Cloud Keying Service for Secure Software Distribution

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Remote application servers lack the security measures of internal, trusted servers, increasing the complexity of secure software package distribution due to the need for encryption and signing, which is not typically applied to internal servers.

Innovation Solution

A cloud-based keying and signing service generates a private and public key pair for users, signs software packages using a computed hash, and decrypts symmetric keys for secure distribution, ensuring the integrity and authenticity of software packages by managing keys and encryption on the cloud.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If encryption and signing are implemented on remote application servers, then security is improved, but device complexity increases

Engineering Contradiction:

ImprovesecurityVSAvoidcomplexity of secure implementation

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts the complex key management and cryptographic operations from the remote application server and relocates them to a dedicated cloud-based key management service. This separation allows the application server to focus on its primary function while the specialized service handles security operations, reducing overall system complexity while maintaining strong security.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces a cloud-based key management service as an intermediary between the application server and clients. This intermediary handles all cryptographic operations including key generation, signing, and decryption, simplifying the implementation for both the server and clients while ensuring robust security through centralized management.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If cloud-based key management service is implemented, then ease of operation is improved, but device complexity increases

Engineering Contradiction:

Improveease of software package distributionVSAvoidcomplexity of key management system

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

The cloud-based key management service automatically performs key generation, signing, and decryption operations without requiring manual intervention from administrators or users. The service self-manages the cryptographic lifecycle including generating key pairs, signing software packages, and decrypting symmetric keys, thereby simplifying operations while the underlying complexity is handled by the automated system.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS9059856B2Providing security services on the cloud

Publication Date: 2015.06.16 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Embodiments are directed to the providing a cloud keying and signing service and to securing software package distribution on the cloud. In an embodiment, a computer system instantiates a signing service configured to sign software packages. The computer system receives a signing request from a computer user requesting that a selected software package be signed. The signing request includes a computed hash of the selected software package. The computer system generates a private and public key pair on behalf of the computer user and stores the private key of the generated key pair in a secure data store.