED DESCRIPTION

[0015] The proposed technology involves managing hardware security servers by using a network traffic manager device as a hardware security server proxy. The hardware security server proxy connects a proxy library to client devices on the front end, and the proxy uses a virtual key table to map different back-end keys to multiple hardware security servers. The proposed technology can also connect to multiple hardware security servers simultaneously and can immediately switch to any of the multiple hardware security servers to perform the requested key operation.

[0016] The hardware security server agent can use an endpoint with a unified RESTful interface that connects the hardware security server agent to the client device. In some examples, when multiple hardware security servers update their respective software, the network traffic manager device can automatically update the software on the client device as needed. This is achieved by sending the update to the client device after the hardware security server updates its software. This allows the user to avoid reconfiguring or restarting their infrastructure every time one of the multiple hardware security servers updates its software.

[0017] An example of the proposed technology includes a network environment 10 incorporating a network traffic management system for providing a network traffic manager device 14, wherein the network traffic manager device 14 is configured to manage a network flow. Figure 1 and Figure 2 . The exemplary environment 10 includes a plurality of client computing devices 12(1)-12(n), a network traffic manager device 14, a network traffic manager device 14, and a plurality of hardware security servers 16(1)-16(n) coupled together via a communication network 30, but the environment may include other types and numbers of systems, devices, components, and / or elements and in other topologies and deployments. Although not shown, the exemplary environment 10 may include additional network components, such as routers, switches, and other devices, which are well known to those skilled in the art and therefore will not be described herein.

[0018] More specifically refer to Figure 1 , the network traffic manager device 14 of the network traffic management system is coupled to the plurality of client computing devices 12(1)-12(n) via a communication network 30, but the plurality of client computing devices 12(1)-12(n) and the network traffic manager device 14 may be coupled together via other topologies. Additionally, the network traffic manager device 14 is coupled to the network traffic manager device 14 via the communication network 30, but the network traffic manager device 14 and the network traffic manager device 14 may be coupled together via other topologies.

[0019] like Figure 2 As illustrated, the network traffic manager device 14 includes a processor or central processing unit (CPU) 18, memory 20, optional configurable hardware logic 21, and a communication system 24 coupled together by a bus arrangement 26, but the network traffic manager device 14 may include other types and numbers of elements in other configurations. In this example, the bus is a PCI Express bus, but other bus types and links may be used. The network traffic manager device 14 may include a communication system 24 for communicating information, such as computer executable instructions or other data. As a specific example, refer to Figure 2 , the communication system 24 of the network traffic management device 14 is operatively coupled to and in communication with the communication network 30, such that the network traffic manager 14 is coupled to and in communication with the client computing devices 12(1)-12(n) and the plurality of hardware security servers 16(1)-16(n). For example, the traffic management logic 25 of the network traffic management device 14 may perform various proxy services such as load balancing, rate monitoring, caching, encryption / decryption, session management (including key generation), address translation, and / or access control. Figure 2As illustrated, the network traffic manager device 14 may send and receive requests, responses, or other proxy service operations to and from the client computing device 12(1) and the hardware security server 16(1).

[0020] The network traffic manager device 14 assists in managing a plurality of hardware security servers 16(1)-16(n), as illustrated and described by way of examples herein, although the network traffic manager device 14 may perform other types and / or numbers of functions. A processor 18 within the network traffic manager device 14 may execute one or more computer-executable instructions stored in a memory 20 for the methods illustrated and described with reference to the examples herein, although the processor may execute other types and numbers of instructions and perform other types and numbers of operations. The processor 18 may include one or more central processing units ("CPUs") or general-purpose processors having one or more processing cores, such as one or more processors. processor, but one or more other types of processors may be used (e.g., ).

[0021] The memory 20 within the network traffic manager device 14 may include one or more tangible storage media, such as RAM, ROM, flash memory, CD-ROM, floppy disk, hard drive, solid-state memory, DVD, or any other memory storage type or device known to those skilled in the art, including combinations thereof. The memory 20 may store one or more non-transitory computer-readable instructions of the present technology that may be executed by the processor 18 as illustrated and described with reference to the examples herein. Figure 3 and Figure 4 The exemplary flow chart shown represents example steps or actions of the present technology that may be embodied or expressed as one or more non-transitory computer or machine readable instructions stored in memory 20 that may be executed by processor 18 and / or implemented by configuration logic. Memory 20 may also include structured and / or unstructured data (e.g., data such as data stored in memory) used by software routines to perform computing tasks. Figure 5 HSM management data structure as shown). Figure 5 As illustrated, a data structure may be used to map a unique numeric handle to a key handle. The key handle may further be mapped to a plurality of hardware security servers 16(1)-16(n).

[0022] Thus, the memory 20 of the network traffic manager device 14 may store one or more applications that may include computer-executable instructions that, when executed by the network traffic manager device 14, cause the network traffic manager device 14 to perform actions, such as, for example, transmitting, receiving, or otherwise processing messages, and performing the operations described below with reference to Figure 3 and Figure 4 Other actions described and illustrated. The application may be implemented as a module or component of another application. Further, the application may be implemented as an operating system extension, module, plug-in, etc. The application may be implemented as a module or component of another application. Further, the application may be implemented as an operating system extension, module, plug-in, etc. Still further, the application may operate in a cloud-based computing environment. The application may execute within a virtual machine or virtual server that may be managed in the cloud-based computing environment. Additionally, the applications, including the network traffic manager device 14 itself, may be located in a virtual server running in the cloud-based computing environment, rather than being tied to one or more specific physical network computing devices. Additionally, the application may run in one or more virtual machines (VMs) executing on the network traffic manager device 14. Additionally, in at least one of the various embodiments, the virtual machines running on the network traffic manager device 14 may be managed or supervised by a hypervisor. Additionally, one or more of the components that together make up the network traffic manager device 14 may be standalone devices or integrated with one or more other devices or appliances (such as, for example, with multiple servers).

[0023] The communication system 24 in the network traffic manager device 14 is used to operatively couple and communicate between the network traffic manager device 14, the plurality of client computing devices 12(1)-12(n), and the network traffic manager device 14, all coupled together via a communication network 30. By way of example only, the communication network may be the Internet or another public network.

[0024] Each of the plurality of client computing devices 12(1)-12(n) of the network traffic management system 10 includes a central processing unit (CPU) or processor, memory, input / display device interfaces, configurable logic devices, and an input / output system or I / O system coupled together by a bus or other link. Additionally, the plurality of client computing devices 12(1)-12(n) may include any type of computing device that can receive, render, and facilitate user interactions, such as a client computer, a network computer, a mobile computer, a mobile phone, a virtual machine (including a cloud-based computer), etc. Each of the plurality of client computing devices 12(1)-12(n) utilizes a network traffic manager device 14 to perform one or more operations with the network traffic manager device 14 via a communication network 30 located between the network traffic manager device 14 and the plurality of hardware security servers 16(1)-16(n), such as communicating with the plurality of hardware security servers 16(1)-16(n), by way of example only, although other functions may also be performed.

[0025] The network traffic manager device 14 may receive requests transmitted by a plurality of client computing devices 12(1)-12(n) using a communication network 30. The network traffic manager device 14 may perform various services to map key tables between the network traffic manager device 14 and a plurality of hardware security servers 16(1)-16(n). For example, the plurality of hardware security servers 16(1)-16(n) may perform operations such as load balancing, rate monitoring, caching, encryption / decryption, session management (including key generation), address translation, and / or access control. The network traffic manager device 14 may process the requests and perform various operations on behalf of the plurality of client computing devices 12(1)-12(n). The network traffic manager device 14 may perform various cryptographic operations and communication operations to communicate with the plurality of hardware security servers 16(1)-16(n).

[0026] In general, a plurality of hardware security servers 16(1)-16(n) may perform various computing tasks implemented using a computing environment. The computing environment may include computer hardware, computer software, and combinations thereof. As a specific example, the computing environment may include general-purpose and / or special-purpose processors, configurable and / or hard-wired electronic circuitry, communication interfaces, and computer-readable memory for storing computer-executable instructions to enable the processor to perform a given computing task. The logic for performing a given task may be specified within a single module or distributed across multiple modules. As used herein, the terms "module" and "component" may refer to an implementation within one or more dedicated hardware devices or appliances (e.g., computers), and / or an implementation within software hosted by one or more hardware devices or appliances, which may host one or more other software applications or implementations. Additionally, the network traffic manager device 14 may include a cryptographic offload module for offloading cryptographic operations to the plurality of hardware security servers 16(1)-16(n).

[0027] The plurality of hardware security servers 16(1)-16(n) may be implemented using a variety of different computer architectures. For example, the plurality of hardware security servers 16(1)-16(n) may be implemented as plug-in circuit cards that interface with an input / output or peripheral interface of a computer, such as a Peripheral Component Interconnect Express (PCIe), and may include a connector for connecting to a backplane or other connector of the computer. As another example, the plurality of hardware security servers 16(1)-16(n) may be implemented as computer appliances connected via a computer network (a plurality of network-based hardware security servers 16(1)-16(n)). As another example, the plurality of hardware security servers 16(1)-16(n) may be implemented as virtualized resources within a cloud computing infrastructure (a plurality of cloud-based hardware security servers 16(1)-16(n)). The plurality of hardware security servers 16(1)-16(n) may have different storage capacities and / or acceleration capabilities. For example, the physical plurality of hardware security servers 16(1)-16(n) may be divided into a plurality of logical plurality of hardware security servers 16(1)-16(n), wherein each logical plurality of hardware security servers 16(1)-16(n) may have different capabilities and may be accessed using different account credentials. The logical plurality of hardware security servers 16(1)-16(n) may also be referred to as partitions or tokens of the physical plurality of hardware security servers 16(1)-16(n). The partitions of the plurality of hardware security servers 16(1)-16(n) may be isolated from each other so that keys and data on one partition are not visible from different partitions. The partitions may share hardware and other resources, or the partitions may use specific non-shared hardware and resources. The plurality of hardware security servers 16(1)-16(n) may use various storage technologies, such as random access memory (RAM), non-volatile RAM, flash memory, hard disk drives, solid-state drives, or other storage implementations.

[0028] The plurality of hardware security servers 16(1)-16(n) may include a plurality of hardware security modules. The plurality of hardware security servers 16(1)-16(n) may be computer hardware and / or software (e.g., a computing device) configured to store cryptographic keys, perform cryptographic operations (such as generating keys, encrypting data, and decrypting data), and enforce security policies for using and / or accessing cryptographic keys. The plurality of hardware security servers 16(1)-16(n) may include a physical enclosure that reduces the likelihood of observing and / or tampering with sensitive data (such as private keys of the plurality of hardware security servers 16(1)-16(n)). If the enclosure is tampered with, the enclosure may cover potential electrical probe points and display visible damage. The plurality of hardware security servers 16(1)-16(n) may have different APIs having different functions for performing the same task. The plurality of hardware security servers 16(1)-16(n) may also comply with public key cryptography standards (PKCS). PKCS may be a class of public key cryptography standards. PKCS#11 (also known as Cryptoki) can be a specific platform-independent API for interfacing with multiple hardware security servers 16(1)-16(n), which can define data types, functions, and other components available to applications that implement the PKCS#11 standard. The data types can represent items stored on the multiple hardware security servers 16(1)-16(n), such as cryptographic keys. In some examples, the specific platform-independent API can implement different methods and functions for importing, exporting, encrypting, and decrypting cryptographic keys. The multiple hardware security servers 16(1)-16(n) can perform cryptographic operations and other operations using the keys. Specifically, the multiple hardware security servers 16(1)-16(n) can receive requests associated with an active HSM session. The requests can include requests to retrieve a key handle, requests to initialize or update persistent attributes, and requests to perform cryptographic operations. As an example, a key handle can be returned in response to a request for a handle using a persistent attribute (e.g., a key string identifier) ​​as a reference.

[0029] In one example, the network traffic manager device 14 can be a dedicated computing device including a processor 18 and a computer-readable memory 20. The memory 20 of the network traffic management device 14 can store one or more applications that can include computer-executable instructions that, when executed by the network traffic manager device 14, cause the network traffic manager device 14 to perform actions such as, for example, transmitting, receiving, or otherwise processing messages, and to perform other actions such as offloading cryptographic operations to the plurality of hardware security servers 16(1)-16(n) and accessing cryptographic keys stored on the plurality of hardware security servers 16(1)-16(n). The applications can be implemented as components of other applications. Further, the applications can be implemented as operating system extensions, plug-ins, etc.

[0030] Therefore, the technology disclosed herein should not be construed as limited to a single environment, and other configurations and architectures are also contemplated. For example, Figure 1 and Figure 2 The depicted plurality of hardware security servers 16(1)-16(n) may operate within the network traffic manager device 14, rather than as standalone servers that communicate with the network traffic manager device 14 via the communication network 30. In this example, the plurality of hardware security servers 16(1)-16(n) operate within the memory 20 of the network traffic manager device 14.

[0031] Although the network traffic manager device 14 is illustrated in this example as comprising a single device, the network traffic manager device 14 may, in other examples, comprise multiple devices or blades, each having a processor, each processor having one or more processing cores, the one or more processing cores implementing one or more steps of the present technology. In these examples, one or more of the devices may have a dedicated communication interface or memory. Alternatively, one or more of the devices may utilize memory, a communication interface, or other hardware or software components of one or more other communicatively coupled devices. Additionally, one or more of the devices that together comprise the network traffic manager device 14 may, in other examples, be standalone devices or integrated with, for example, one or more other devices or applications, multiple hardware security servers 16(1)-16(n), or the network traffic manager device 14, or the network traffic manager device 14, or an application coupled to one or more communication networks. Furthermore, in these examples, one or more of the devices of the network traffic manager device 14 may be located in the same or different communication networks 30, including, for example, one or more public networks, private networks, or cloud networks.

[0032] Although an exemplary network traffic management system 10 having multiple client computing devices 12(1)-12(n), a network traffic manager device 14, a network traffic manager device 14 and multiple hardware security servers 16(1)-16(n), and a communication network 30 is described and illustrated herein, it should be understood that the example system described herein is for exemplary purposes, as many variations in the specific hardware and software used to implement the example are possible, as will be appreciated by those skilled in the art.

[0033] Further, each of the example systems may be conveniently implemented using one or more general purpose computer systems, microprocessors, digital signal processors, and microcontrollers programmed according to the teachings of the examples, as described and illustrated herein and as will be appreciated by those skilled in the art.

[0034] One or more of the components depicted in the network traffic management system, such as, for example, the network traffic manager device 14, the plurality of client computing devices 12(1)-12(n), the network traffic manager device 14, and the plurality of hardware security servers 16(1)-16(n), may be configured to operate as virtual instances on the same physical machine. In other words, Figure 1 and Figure 2 The illustrated network traffic manager device 14, the plurality of client computing devices 12(1)-12(n), the network traffic manager device 14, or one or more of the plurality of hardware security servers 16(1)-16(n) may operate on the same physical device rather than as a single physical device. Figure 1 The depicted individual devices operate in communication via a network. Figure 1 and Figure 2 A greater or lesser number of client computing devices 12(1)-12(n), a network traffic manager device 14, a network traffic manager device 14, or a plurality of hardware security servers 16(1)-16(n) than depicted. The plurality of client computing devices 12(1)-12(n), the network traffic manager device 14, and the plurality of hardware security servers 16(1)-16(n) may be implemented as applications on the network traffic manager device 14.

[0035] In addition, two or more computing systems or devices can replace any one of the systems or devices in any example. Therefore, the principles and advantages of distributed processing, such as redundancy and replication, can also be implemented as needed to improve the robustness and performance of the devices and systems of the examples. The examples can also be implemented on one or more computer systems extended across any suitable network using any suitable interface mechanism and flow technology. As examples only, any suitable interface mechanism and flow technology include any suitable form of traffic (e.g., voice and modem), wireless traffic media, wireless traffic network, cellular traffic network, G3 traffic network, public switched telephone network (PSTN), packet data network (PDN), the Internet, intranet and combinations thereof.

[0036] The examples may also be embodied as a non-transitory computer-readable medium having stored thereon instructions for one or more aspects of the techniques as described and illustrated by the examples herein, which instructions, when executed by a processor (or configurable hardware), cause the processor to perform the steps necessary to implement the method of the examples, as described and illustrated herein.

[0037] Now refer to Figures 1 to 5 An example of a method for providing a network traffic manager device 14 is described. First, in step 305, the network traffic manager device 14 receives a request from a client computing device 12(1). The request may include a unique numerical handle and a command to the hardware security server 16(1). The unique numerical handle may be generated as a response to a previous request from the client, such as Figure 4As illustrated. The commands to the hardware security server 16(1) can be API calls. An API is a program interface (e.g., a set of methods and / or protocols) for communicating between different modules. In some examples, the network traffic manager device 14 can act as a hardware security server proxy to communicate with multiple hardware security servers 16(1)-16(n) to send API calls and receive responses. A proxy is an agent that can be located in the communication path between a client (e.g., multiple client computing devices 12(1)-12(n)) and a server (e.g., multiple hardware security servers 16(1)-16(n)), which can intercept communications (e.g., network packets, frames, datagrams, and messages) between the multiple client computing devices 12(1)-12(n) and the multiple hardware security servers 16(1)-16(n). The network traffic manager device 14 can act as a virtual server that presents the network address of the network traffic manager device 14 as the network address of the multiple hardware security servers 16(1)-16(n). As an example, connecting the plurality of client computing devices 12(1)-12(n) and the network traffic manager device 14 can be accomplished by integrating a proxy library into the plurality of client computing devices 12(1)-12(n). The proxy library may or may not speak an open protocol to the hardware security server agent. Endpoints with a unified RESTful interface using KMIP or a proprietary protocol can be connected to the network traffic manager device 14 and the plurality of client computing devices 12(1)-12(n). In some examples, the network traffic manager device 14 can perform security functions and / or routing functions for the plurality of client computing devices 12(1)-12(n), such as performing encryption and / or decryption operations for traffic flowing between the plurality of client computing devices 12(1)-12(n) and the plurality of hardware security servers 16(1)-16(n). Specifically, the network traffic manager device 14 can act on behalf of the plurality of hardware security servers 16(1)-16(n), such as by encrypting traffic sent by the plurality of hardware security servers 16(1)-16(n), decrypting traffic destined for the plurality of hardware security servers 16(1)-16(n), and performing handshake operations for exchanging cryptographic information with the plurality of client computing devices 12(1)-12(n).

[0038] In step 310, the network traffic manager device 14 identifies a key handle associated with the received unique numerical handle. The hardware security server 16(1) associated with the identified key handle may be configured to execute the received command using the key handle. A mapping may also exist between the received unique numerical handle and the key handle. In some embodiments, there may be multiple key handles for multiple hardware security servers 16(1)-16(n), and the multiple key handles may be associated with a unique numerical handle, such as Figure 5As illustrated. The unique numerical handle may be sent to a plurality of client computing devices 12(1)-12(n). The unique numerical handle may be mapped to a data structure of key handles of a plurality of hardware security servers 16(1)-16(n). The unique numerical handle may be generated as a response to a previous request from a client, such as Figure 4 As illustrated and explained below. A unique numeric handle is unique in that it is a specific handle and is unique to a client. However, a unique numeric handle may be mapped to multiple handles retrieved from multiple hardware security servers 16(1)-16(n), which may result in a unique numeric handle already matching an already generated handle. Although a unique numeric handle may match an already generated handle, the numeric handle may have other unique characteristics, as emphasized above and throughout this application. The data structure and mapping may also be stored in memory as a response to a previous request from a client. In some examples, a key may be generated by and / or requested to be stored on multiple hardware security servers 16(1)-16(n). The key may potentially be kept more secure by storing it on multiple hardware security servers 16(1)-16(n). Volatile properties of the key may include the key handle. A given key handle is valid as an identifier of a key for a given session. A given key can have multiple key handles, where each session accessing the key can use a different key handle.

[0039] In step 315, the network traffic manager device 14 retrieves the key handle from the memory when the key handle is identified in step 310. By retrieving the key handle from the memory, the network traffic manager device 14 can manage multiple key handles corresponding to multiple hardware security servers 16(1)-16(n). This can enable multiple client computing devices 12(1)-12(n) to interface to different servers in the multiple hardware security servers 16(1)-16(n) using a single interface through the network traffic manager device 14 while shielding the underlying implementation details of the multiple hardware security servers 16(1)-16(n). Figure 5As illustrated, multiple client computing devices 12(1)-12(n) may each have a unique numerical handle. Each unique numerical handle may be mapped to a data structure of key handles for multiple hardware security servers 16(1)-16(n). Requests received from a client 12(1) will be sent to the hardware security server 16(1). Using the information of which hardware security server 16(1) the request will be sent to, and the unique numerical handle, the corresponding key handle may be located in an appropriate data structure. It should be understood in the art that the key handle and the unique numerical handle may be stored in memory in other configurations. For example, in the back end, there may be a numerical handle data structure for each of the multiple hardware security servers 16(1)-16(n). For example, this mapping may allow the front end of multiple client computing devices 12(1)-12(n) to use the same key across multiple hardware security servers 16(1)-16(n). This implementation may allow for other advantages, for example, a dealer or broker application may create an arbitrage agent through multiple client computing devices 12(1)-12(n) that acts as a dealer to present pricing to multiple client computing devices 12(1)-12(n) using pricing information mapped from multiple hardware security servers 16(1)-16(n) on the back end. For example, the network traffic manager device 14 may send a request for pricing information to the hardware security server 16(1). The network traffic manager device 14 may receive pricing information from the hardware security server 16(1). The network traffic manager device may then send the received pricing information to the client 12(1). This process may be repeated for multiple hardware security servers 16(1)-16(n) to present pricing options to the client 12(1). In some embodiments, the network traffic manager device 14 may also receive pricing requirements from the client computing devices 12(1)-12(n) before sending the pricing information received from the multiple hardware security servers 16(1)-16(n).

[0040] In step 320, the network traffic manager device 14 sends the received request to the hardware security server 16(1) associated with the identified key handle to execute the command and receive a response after executing the command. In some embodiments, the received request can be an API request. For example, the network traffic manager device 14 can use packet-based messaging (e.g., an Ethernet-based packet data network) and / or other APIs to transmit information to the hardware security server 16(1). An API is a program interface (e.g., a set of methods and / or protocols) for communication. As known to those skilled in the art, there are other types of requests that can be received from a client and sent to multiple hardware security servers 16(1)-16(n). An agent library integrated into the client computing device 12(1)-12(n) can allow the network traffic manager device 14 to receive API requests from the client computing device 12(1) for subsequent transmission to the hardware security server 16(1). The agent library can obtain the received API request and send the request in an equivalent format or syntax to the hardware security server 16(1) for processing.

[0041] In step 325, the network traffic manager device 14 may receive a response from the hardware security server 16(1) after sending the request with the key handle. In some embodiments, the response may be output from the hardware security server 16(1) as a result of the API call. In step 330, the network traffic manager device 14 may send the returned response received from the hardware security server 16(1) to the client 12(1) associated with the unique numeric handle, and the exemplary process ends at step 335. By allowing the client computing device 12(1) to send the request in step 305 and then receive the response in step 330, the front-end communication calls with the client are streamlined when the network traffic manager device 14 manages requests to the back-end of multiple hardware security servers 16(1)-16(n). This allows for a single API key management system on the front-end of multiple client computing devices 12(1)-12(n), while allowing access to any number of actual implementations in cloud environments or hardware on the back-end based on high availability requirements and other factors.

[0042] In addition, reference will now be made to Figure 4 An example is described of how the network traffic manager device 14 processes a previous request to store and generate a data structure to manage key handles and unique numeric handles. First, in step 405, the network traffic manager device 14 receives a previous request to retrieve a key handle from the hardware security server 16(1). As described above and as Figure 4As illustrated, in step 410, the network traffic manager device 14 then sends a previous request to the hardware security server 16(1) to retrieve the key handle. The network traffic manager device 14 may query the hardware security server 16(1) for the volatile key handle using the persistent attribute of the key as a reference to the key. The hardware security server 16(1) may be queried by sending a query to the hardware security server 16(1).

[0043] In step 415, the network traffic manager device 14 receives a key handle from the hardware security server after sending the previous request to the hardware security server. A handle is an identifier of or a reference to a resource or object. For example, a handle may be an integer assigned by the plurality of hardware security servers 16(1)-16(n), an operating system, or other software when an object is created or first used. Handles to objects on the plurality of hardware security servers 16(1)-16(n) may be volatile in that the handle to an object may change during the lifetime of the object. In contrast, persistent properties of an object, once initialized, do not change during the lifetime of the object. Additionally, the key handle may be different for the same key in different sessions. For the same session, the key handle may change when the session is re-established. For some functions performed by the plurality of hardware security servers 16(1)-16(n), the key handle may be the only way to reference the key when performing the function.

[0044] In step 420, the network traffic manager device 14 generates a unique numerical handle associated with the key handle. The unique numerical handle can be a random number or a series of characters. In some embodiments, the unique numerical handle can be a random number or a pseudo-random number, etc. The unique numerical handle is unique to the client 12(1). In some embodiments, if the network traffic manager device 14 receives requests from multiple clients, a unique numerical handle can be sent and assigned to each client for future API calls. The unique numerical handle allows the client 12(1) to manage only one handle, while the network traffic manager device 14 manages the key handles for multiple hardware security servers 16(1)-16(n) in the backend as described above.

[0045] In step 425, the network traffic manager device 14 stores the unique numerical handle and the key handle in a data structure in memory. The key handle may be stored in the data structure, and the data structure may be updated when the key handle changes, such that additional queries may be potentially eliminated for most operations performed by the plurality of hardware security servers 16(1)-16(n). As described above, by storing both the unique numerical handle and associating the unique numerical handle to the key handle in memory, this may allow the network traffic manager device 14 to retrieve the key handle in the future for subsequent operations. The key string identifier may also be stored in the key table for automatic restoration of the key handle when a session is recreated, so as to ensure the correctness of the key handle in the key table, such as Figure 5 Additional information may be mapped in the data structure to facilitate operations between the network traffic manager device 14 and the plurality of hardware security servers 16(1)-16(n).

[0046] In step 430, the network traffic manager device 14 sends the generated unique numeric handle to the client 12(1) for use in subsequent API requests to the hardware security server 16(1). By sending the generated unique numeric handle to the client instead of the key handle, the network traffic manager device 14 can use the mapping to connect to multiple hardware security servers 16(1)-16(n) simultaneously and can immediately switch to any of the multiple hardware security servers 16(1)-16(n) to perform any requested key operation, while the client 12(1) only needs the unique numeric handle for future requests. The network traffic manager device 14 can also reconfigure the numeric handle data structure when updating one of the multiple hardware security servers 16(1)-16(n) without changing the unique numeric handle. The network traffic manager device 14 can also automatically update multiple client computing devices 12(1)-12(n) as needed without affecting the unique numeric handle sent to the client.

[0047] Having thus described the basic concepts of the present technology, it will be readily apparent to those skilled in the art that the foregoing detailed disclosure is intended to be presented by way of example only and not by way of limitation. Although not expressly set forth herein, various changes, improvements, and modifications will occur to and are intended by those skilled in the art. Such changes, improvements, and modifications are hereby proposed and are within the spirit and scope of the present technology. Additionally, except as may be specified in the claims, the enumerated order of processing elements or sequences, or the use of numbers, letters, or other designations is not intended to limit the claimed processes to any order. Therefore, the present technology is limited only by the following claims and their equivalents.

Claims

1. A method for managing a hardware security server, the method being implemented by a network traffic management system or a cloud service including a network traffic device, a client device, or a server device, the method comprising: receiving a request from a client, wherein the request includes a unique numerical handle and a command to a hardware security server, and wherein the unique numerical handle is generated as a response to a previous request from the client; identifying a key handle associated with the received unique numeric handle, wherein the hardware security server associated with the identified key handle is configured to execute the received command, and wherein the received unique numeric handle is mapped to the key handle; sending the received request to the hardware security server associated with the identified key handle to execute the command and return a response after executing the command; as well as The returned response received from the hardware security server is sent to the client associated with the unique numeric handle.

2. The method of claim 1, further comprising: receiving a previous request from the client, wherein the previous request is an API request to retrieve the key handle from the hardware security server; sending the previous request to the hardware security server to retrieve the key handle, wherein the key handle was generated by the hardware security server; storing the unique numeric handle and the key handle in a data structure in memory, wherein the unique numeric handle is generated and associated with the key handle, and wherein the key handle is received from the hardware security server after sending the previous request to the hardware security server; as well as The generated unique numerical handle is sent to the client, wherein the generated unique numerical handle is sent for subsequent API requests to the hardware security server.

3. The method of claim 2, further comprising: receiving a subsequent request from the client, wherein the subsequent request includes the unique numerical handle, and wherein the unique numerical handle is generated in response to the previous request from the client; sending the subsequent request to a different hardware security server having a different key handle, wherein the different key handle is retrieved from the memory by searching for the different key handle associated with the different hardware security server using the unique numeric handle; as well as A subsequent response is sent to the client, wherein the subsequent response is received from the different hardware security server as a result of sending the subsequent request to the different hardware security server having the different key handle.

4. The method of claim 1, further comprising: receiving a new key handle from the hardware security server as a response to sending the request to the hardware security server and as a result of reconfiguring the hardware security server; as well as The new key handle associated with the unique numeric handle is stored in the memory, wherein the new key handle from the reconfigured hardware security server replaces the key handle in the memory.

5. The method of claim 4 , wherein the key handle is mapped to the unique numeric handle by linking the unique numeric handle to a plurality of key handles stored in a data structure in the memory, and wherein each of the key handles in the plurality of key handles is associated with a particular hardware security server.

6. A non-transitory computer-readable medium having stored thereon instructions for managing a hardware security server, the instructions comprising executable code that, when executed by a processor, causes the processor to: receiving a request from a client, wherein the request includes a unique numerical handle and a command to a hardware security server, and wherein the unique numerical handle is generated as a response to a previous request from the client; identifying a key handle associated with the received unique numeric handle, wherein the hardware security server associated with the identified key handle is configured to execute the received command, and wherein the received unique numeric handle is mapped to the key handle; sending the received request to the hardware security server associated with the identified key handle to execute the command and return a response after executing the command; and The returned response received from the hardware security server is sent to the client associated with the unique numeric handle.

7. The medium of claim 6, wherein the executable code, when executed by the processor, further causes the processor to: receiving a previous request from the client, wherein the previous request is an API request to retrieve the key handle from the hardware security server; sending the previous request to the hardware security server to retrieve the key handle, wherein the key handle was generated by the hardware security server; storing the unique numeric handle and the key handle in a data structure in memory, wherein the unique numeric handle is generated and associated with the key handle, and wherein the key handle is received from the hardware security server after sending the previous request to the hardware security server; and The generated unique numerical handle is sent to the client, wherein the generated unique numerical handle is sent for subsequent API requests to the hardware security server.

8. The medium of claim 7, wherein the executable code, when executed by the processor, further causes the processor to: receiving a subsequent request from the client, wherein the subsequent request includes the unique numerical handle, and wherein the unique numerical handle is generated in response to the previous request from the client; sending the subsequent request to a different hardware security server having a different key handle, wherein the different key handle is retrieved from the memory by searching for the different key handle associated with the different hardware security server using the unique numeric handle; and A subsequent response is sent to the client, wherein the subsequent response is received from the different hardware security server as a result of sending the subsequent request to the different hardware security server having the different key handle.

9. The medium of claim 6, wherein the executable code, when executed by the processor, further causes the processor to: receiving a new key handle from the hardware security server as a response to sending the request to the hardware security server and as a result of reconfiguring the hardware security server; and The new key handle associated with the unique numeric handle is stored in a memory, wherein the new key handle from the reconfigured hardware security server replaces the key handle in the memory.

10. The medium of claim 6, wherein the key handle is mapped to the unique numeric handle by linking the unique numeric handle to a plurality of key handles stored in a data structure in memory, and wherein each of the key handles in the plurality of key handles is associated with a particular hardware security server.

11. A network traffic manager device comprising: Memory, said memory including programming instructions stored in said memory; and a processor configured to execute the programming instructions stored in the memory to: receiving a request from a client, wherein the request includes a unique numerical handle and a command to a hardware security server, and wherein the unique numerical handle is generated as a response to a previous request from the client; identifying a key handle associated with the received unique numeric handle, wherein the hardware security server associated with the identified key handle is configured to execute the received command, and wherein the received unique numeric handle is mapped to the key handle; sending the received request to the hardware security server associated with the identified key handle to execute the command and return a response after executing the command; and The returned response received from the hardware security server is sent to the client associated with the unique numeric handle.

12. The apparatus of claim 11 , wherein the processor is further configured to execute the programming instructions stored in the memory to: receiving a previous request from the client, wherein the previous request is an API request to retrieve the key handle from the hardware security server; sending the previous request to the hardware security server to retrieve the key handle, wherein the key handle was generated by the hardware security server; storing the unique numeric handle and the key handle in a data structure in the memory, wherein the unique numeric handle is generated and associated with the key handle, and wherein the key handle is received from the hardware security server after sending the previous request to the hardware security server; and The generated unique numerical handle is sent to the client, wherein the generated unique numerical handle is sent for subsequent API requests to the hardware security server.

13. The apparatus of claim 12, wherein the processor is further configured to execute the programming instructions stored in the memory to: receiving a subsequent request from the client, wherein the subsequent request includes the unique numerical handle, and wherein the unique numerical handle is generated in response to the previous request from the client; sending the subsequent request to a different hardware security server having a different key handle, wherein the different key handle is retrieved from the memory by searching for the different key handle associated with the different hardware security server using the unique numeric handle; and A subsequent response is sent to the client, wherein the subsequent response is received from the different hardware security server as a result of sending the subsequent request to the different hardware security server having the different key handle.

14. The apparatus of claim 11 , wherein the processor is further configured to execute the programming instructions stored in the memory to: receiving a new key handle from the hardware security server as a response to sending the request to the hardware security server and as a result of reconfiguring the hardware security server; and The new key handle associated with the unique numeric handle is stored in the memory, wherein the new key handle from the reconfigured hardware security server replaces the key handle in the memory.

15. The apparatus of claim 11 , wherein the key handle is mapped to the unique numeric handle by linking the unique numeric handle to a plurality of key handles stored in a data structure in the memory, and wherein each of the key handles in the plurality of key handles is associated with a particular hardware security server.

16. A network traffic management system comprising a traffic management device, a client device, or a server device, the network traffic management system comprising a memory, the memory including programming instructions stored thereon; and a processor configured to execute the stored programming instructions to: receiving a request from a client, wherein the request includes a unique numerical handle and a command to a hardware security server, and wherein the unique numerical handle is generated as a response to a previous request from the client; identifying a key handle associated with the received unique numeric handle, wherein the hardware security server associated with the identified key handle is configured to execute the received command, and wherein the received unique numeric handle is mapped to the key handle; sending the received request to the hardware security server associated with the identified key handle to execute the command and return a response after executing the command; and The returned response received from the hardware security server is sent to the client associated with the unique numeric handle.

17. The network traffic management system of claim 16, wherein the processor is further configured to execute the programming instructions stored in the memory to: receiving a previous request from the client, wherein the previous request is an API request to retrieve the key handle from the hardware security server; sending the previous request to the hardware security server to retrieve the key handle, wherein the key handle was generated by the hardware security server; storing the unique numeric handle and the key handle in a data structure in the memory, wherein the unique numeric handle is generated and associated with the key handle, and wherein the key handle is received from the hardware security server after sending the previous request to the hardware security server; and The generated unique numerical handle is sent to the client, wherein the generated unique numerical handle is sent for subsequent API requests to the hardware security server.

18. The network traffic management system of claim 17, wherein the processor is further configured to execute the programming instructions stored in the memory to: receiving a subsequent request from the client, wherein the subsequent request includes the unique numerical handle, and wherein the unique numerical handle is generated in response to the previous request from the client; sending the subsequent request to a different hardware security server having a different key handle, wherein the different key handle is retrieved from the memory by searching for the different key handle associated with the different hardware security server using the unique numeric handle; and A subsequent response is sent to the client, wherein the subsequent response is received from the different hardware security server as a result of sending the subsequent request to the different hardware security server having the different key handle.

19. The network traffic management system of claim 16, wherein the processor is further configured to execute the programming instructions stored in the memory to: receiving a new key handle from the hardware security server as a response to sending the request to the hardware security server and as a result of reconfiguring the hardware security server; and The new key handle associated with the unique numeric handle is stored in the memory, wherein the new key handle from the reconfigured hardware security server replaces the key handle in the memory.

20. The network traffic management system of claim 16, wherein the key handle is mapped to the unique numeric handle by linking the unique numeric handle to a plurality of key handles stored in a data structure in the memory, and wherein each of the key handles in the plurality of key handles is associated with a particular hardware security server.

Images