Device Managed Cryptographic Keys via Secure API
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web browsers currently manage cryptographic keys, which can make these keys more vulnerable to compromise due to the browser's limited security compared to the device's operating system or secure hardware.
Innovation Solution
Implementing a device-managed key-management API that offloads key management from the browser to the device, using secure software or hardware to manage and store cryptographic keys, ensuring they are not directly accessible to the browser.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the browser manages cryptographic keys directly, then the browser can perform cryptographic operations independently, but the security of the keys deteriorates due to the browser's limited security compared to device operating systems or secure hardware
Solution Approach 1:
The patent introduces a key management API as an intermediary layer between the browser and the cryptographic key storage system. This API serves as a mediator that allows the browser to request and perform cryptographic operations without directly accessing or storing the private keys. The secure element or device operating system acts as the intermediary that securely stores the keys and provides cryptographic services through controlled interfaces, thereby resolving the contradiction between operational independence and security.
2Speed
If the browser stores cryptographic keys locally, then key access speed improves, but the vulnerability to key compromise increases
Solution Approach 1:
The patent extracts the key storage function from the browser and places it in a secure element or device operating system with enhanced security protections. By taking out the keys from the browser's local storage, the system eliminates the harmful factor of browser-based key compromise while maintaining efficient key access through the key management API interface. This extraction resolves the contradiction between access speed and security vulnerability.
3Reliability
If device-managed key management is implemented, then key security improves, but system complexity increases due to additional API layers and secure hardware dependencies
Solution Approach 1:
The key management API is designed with universality to serve multiple functions: it provides key storage, key retrieval, cryptographic operation execution, and security policy enforcement through a single unified interface. This multi-functional design reduces the need for separate complex subsystems and simplifies the overall architecture despite the enhanced security requirements. The API handles diverse cryptographic needs through standardized calls to the secure element or operating system, thereby managing complexity while improving security.
Data Source
AI summary
Techniques are disclosed relating to improving key management on devices. In various embodiments, a device receives, from a browser via a key-management API supported by the device, a request for a browser session to receive access to a cryptographic key managed by the device. The key-management API of the device determines whether to grant the browser session access to the cryptographic key based on verification of a signed attestation from a server corresponding to the browser session and using metadata stored about the cryptographic key. Based on the determination, the device provides access to the cryptographic key via the key-management API. In some embodiments, providing access to the cryptographic key includes performing a requested cryptographic operation using the cryptographic key and without providing the cryptographic key to the browser. In some embodiments, the cryptographic key is managed by an operating system, a secure element, or another application of the device.