Method and system for managing at least one root key of a public key infrastructure

Abstract

Method and system for managing at least one root key of a public key infrastructure. The invention relates to a method and a system for managing at least one root key of a public key infrastructure. The method implements, in offline steps, the following: A) generation (46) of a root key of the instantiation of said public key infrastructure, B) encryption (48) of said root key by a symmetric encryption algorithm with a secret key (Ks), and obtaining an encrypted root key, C) splitting (50) of said secret key (Ks) into a number N of secret fragments, D) conversion (51) of each secret fragment into a sequence of codes, E) saving (52) of each sequence of codes corresponding to a secret fragment on at least one separate physical medium, external to the computing device, F) erasure (56) of said instantiation of the public key infrastructure and of the parameters and results of each of steps A) to D).Figure for the abridged version: 2.

Description

Title of the invention: Method and system for managing at least one root key of a public key infrastructure

[0001] The present invention relates to a method for managing at least one root key of a public key infrastructure, and an associated system.

[0002] The invention lies in the field of information systems security, and finds applications in any information system requiring the implementation of a public key infrastructure or PKI (from the English "Public Key Infrastructure").

[0003] As is known, a public key infrastructure is a set of components, including cryptographic equipment and software, and human procedures, for the management of public keys, used for the encryption and authentication of data in an information system.

[0004] In order to ensure the confidentiality, integrity and authenticity of information system data, in any application domain, it is known to implement a data encryption infrastructure using asymmetric encryption keys managed by a PKI.

[0005] In a known manner, a PKI infrastructure allows the authentication of keys and certificates, on several hierarchical strata, comprising a highest stratum, or root, which generates one or more root keys, an intermediate stratum which generates one or more intermediate keys, using the root key, and one or more lower strata, comprising the user equipment, to which are associated low-level public encryption keys, depending on the intermediate keys.

[0006] Thus, for complete validation of data authenticity, it is critical to ensure the confidentiality of the keys at the highest levels, and in particular the root key(s), by securely storing these keys over a long period. It is especially necessary to prevent any compromise by malicious attacks or, where applicable, by malicious agents with legitimate access to the system on which the PKI infrastructure is installed.

[0007] On the other hand, it is also necessary to ensure the availability of root keys in order to operate the PKI infrastructure, in particular to issue certificates to user equipment to ensure their authenticity or any other desired service.

[0008] However, the needs for absolute confidentiality on the one hand and availability on the other are contradictory and difficult to reconcile.

[0009] To solve the problem of storing the secrets of a PKI infrastructure, and in particular the root keys of the infrastructure, it is known to use modules Security hardware, or HSMs (Hardware Security Modules), is dedicated to this function and considered unattackable. Such HSMs are particularly expensive and, moreover, are susceptible to destruction in the event of a failure (e.g., fire, flood, etc.).

[0010] Remote distributed storage solutions for PKI are also known in a service infrastructure or "cloud computing," with several data storage providers offering secure storage and secrets management solutions, for example Amazon's AWS® and Google's CloudHSM®. However, such services are managed remotely by external providers and raise other issues of confidentiality and operational independence.

[0011] The present invention proposes a less expensive and local solution, which makes it possible to ensure both the confidentiality and availability of secrets in a public key infrastructure.

[0012] To this end, the invention proposes a method for managing at least one root key of a public key infrastructure, implemented on a computing device comprising at least one computing processor and at least one associated electronic memory. The method includes an installation for obtaining parameters associated with an instantiation of a public key infrastructure and for performing operations with said public key infrastructure, and disconnecting the computing device from any communication network. The method comprises the following steps performed offline during a first phase of the method: • A) generation of a root key for the instantiation of said public key infrastructure, • B) encryption of said root key by a symmetric secret-key encryption algorithm, and obtaining an encrypted root key, • C) partitioning said secret key into a number N of secret fragments, • D) conversion of each secret fragment into a sequence of codes, • E) saving each code sequence corresponding to a fragment secret stored on at least one separate physical medium, external to the computing device, • F) erasure of said public key infrastructure instantiation and of the parameters and results of each of steps A) to D) previously implemented.

[0013] Advantageously, the method of the invention offers distributed storage of encrypted root key fragments, in the form of code sequences, on separate, independent media. Advantageously, this increases security against potential malicious attacks.

[0014] The method for managing at least one root key of a public key infrastructure according to the invention may have one or more of the following characteristics, taken independently or according to all acceptable combinations.

[0015] Each code sequence is saved in a plurality of copies on separate physical media.

[0016] The secret key splitting implements a Shamir secret sharing algorithm.

[0017] The conversion step implements an algorithm for generating mnemonic codes.

[0018] The mnemonic code generation algorithm uses the BIP39 standard.

[0019] During the save-up step, the said hardware used to store each sequence of codes is paper.

[0020] The process further comprises the following steps, carried out in a second phase subsequent to the first phase:

[0021] - obtaining a number K of code sequences, the number K being less than or equal to N,

[0022] - obtaining K fragments, each fragment being obtained by inverse conversion of a corresponding code sequence,

[0023] -reconstruction of a secret key, called the reconstructed secret key, from the K fragments obtained,

[0024] -decryption of a root key to obtain a decrypted root key from the encrypted root key using the reconstructed secret key.

[0025] The method further comprises generating one or more intermediate keys, creating a certificate using the decrypted root key and authenticating said intermediate keys using said certificate.

[0026] According to another aspect, the invention relates to a system for managing at least one root key of a public key infrastructure, comprising at least one computing device including at least one computing processor and at least one associated electronic memory. The system implements an installation module configured to obtain parameters associated with an instantiation of a public key infrastructure and to perform operations with said public key infrastructure.

[0027] Following a disconnection of the computing device from any communication network, the computing device is configured to implement, in a first phase, offline: • a module for generating a root key for the instantiation of said public key infrastructure, • an encryption module for said root key using an algorithm symmetric encryption with a secret key, and obtaining an encrypted root key, • a module for splitting said secret key into a number N of secret fragments, • a module for converting each secret fragment into a sequence of codes, • a backup module for each code sequence corresponding to a secret fragment on at least one separate physical medium, external to the computing device, • a module for erasing said instantiation of the public key infrastructure and the parameters and results obtained by the implemented modules.

[0028] According to a particular feature, the management system of at least one root key of a public key infrastructure, in which at least one of said computing devices is configured to, in a second phase subsequent to the first phase, implement:

[0029] - a module for obtaining a number K of code sequences, the number K being less than or equal to N,

[0030] - a module for obtaining K fragments, each fragment being obtained by inverse conversion of a corresponding code sequence,

[0031] - a module for reconstructing a secret key, called the reconstructed secret key, from the K fragments obtained,

[0032] -a decryption module configured to obtain a decrypted root key from the encrypted root key using the reconstructed secret key.

[0033] Other features and advantages of the invention will become apparent from the description given below, by way of example and not limitation, with reference to the accompanying figures, among which:

[0034] [Fig-1] [Fig.1] schematically illustrates a system for managing at least one key root of a public key infrastructure according to an implementation mode;

[0035] [Fig.2] [Fig.2] is a synoptic diagram of the main steps in a creation and storage of root key(s) in a management system of at least one PKI infrastructure root key;

[0036] [Fig.3] [Fig.3] a synoptic diagram of the main steps of a reconstruction process of root key(s) in a management system of at least one PKI infrastructure root key.

[0037] Fig. 1 schematically illustrates a system 2 for managing at least one root key of a public key infrastructure (or PKI) in one embodiment.

[0038] System 2 is configured to implement a method for managing at least one root key of a PKI.

[0039] This process comprises two distinct phases, which are a first phase of creation and storage of root keys, in a secure manner and ensuring good subsequent availability, and a second phase of reconstruction and signing of intermediate keys, subsequent to the first phase.

[0040] Schematically, the first phase is implemented using a computing device 4, and the second phase is implemented using a computing device 6.

[0041] The calculation devices 4 and 6 may be identical or totally distinct.

[0042] Each of the computing devices 4, 6 is an electronic computing device, for example a computer, comprising a computing processor 8, 14, an electronic memory unit 10, 16 and a communication interface 12, 20, configured to communicate via an internal communication bus 15, 17.

[0043] Preferably, the communication interface 12, 20 is a wired-only communication interface; that is, preferably, the computing devices 4, 6 do not have a radio communication interface. Advantageously, this limits protection against potential external malicious attacks and facilitates connection and disconnection from an external network 22, e.g., the Internet. Typically, the communication interface 12, 20 implements the Ethernet protocol, and connection / disconnection is made via a communication cable.

[0044] The computing device 4 is configured to implement the first phase of creating and storing root keys of a PKI infrastructure, which are intended to be secret, as described in detail below.

[0045] In particular, the computing device 4 is configured to implement:

[0046] - a public key infrastructure installation module for obtaining pa metrics associated with an instantiation of a public key infrastructure and performing operational tasks with said public key infrastructure,

[0047] -a module for generating a root key for the instantiation of said public key infrastructure,

[0048] - an encryption module for said root key using a sy encryption algorithm secret key metric, and obtaining an encrypted root key,

[0049] - a module for splitting the secret key into N secret fragments,

[0050] - a module for converting each secret fragment into a sequence of codes,

[0051] -a backup module for each of the codes on a separate medium external to the computing device, and

[0052] -a module for erasing said instantiation of the public key infrastructure and the parameters and results obtained previously.

[0053] The code sequences obtained are saved on 24i to 24N media.

[0054] Preferably, each of said supports 24i to 24N is a physical support printing, for example paper.

[0055] Alternatively, each of said media 24i to 24N is a secure electronic medium, for example an encrypted hardware storage unit, or an encrypted software storage unit.

[0056] Advantageously, the 241 to 24N media can be distributed to various agents, independent of each other, to increase security and reliability.

[0057] In one embodiment, the modules listed above are implemented in the form of software instructions forming a computer program executable by the processor 8.

[0058] Preferably, these modules implemented as software instructions are temporarily loaded into the memory unit 10, and erased as soon as backups are made on external media, in order to maximize security against possible malicious attacks.

[0059] Preferably, the splitting module implements a splitting into fragments such that a number K less than N of fragments is sufficient for the reconstruction of the secret, i.e. of the secret key used.

[0060] Thus, a number K of supports 24ji to 24jK among the N supports 24i to 24N is used in the second phase of reconstruction and signing of intermediate keys.

[0061] The computing device 6 is configured to implement:

[0062] - a module for obtaining a number K of code sequences, the number K being less than or equal to N,

[0063] - a module for obtaining K secret fragments, each secret fragment being obtained by inverse conversion of a corresponding code sequence

[0064] - a module for reconstructing a secret key, called the reconstructed secret key, from the K secret fragments obtained,

[0065] -a decryption module configured to obtain a decrypted root key from the encrypted root key using the reconstructed secret key.

[0066] In addition, the computing device 6 is configured to implement a public key infrastructure installation module to obtain parameters associated with an instantiation of a public key infrastructure, analogous to that implemented by the computing device 4.

[0067] Fig. 2 is a synoptic diagram of the main steps of the first phase of a root key management process of a PKI infrastructure according to one embodiment.

[0068] The method includes steps carried out when the computing device in which the method is implemented is connected to a communication network, and then steps carried out when the computing device is disconnected from any communication network.

[0069] In particular, the method includes a step 40 of installing a system autonomous and secure operating system, for example the Live Linux operating system, which is run on the fly.

[0070] In one embodiment, the installation is carried out by an operator acting on instructions, so as to ensure the reproducibility of the actions.

[0071] Alternatively, an automated installation is also conceivable.

[0072] The process then includes an installation step 42 to obtain parameters associated with an instantiation of a public key infrastructure.

[0073] For example, during step 42, a PKI script is obtained via a communication link of the computing device implementing the process.

[0074] Preferably, the communication link is a wired link.

[0075] Step 42 is followed by step 44 of disconnecting the computing device from the network communication can be compromised, for example, by disconnecting the wired cable that provides the connection by an operator. This ensures maximum security, as remote access to the computing device implementing the process is thus rendered impossible.

[0076] The following steps are performed offline from any communication network.

[0077] Step 44 is followed by step 45, which generates a secret key for the instantiation of said public key infrastructure. A secret key Ks is a key generated to encrypt the backup of the instantiation of said public key infrastructure during step 52, described below.

[0078] Step 45 is followed by a step 46 of generating a root key Kr of the instantiation of said public key infrastructure.

[0079] A root key is a key generated by the highest hierarchical stratum, also called a certification authority or CA (for "Certification Authority").

[0080] The root key is a higher-level secret, the confidentiality and integrity of which are critical for the management of the public key infrastructure.

[0081] Preferably, the root key is generated with a high-entropy algorithm, making it possible to ensure a satisfactory level of security.

[0082] The process then includes a step 48 of encrypting the root key Kr generated in step 46, by a symmetric encryption algorithm with a secret key (key Ks) generated in step 45, and of obtaining an encrypted root key.

[0083] Preferably the encryption algorithm applied is a secret-key process, for example the AES 256 standard, using a random secret key generated in accordance with the standard used.

[0084] The process also includes a step 50 of splitting the secret key Ks used in the encryption step 48 into a number N of secret fragments.

[0085] The number N is an integer, for example between 5 and 20.

[0086] The fragments are numbered from 1 to N, the respective number being associated with each fragment, and also provided later during the reconstruction stage.

[0087] Preferably, the splitting of the secret key Ks into fragments is carried out by applying Shamir's secret sharing algorithm (in English "Shamir's Secret Sharing" or SSS), which has the advantage of allowing total reconstruction from only K fragments, K being an integer less than N.

[0088] For example, K= px N, rounded up to the nearest integer, with p a real coefficient between 0.5 and 0.8.

[0089] Following the cutting step 50, the process includes a step 51 of converting each secret fragment into a sequence of codes.

[0090] Preferably, the conversion is carried out by a mnemonic code generation algorithm, for example BIP 39.

[0091] Alternatively, any algorithm having an integrity function can be used here.

[0092] In particular, the BIP 39 algorithm transforms sequences of symbols into codes, which are words of a natural language, for example words in the English language.

[0093] Advantageously, the use of mnemonic codes allows integrity control by a human operator.

[0094] The code sequences are saved (save step 52) each on at least one separate medium, external to the computing device.

[0095] Preferably, the support is a material printing support, for example paper.

[0096] Alternatively, each of said media is a secure electronic medium, for example an encrypted storage unit.

[0097] For example, in one embodiment each sequence of codes is saved in two copies on physical media, preferably paper.

[0098] This allows each copy to be assigned to a distinct agent, each agent being, for example, an authorized administrator.

[0099] In addition, the root key Krchcrypted in step 48 is also saved on a chosen storage medium, for example an electronic storage medium (e.g. a USB key) or a physical printing medium, for example paper.

[0100] The method may include an additional optional testing step, comprising an inverse conversion of each code sequence into a reconstructed fragment, a reconstruction of said secret key from the reconstructed fragments, a decryption of the encrypted root key and a comparison of the decrypted root key with the root key obtained in step 46.

[0101] In case of a tie, the test has a positive result.

[0102] Finally, the process includes a step 54 of erasure of said instantiation of the public key infrastructure and of the parameters and results of each of the steps 45 at 50, and a step 56 of removal of the operating system installed at step 40.

[0103] Thus, advantageously, security and confidentiality are maximized, a subsequent malicious attack intended to recover information relating to the first phase of the process being impossible after steps 54 and 56 of erasure and deletion of the operating system.

[0104] Fig. 3 is a synoptic diagram of the main steps of the second phase of a root key management process of a PKI infrastructure according to one embodiment.

[0105] This second phase performs a key reconstruction and signing.

[0106] The second phase includes initialization steps 60, installation 62 and disconnection 64, analogous to steps 40, 42, 44 described with reference to [Fig.2], implemented on the computing device carrying out the second phase of the process.

[0107] In addition, during one of the initialization steps 60 or installation steps 62, the encrypted root key is also imported and stored.

[0108] The process then includes steps carried out offline from any communication network.

[0109] During a step 66, code sequences, corresponding to fragments of secret key, are obtained by the computing device.

[0110] For example, the code sequences are inserted via a human-machine interface of the computing device, each code sequence being associated with a fragment number, according to the fragment numbering carried out in step 50.

[0111] The process then includes a step 68 of obtaining fragments from the code sequences, by applying the mnemonic decoding corresponding to the mnemonic coding applied in the first phase.

[0112] The process includes a step 70 of reconstructing the secret key, called the reconstructed secret key, from K fragments obtained in step 68.

[0113] Advantageously, the number K of fragments is less than the number N initially obtained.

[0114] For example, as indicated with reference to [Fig.2], ,K= px N, rounded up to the nearest integer, with p a real coefficient between 0.5 and 0.8.

[0115] For example, the reconstruction applies Shamir's secret sharing algorithm.

[0116] The PKI root key is decrypted (step 72) with the secret key reconstructed in reconstruction step 70.

[0117] The decryption step 72 implements a symmetric secret-key decryption algorithm, corresponding to the encryption algorithm implemented in the first phase, in encryption step 48, applied with the reconstructed secret key obtained in step 70. Thus, from the encrypted root key, the root key is obtained decrypted, by implementing the secret-key decryption algorithm using the reconstructed secret key.

[0118] Next, preferably, one or more intermediate keys are generated (step 74) and authenticated by creating a certificate using the decrypted root key.

[0119] These intermediate keys and certificates are distributed to the intermediate layers of the PKI, after authenticity checks.

[0120] The process then includes a step 76 of deleting the parameters and results, and of deleting the installed operating system, so as to prevent any attack intended to recover the root key.

[0121] Advantageously, the proposed method, by allowing the saving of secret fragments in the form of code sequences on separate hardware media, makes it possible to increase security against possible attacks, the recovery of one of the hardware media not being sufficient for an attack.

[0122] Advantageously, the use of a mnemonic conversion allows validation and memorization by agents (e.g., people in a company).

[0123] Advantageously, the use of a secret sharing algorithm, e.g. the SSS algorithm, makes it possible to increase availability, since only K encrypted fragments are needed to reconstruct a secret key, allowing the absence of some fragments without harming overall availability.

Claims

Demands

1. A method for managing at least one root key of a public key infrastructure, implemented on a computing device comprising at least one computing processor and at least one associated electronic memory, the method comprising: - an installation (40, 42) for obtaining parameters associated with an instantiation of a public key infrastructure and for performing operations with said public key infrastructure, - a disconnection (44) of the computing device from any communication network, the following steps being carried out offline, during a first phase of the method: • A) generation (46) of a root key of the instantiation of said public key infrastructure, • B) encryption (48) of said root key by a symmetric encryption algorithm with a secret key (Ks), and obtaining an encrypted root key,• C) partitioning (50) said secret key (Ks) into a number N of secret fragments, • D) conversion (51) of each secret fragment into a sequence of codes, • E) saving (52) of each sequence of codes corresponding to a secret fragment on at least one separate physical medium, external to the computing device, • F) erasure (56) of said instantiation of the public key infrastructure and of the parameters and results of each of the steps A) to D) implemented previously.

2. A method according to claim 1, wherein each sequence of codes is saved in a plurality of copies on separate physical media.

3. A method according to any one of claims 1 or 2, wherein the secret key splitting step (50) implements a Shamir secret sharing algorithm.

4. A method according to any one of claims 1 to 3, wherein the conversion step (51) implements a mnemonic code generation algorithm.

5. A method according to claim 4, wherein the mnemonic code generation algorithm uses the BIP39 standard.

6. A method according to any one of claims 1 to 5, wherein in the saving step (52), said material medium used to store each sequence of codes is paper.

7. A method according to any one of claims 1 to 6, further comprising the following steps, carried out in a second phase subsequent to the first phase: - obtaining (66) a number K of code sequences, the number K being less than or equal to N, - obtaining (68) K fragments, each fragment being obtained by inverse conversion of a corresponding code sequence, - reconstruction (70) of a secret key, called the reconstructed secret key, from the K fragments obtained, - decryption (72) of a root key to obtain a decrypted root key from the root key encrypted using the reconstructed secret key.

8. A method according to claim 7, comprising a generation (74) of one or more intermediate keys, creation of a certificate using the decrypted root key and authentication of said intermediate keys using said certificate.

9. A system for managing at least one root key of a public key infrastructure, comprising at least one computing device (4, 6) having at least one computing processor (8, 14) and at least one associated electronic memory (10, 16), the system implementing: - an installation module configured to obtain parameters associated with an instantiation of a public key infrastructure and to perform operations with said public key infrastructure, - following a disconnection of the computing device from any communication network, the computing device is configured to implement, in a first offline phase: • a module for generating a root key of the instantiation of said public key infrastructure public, • a module for encrypting said root key by a symmetric secret key encryption algorithm (Ks), and obtaining an encrypted root key, • a module for splitting said secret key (Ks) into a number N of secret fragments, • a module for converting each secret fragment into a sequence of codes, • a module for saving each sequence of codes corresponding to a secret fragment on at least one separate hardware medium, and external to the computing device, • a module for erasing said instantiation of the public key infrastructure and the parameters and results obtained by the implemented modules.

10. A system for managing at least one root key of a public key infrastructure according to claim 9, wherein at least one of said computing devices is configured to, in a second phase subsequent to the first phase, implement: - a module for obtaining a number K of code sequences, the number K being less than or equal to N, - a module for obtaining K fragments, each fragment being obtained by inverse conversion of a corresponding code sequence, - a module for reconstructing a secret key, called the reconstructed secret key, from the K fragments obtained, - a decryption module configured to obtain a decrypted root key from the encrypted root key using the reconstructed secret key.

Images