PKCS #7 Certificate Encryption Using One AES Key per Batch
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing process of using Hardware Security Modules (HSMs) to retrieve AES keys for decrypting PKCS #7 files is expensive and time-consuming, especially when multiple digital certificates are needed for multiple electronic devices, leading to high IT costs and potential network connectivity issues.
Innovation Solution
A system that uses a single AES key to encrypt multiple PKCS #7 files, allowing a single call to an HSM to obtain the key, which can then decrypt multiple certificates, reducing the need for repeated HSM calls and improving efficiency and cost-effectiveness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a new AES key is used for each electronic device, then security is improved, but the number of HSM calls increases and costs increase
Solution Approach 1:
The patent segments the key management process into two parts: a long-lived master AES key stored in HSM for batch operations, and device-specific cryptographic material embedded in each PKCS#7 file. This allows the master key to be reused across multiple devices while maintaining unique security credentials for each device through individual certificate signatures.
Solution Approach 2:
The patent performs preliminary encryption of multiple PKCS#7 files with the master AES key before distribution. This advance preparation allows the client to retrieve a single key from HSM and use it to decrypt multiple certificate packages, eliminating the need for repeated HSM calls during device provisioning.
2Reliability
If multiple calls to remote HSMs are made, then each device can be securely provisioned, but time and costs increase
Solution Approach 1:
The patent merges multiple separate key retrieval operations into a single batch operation. By encrypting multiple PKCS#7 files with the same master AES key, the system combines what would otherwise require multiple independent HSM calls into one unified key retrieval and distribution process.
Solution Approach 2:
The master AES key serves multiple functions: it encrypts multiple different PKCS#7 files containing certificates for different devices, and enables the client to provision numerous devices sequentially using a single key retrieval operation, making the key management system universally applicable to batch provisioning scenarios.
3Speed
If on-premises HSMs are deployed, then key retrieval is faster, but infrastructure costs increase
Solution Approach 1:
The patent creates a copy of the encrypted PKCS#7 files containing the master AES key and distributes them to clients. This allows clients to have local access to the encrypted certificate packages without requiring permanent HSM infrastructure, while still enabling fast decryption using the retrieved key.
Data Source
AI summary
Cryptographic systems and methods are provided. A method, according to one implementation, includes a step of generating a plurality of key pairs in response to receiving a request from a client for one or more digital certificates. The key pairs are associated respectively with the one or more digital certificates. Also, each key pair includes a public key and a private key. The method further includes a step of utilizing at least the plurality of key pairs to generate the one or more digital certificates. Also, the method includes a step of encrypting the one or more digital certificates and respective private keys using a single Advanced Encryption Standard (AES) key. The method also includes a step of sending the encrypted one or more digital certificates and private keys back to the client.