Dual-interface key management

1. A system comprising an access card, the access card comprising:

an interface;

a memory; and

a processor coupled to the interface and to the memory, wherein

the processor is configured to:

receive challenge data, according to an authentication protocol, via the interface of the access card, wherein

the challenge data is received in lieu of a challenge,

the challenge comprises one or more random numbers, and

the challenge is processed to generate a response according to the authentication protocol,

obtain key-management information from the challenge data, wherein the processor is configured to obtain the key-management information by

extracting encrypted key-management information by processing the challenge data, and

retrieving the key-management information by decrypting the encrypted key-management information, and

store the key-management information in the memory of the access card.

2. The system of claim 1 , wherein

the challenge data is comprised in a public key infrastructure (PKI) authentication request; and

the processor is configured to request a PKI authentication of a provider of the key-management information.

3. The system of claim 1 , wherein the processor is configured to:

generate another response to the key-management information; and

transmit the another response in the form of a second challenge data to a provider of the key-management information.

4. The system of claim 1 , wherein

the key-management information is encrypted within the challenge data.

5. The system of claim 1 , wherein

the processor is further configured to generate another response based on the challenge data.

6. The system of claim 1 , wherein

the authentication protocol is a secure socket layer (SSL) protocol that uses client certificate authentication,

the processing the challenge data comprises

using the client certificate authentication to perform the extracting of the encrypted key-management information.

7. The system of claim 1 , wherein

the processor is further configured to

receive, according to the authentication protocol, the challenge, and

generate the response by decrypting, according to the authentication protocol, the challenge.

8. The system of claim 1 , wherein

another key is encrypted within the challenge data,

the another key is used in a generation of an access request, and

the access request comprises a request for authentication.

9. The system of claim 1 , wherein

the authentication protocol comprises a PKI protocol, and

the processing the challenge data comprises

using a cryptographic key according to the PKI protocol.

10. A method comprising:

receiving, by an access card, challenge data according to an authentication protocol, wherein

the receiving is performed via an interface,

the challenge data is received in lieu of a challenge,

the challenge comprises one or more random numbers, and

the challenge is processed to generate a response according to the authentication protocol;

obtaining, by the access card, key-management information from the challenge data,

wherein

the obtaining comprises

extracting encrypted key-management information by processing the challenge data, and

retrieving the key-management information by decrypting the encrypted key-management information; and

storing, by the access card, the key-management information in a memory of the access card.

11. The method of claim 10 , wherein

the challenge data is comprised in a public key infrastructure (PKI) authentication request; and

the method further comprises

requesting a PKI authentication of a provider of the key-management information.

12. The method of claim 10 , further comprising:

generating another response to the key-management information; and

transmitting the another response in the form of a second challenge data to a provider of the key-management information.

13. The method of claim 10 , wherein

the key-management information is encrypted within the challenge data.

14. The method of claim 10 , further comprising:

generating another response based on the challenge data.

15. The method of claim 10 , wherein

the authentication protocol is a secure socket layer (SSL) protocol that uses client certificate authentication,

the processing the challenge data comprises

using the client certificate authentication to perform the extracting of the encrypted key-management information.

16. The method of claim 10 , wherein

another key is encrypted within the challenge data,

the another key is used in a generation of an access request, and

the access request comprises a request for authentication.

17. The method of claim 10 , wherein

the authentication protocol comprises a PKI protocol, and

the processing the challenge data comprises

using a cryptographic key according to the PKI protocol.

18. The method of claim 10 , further comprising:

receiving, according to the authentication protocol, the challenge; and

generating a response by decrypting, according to the authentication protocol, the challenge.

19. The computer program product of claim 18 , wherein

the challenge data is comprised in a public key infrastructure (PKI) authentication request; and

the plurality of instructions further comprise

a fourth set of instructions, executable on the computer system, configured to request a PKI authentication of a provider of the key-management information.

20. A computer program product comprising a non-transitory computer-readable medium storing:

a plurality of instructions, comprising:

a first set of instructions, executable on a computer system, configured to receive, by an access card, challenge data according to an authentication protocol, wherein

the challenge data is received in lieu of a challenge,

the challenge comprises one or more random numbers,

according to the authentication protocol, the challenge is processed to generate a response, and

the receiving is performed via an interface,

a second set of instructions, executable on the computer system, configured to obtain, by the access card, key-management information from the challenge data, wherein

the second set of instructions is further comprises instructions executable and configured to perform the obtaining the key-management information by

extracting encrypted key-management information by processing the challenge data, and

retrieving the key-management information by decrypting the encrypted key-management information; and

a third set of instructions, executable on the computer system, configured to store, by the access card, key-management information in a memory of the access card.

21. The computer program product of claim 20 , wherein the plurality of instructions further comprise:

a fourth set of instructions, executable on the computer system, configured to

generate another response to the key-management information, and

a fifth set of instructions, executable on the computer system, configured to

transmit the another response in the form of a second challenge data to a provider of the key-management information.

22. The computer program product of claim 20 , wherein the key-management information is encrypted within the challenge data.

23. The computer program product of claim 20 , wherein the plurality of instructions further comprise:

a fourth set of instructions, executable on the computer system, configured to generate another response based on the challenge data.

24. The computer program product of claim 20 , wherein

the authentication protocol is a secure socket layer (SSL) protocol that uses client certificate authentication,

wherein the second set of instructions is further executable and configured to use the client certificate authentication to perform the extracting of the encrypted key-management information.

25. The computer program product of claim 20 , wherein

another key is encrypted within the challenge data,

the another key is used in a generation of an access request, and

the access request comprises a request for authentication.

26. The computer program product of claim 20 , wherein

the authentication protocol comprises a PKI protocol, and wherein

the processing the challenge data comprises

using a cryptographic key according to the PKI protocol.

27. The computer program product of claim 20 ,

wherein the plurality of instructions further comprise:

a fourth set of instructions, executable on the computer system, configured to receive, according to the authentication protocol, the challenge, and

a fifth set of instructions, executable on the computer system, configured to generate the response by decrypting, according to the authentication protocol, the challenge.

28. An access card comprising:

an interface;

a memory; and

a processor coupled to the interface and to the memory, wherein

the processor is configured to

receive challenge data, according to an authentication protocol, via the interface, wherein

the challenge data is received in lieu of a challenge,

the challenge comprises one or more random numbers,

the challenge data comprises encrypted key-management information, and

the challenge is processed to generate a response according to the authentication protocol,

obtain key-management information from the challenge data, wherein

the processor is configured to obtain the key-management information by

retrieving the key-management information from the challenge data by decrypting the encrypted key-management information, and

store the key-management information in the memory of the access card.

29. The access card of claim 28 , wherein

the challenge data is comprised in a public key infrastructure (PKI) authentication request; and

the processor is configured to request a PKI authentication of a provider of the key-management information.

30. The access card of claim 28 , wherein the processor is further configured to:

generate another response to the key-management information; and

transmit the another response in the form of a second challenge data to a provider of the key-management information.

31. The access card of claim 28 , wherein

the processor is further configured to generate another response based on the challenge data.

32. The access card of claim 28 , wherein

the authentication protocol is a secure socket layer (SSL) protocol that uses client certificate authentication.

33. The access card of claim 28 , wherein

the processor is further configured to

receive, according to the authentication protocol, the challenge, and

generate the response by decrypting, according to the authentication protocol, the challenge.

34. The access card of claim 28 , wherein

another key is encrypted within the challenge data,

the another key is used in a generation of an access request, and

the access request comprises a request for authentication.

35. The access card of claim 28 , wherein

the authentication protocol comprises a PKI protocol.