Management of cryptographic keys

1. A method implemented in a computing device comprising a physical processor, the method comprising:

transmitting, by the computing device, feature data of the computing device to a key generation module, wherein the feature data indicates a first capability of the computing device;

receiving, by the computing device, from the key generation module, a first digital signature associated with a first feature indicating the first capability of the computing device and a second digital signature associated with a second feature of the computing device, wherein the digital signatures are generated using the feature data that is transmitted by the computing device;

aggregating the first digital signature and the second digital signature into a compound cryptographic key for communication;

receiving, by the computing device, a request from a second computing device to perform a requested function, wherein the first capability and second feature are required to perform the requested function; and

in response to the request from the second computing device, performing, by the computing device, a cryptographic operation using the cryptographic key, the cryptographic operation to indicate, to the second computing device, the first capability of the computing device and the second feature of the computing device to perform the requested function.

2. The method according to claim 1 , the method further comprising:

generating, by the key generation module, the first digital signature and the second digital signature using the feature data from the computing device.

3. The method according to claim 1 , wherein the transmitting the feature data, the receiving the digital signature, and the installing the digital signature as the cryptographic private key are performed during a boot process of the computing device.

4. The method according to claim 1 , wherein the request includes a random nonce in clear text.

5. The method according to claim 1 , further comprising installing, by the computing device, the first digital signature and the second digital signature received from the key generation module as a cryptographic private key for communication.

6. The method according to claim 1 , further comprising installing, by the computing device, the compound cryptographic key for communication.

7. The method according to claim 1 , wherein the second feature includes an identifier of the computing device or an attribute of the computing device indicating a second capability of the computing device.

8. The method according to claim 1 , wherein the first capability of the computing device includes a key generation capability, a key management capability, a key usage capability, or any combination thereof.

9. An electronic device for management of cryptographic keys, the device having a set of features, each individual feature of the set of features being one of an identifier or an attribute of the device, the device comprising:

a transmitting unit that transmits feature data to a key generation module, wherein the feature data indicates a first capability of the device;

a receiving unit that receives from the key generation module, a digital signature associated with the first capability of the computing device, wherein the digital signature is generated using the feature data that is transmitted, the receiving unit further receives a request from a second computing device to perform a requested function, wherein the first capability is required to perform the requested function;

a controller that, during a boot process of the computing device, controls the transmitting unit to transmit the feature data, controls the receiving unit to receive the digital signature, and installs the digital signature that is received in the device as a cryptographic private key; and

a cryptographic unit that, in response to the request from the second computing device, performs a cryptographic operation using the cryptographic private key, the cryptographic operation indicates, to the second computing device, the first capability of the computing device to perform the requested function.

10. The electronic device according to claim 9 , further comprising:

a field programmable gate array, wherein the field programmable gate array has an embedded cryptographic key, a decryption unit and a secure storage, wherein:

the receiving unit is operative to receive an encrypted version of the digital signature, wherein the encrypted version of the digital signature is encrypted using the embedded cryptographic key;

the controller is operative to input the encrypted version of the digital signature to the field programmable gate array; and

the field programmable gate array is operative to decrypt the encrypted version of the digital signature by a decryption unit using the embedded cryptographic key and to store the digital signature in the secure storage.

11. The electronic device according to claim 9 , wherein:

during installation of the digital signature that is received in the device as the cryptographic private key, the controller creates a cryptographic public key corresponding to the cryptographic private key.

12. The electronic device according to claim 9 , wherein:

the transmitting unit is operative to transmit to the key generation module plural feature data corresponding to respective plural individual features of the device,

the receiving unit is operative to receive, from the key generation module, plural digital signatures, one for each of the plural feature data that is transmitted, and

the controller is operative to install the plural digital signatures that are received in the device as plural cryptographic private keys for use by the cryptographic unit in cryptographic operations.

13. The electronic device according to claim 12 , wherein:

the controller is to maintain association data indicating a link between each of the cryptographic plural private keys and the feature data that is transmitted;

the controller comprises a key detection module that recognizes a target identifier or a target attribute and determines whether the controller maintains the association data indicating the link between the target identifier or the target attribute and one of the plural cryptographic private keys installed in the device; and

responsive to the key detection module determining that the controller maintains the association data indicating the link between the target identifier or the target attribute and the one of the plural cryptographic private keys installed in the device, the key detection module controls the cryptographic unit to:

perform a cryptographic operation in which an individual private key linked to the target identifier or the target attribute functions as the cryptographic private key, and

output a result of the cryptographic operation from the device.

14. The electronic device according to claim 12 , wherein:

the controller is to maintain association data indicating a link between each individual cryptographic private key of the plural cryptographic private keys and a corresponding identifier or a corresponding attribute of the feature data that is transmitted;

the controller comprises a key detection module that recognizes a target identifier or a target attribute, determines whether the target identifier or the target attribute is relevant to the electronic device, and determines whether the controller maintains the association data indicating the link between the target identifier or the target attribute and one of the plural cryptographic private keys installed in the device; and

responsive to the key detection module determining that the controller does not maintain the association data indicating the link between the target identifier or the target attribute and the one of the plural cryptographic private keys installed in the device, the controller:

controls the transmitting unit to transmit the feature data corresponding to the targeted identifier or the target attribute to the key generation module,

controls the receiving unit to receive, from the key generation module, the digital signature of the feature data corresponding to the target identifier or the target attribute that is transmitted;

installs the digital signature that is received in the device as an individual private key of the plural cryptographic private keys;

controls the cryptographic unit to perform a cryptographic operation in which the individual private key linked to the target identifier or the target attribute functions as the cryptographic private key of the device; and

outputs a result of the cryptographic operation from the device.

15. The electronic device according to claim 14 , wherein the feature data comprises information related to a first attribute and information related to a second attribute:

the receiving unit receives, from the key generation module, the digital signature for a portion of the feature data relating to the first attribute and a second digital signature for a second portion of the feature data relating to the second attribute; and

the controller:

applies a digital signature method to the digital signature and the second digital signature that produces an aggregative digital signature, the aggregative digital signature comprising information related to the digital signature and the second digital signature; and

installs the aggregative digital signature in the device as the cryptographic private key.

16. The method according to claim 9 , wherein the cryptographic private key is installed during an initial setup phase when the computing device is first booted and a second cryptographic private key is installed in response to a subsequent request at a later time.

17. The electronic device according to claim 9 , wherein the electronic device is interconnected by a connection fabric to a plurality of different electronic devices, wherein the capability of the electronic device is different than respective capabilities of the plurality of different electronic devices.

18. The electronic device according to claim 9 , wherein the first capability of the device includes a key generation capability, a key management capability, a key usage capability, or any combination thereof.

19. An electronic device for management of cryptographic keys comprising:

a physical processor that:

sends a request to an external collaborator device to perform a requested interaction, wherein the requested interaction requires a first capability of the external collaborator device, the first capability including a key generation capability, a key management capability, a key usage capability, or any combination thereof;

receives, from the external collaborator device, a response to the request; and

verifies whether the external collaborator device comprises the first capability by performing a cryptographic operation using the response from the external collaborator device and a private key of a public-private cryptographic key pair, wherein the private key of the public-private cryptographic key pair is a digital signature associated with the first capability.

20. The electronic device according to claim 19 , wherein:

the physical processor performs the requested interaction with the external collaborator device conditional on verifying that the external collaborator device comprises the first capability, and performs the verifying using a cryptographic public key that aggregates plural public keys of the external collaborator device, and

the plural public keys of the external collaborator device have associated private keys that are digital signatures of feature data of the external collaborator device.