Public Key Token Integrity via Segmentation and MAC
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems lack adequate protection and integrity for public keys when they leave a secure environment, such as a Hardware Security Module (HSM), which can compromise security.
Innovation Solution
A computer-implemented method and system for creating a public key token that includes generating a public key and a private key using a master key, encrypting the private key, and creating a Common Cryptographic Architecture (CCA) key token with a set of permissions and a message authentication code (MAC) to ensure the integrity and secure usage of the public key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public keys are stored in a secure environment like HSM, then security is maintained, but the public keys cannot be accessed or used outside the secure environment
Solution Approach 1:
The public key is segmented into two parts: the secret key material remains securely stored in the HSM, while a public key token (containing public key data and permissions) is extracted and made accessible outside the HSM. This segmentation allows the system to maintain security for sensitive operations while enabling external access to public key information.
Solution Approach 2:
A public key token acts as an intermediary between the secure HSM environment and external systems. The token contains embedded permissions and MACs that mediate access control, allowing external parties to verify public keys without direct access to the HSM or the secret key material.
2Ease of operation
If public keys are made accessible outside secure environment, then usability is improved, but integrity and security protection deteriorates
Solution Approach 1:
Permissions and Message Authentication Codes (MACs) are pre-computed and embedded into the public key token before it leaves the secure environment. This preliminary action ensures that integrity protection is built into the token structure itself, allowing verification without requiring continuous connection to the HSM.
Solution Approach 2:
The MAC embedded in the public key token provides a feedback mechanism for integrity verification. External systems can verify the token's authenticity and the public key's integrity by checking the MAC, providing continuous security validation even when the key is used outside the secure environment.
3Device complexity
If traditional public key protection methods are used, then implementation is simple, but security against tampering and unauthorized access is insufficient
Solution Approach 1:
The public key token is constructed as a composite structure combining multiple security elements: public key data, embedded permissions, and Message Authentication Codes. This composite structure provides multi-layered security protection while maintaining a standardized, implementable format based on existing CCA token structures.
Data Source
AI summary
Embodiments are directed to a computer-implemented method, computer system, and computer program product for creating a public key token. A public key and private key are generated, using a master key. A set of permissions is received for the public key and private key that note the allowable uses for the public key and private key. Thereafter, the set of permissions, encrypted public key, and other associated information is placed in a public key token.