Private Hardware Security Key Migration Across Vendor APIs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Different hardware security systems from various vendors have disparate application programming interfaces (APIs) for storing cryptographic keys, making it challenging to migrate security hardware keys between them.
Innovation Solution
A method involving a network traffic management system that encrypts a symmetric key from a first hardware security system using a public key from a second system, transfers the encrypted key, and decrypts it at the destination system, ensuring the original key remains encrypted throughout the migration process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If different hardware security systems use different vendor-specific APIs and storage methods, then each system can maintain its own security implementation, but key migration between systems becomes difficult and complex
Solution Approach 1:
The patent introduces a key migration service as an intermediary component that mediates between the first hardware security system and the second hardware security system. This service receives encrypted key data from the first system, processes it through cryptographic operations, and delivers it to the second system. The intermediary handles the complexity of vendor-specific APIs and encryption schemes, allowing key migration without requiring direct compatibility between different hardware security system vendors.
2Ease of operation
If cryptographic keys are transferred between hardware security systems, then key migration is achieved, but the risk of key exposure in cleartext increases
Solution Approach 1:
The patent applies preliminary encryption to the cryptographic key before it leaves the first hardware security system. The key is encrypted using the public key of the second hardware security system or a migration service key pair before transmission. This preliminary security measure ensures that the key never exists in cleartext during transit or storage in the migration service, eliminating the exposure risk while enabling migration.
Solution Approach 2:
The patent creates an encrypted copy of the cryptographic key for migration purposes rather than transferring the original unencrypted key. The migration service stores and processes only encrypted representations of the key, using cryptographic operations to transform and transfer key material without exposing the actual secret values. This copying approach allows migration while maintaining security.
Data Source
AI summary
Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with migrating keys between a first hardware security system and a second hardware security system includes receiving an encrypted symmetric key from a first hardware security system. The symmetric key generated by the first hardware security system is encrypted using a public key generated from a second hardware security system. A generated public key is sent to the first hardware security system prior to encrypting the symmetric key. The received encrypted symmetric key is sent to the second hardware security system. An encrypted original key from the first hardware security system is received upon sending the encrypted symmetric key to the second hardware security system. The original key is encrypted using the symmetric key. The migration is completed when the second hardware security system decrypts the sent encrypted original key using the sent encrypted symmetric key.