Methods and devices for securing keys when key-management processes are subverted by an adversary
The present invention discloses methods and devices for securing keys when key-management processes are subverted by an adversary. Methods include the steps of: upon receiving a creation request in the computing-environment, creating a secure key in at least one location in a computing environment by repetitively computing respective secure-key contributions: in at least one location; and in a set of N computing resources in the computing environment, wherein N is a non-negative integer; and applying the respective secure-key contributions to change a secure-key value, wherein: the respective secure-key contributions cannot be omitted or modified by at least one location; and the secure key is never revealed to the computing resources; thereby enabling the computing resources in the computing environment to ensure that the secure key is truly random; wherein at least one location is a region of memory located in a computing resource operationally connected to the computing-environment.
1. A method for securing keys when key-management processes are subverted by an adversary, the method comprising the steps of:
(a) upon receiving a creation request in the computing-environment, creating a secure key in at least one location in a computing environment by repetitively computing respective secure-key contributions:
(i) in said at least one location; and
(ii) in a set of N computing resources in said computing environment, wherein N is a non-negative integer, and wherein said set includes all computing resources in said computing environment; and
(b) applying said respective secure-key contributions to change a secure-key value, wherein:
(i) said respective secure-key contributions cannot be omitted or modified by said at least one location; and
(ii) said secure key is never revealed in unencrypted form to any of said computing resources;
thereby enabling said computing resources in the computing environment to
ensure that said secure key is random;
wherein said at least one location is a region of memory located in a given computing resource of said set, operationally connected to said computing-environment.
2. The method of claim 1 , wherein said respective secure-key contributions are random.
3. The method of claim 1 , wherein said respective secure-key contributions of said set of N computing resources are never revealed to said at least one location.
4. The method of claim 1 , wherein a given, respective secure-key contribution of a given computing resource is never revealed to any other computing resource of said set of N computing resources, and wherein said secure-key in said at least one location is never revealed to any other computing resource of said set of N computing resources.
5. The method of claim 1 , wherein said step of creating and said step of applying said respective secure-key contributions can be performed on any element of a collection of computing resources operationally connected to the computing-environment, and wherein said step of applying is performed differently on each said element, thereby preventing subversion of one said element from compromising any other said element.
6. A device for securing keys when key-management processes are subverted by an adversary, the device comprising:
(a) a server including:
(i) a CPU for performing computational operations;
(ii) a memory module for storing data; and
(iii) a network connection for communicating across a network; and
(b) a protection module, residing on said server, configured for:
(i) upon receiving a creation request in the computing-environment, creating a secure key in at least one location in a computing environment by repetitively computing respective secure-key contributions:
(A) in said at least one location; and
(B) in a set of N computing resources in said computing environment, wherein N is a non-negative integer, and wherein said set includes all computing resources in said computing environment; and
(ii) applying said respective secure-key contributions to change a secure-key value, wherein:
(A) said respective secure-key contributions cannot be omitted or modified by said at least one location; and
(B) said secure key is never revealed in unencrypted form to any of said computing resources;
thereby enabling said computing resources in the computing environment to ensure that said secure key is random;
wherein said at least one location is a region of memory located in a given computing resource of said set, operationally connected to said computing-environment.
7. The device of claim 6 , wherein said respective secure-key contributions are random.
8. The device of claim 6 , wherein said respective secure-key contributions of said set of N computing resources are never revealed to said at least one location.
9. The device of claim 6 , wherein a given, respective secure-key contribution of a given computing resource is never revealed to any other computing resource of said set of N computing resources, and wherein said secure-key in said at least one location is never revealed to any other computing resource of said set of N computing resources.
10. The device of claim 6 , wherein said creating and said applying said respective secure-key contributions can be performed on any element of a collection of computing resources operationally connected to the computing-environment, and wherein said applying is performed differently on each said element, thereby preventing subversion of one said element from compromising any other said element.
11. A non-transitory computer-readable medium, having computer-readable code embodied on the non-transitory computer-readable medium for securing keys when key-management processes are subverted by an adversary, the computer-readable code comprising:
(a) program code for, upon receiving a creation request in the computing-environment, creating a secure key in at least one location in a computing environment by repetitively computing respective secure-key contributions:
(i) in said at least one location; and
(ii) in a set of N computing resources in said computing environment, wherein N is a non-negative integer, and wherein said set includes all computing resources in said computing environment; and
(b) program code for, applying said respective secure-key contributions to change a secure-key value, wherein:
(i) said respective secure-key contributions cannot be omitted or modified by said at least one location; and
(ii) said secure key is never revealed in unencrypted form to any of said computing resources;
thereby enabling said computing resources in the computing environment to ensure that said secure key is random;
wherein said at least one location is a region of memory located in a given computing resource of said set, operationally connected to said computing-environment.
12. The non-transitory computer-readable medium of claim 11 , wherein said respective secure-key contributions are random.
13. The non-transitory computer-readable medium of claim 11 , wherein said respective secure-key contributions of said set of N computing resources are never revealed to said at least one location.
14. The non-transitory computer-readable medium of claim 11 , wherein a given, respective secure-key contribution of a given computing resource is never revealed to any other computing resource of said set of N computing resources, and wherein said secure-key in said at least one location is never revealed to any other computing resource of said set of N computing resources.
15. The non-transitory computer-readable medium of claim 11 , wherein said creating and said applying said respective secure-key contributions can be performed on any element of a collection of computing resources operationally connected to the computing-environment, and wherein said applying is performed differently on each said element, thereby preventing subversion of one said element from compromising any other said element.