System and method for cryptographic suite management
Systems and methods for cryptographic suite management are described. A system for cryptographic suite management has a cryptographic suite management unit comprising a series of APIs enabling diverse applications to call cryptographic functions. The system enables: multiple applications on an interface to access shared cryptographic resources; applications across multiple devices to share and license cryptographic resources between devices; encryption, decryption and sharing of data between devices having different cryptographic implementations; the definition, distribution and enforcement of policies governing the terms of use for cryptographic implementations, systems and methods to secure and protect shared and dynamically loaded cryptographic providers; use by an application of multiple cryptographic resources and the management of cryptographic provider bundles and associated policies across one or many cryptographic suite management unit instances.
1. A system for cryptographic suite management for configuring cryptographically secure communications between at least two correspondent devices, each of the correspondent devices comprising one or more processors, the system comprising:
a cryptographic suite management unit on a first of the correspondent devices to configure secured communications with at least a second of the other correspondent devices upon the first of the correspondent devices receiving an import request from at least the second of the other correspondent devices, the request comprising the identification of a cryptographic implementation and security requirements for the cryptographic implementation for exportation by the second correspondent, the second cryptographic suite management unit is configured to provide the cryptographic implementation configured using the security requirements and export the configured cryptographic implementation to the first correspondent to enable the first cryptographic suite management unit to securely import the configured cryptographic implementation for use by the first correspondent.
2. The system of claim 1 , wherein the first of the correspondent devices is further in communication with a third of the correspondent devices, in identical manner as the interaction between the second of the correspondent devices and the first of the correspondent devices, wherein the first of the correspondent devices is a trusted third party intermediary facilitating secure communication between the second of the correspondent devices and the third of the correspondent devices.
3. The system of claim 1 , wherein each cryptographic suite management unit is configured to store a plurality of cryptographic implementations in a secured suite vault for use and export to other correspondent devices.
4. The system of claim 3 , wherein each cryptographic suite management unit is configured to dynamically load each of the plurality of cryptographic implementations in its suite vault for use in a secure communication.
5. The system of claim 3 , wherein the suite vault encrypts each cryptographic implementation during storage and stores a copy of the keys used for the encryption.
6. The system of claim 5 , wherein upon a request to obtain the cryptographic implementation, the suite vault obtains the encrypted cryptographic implementation and the keys, decrypts the cryptographic implementation using the keys, securely erases the keys, writes the cryptographic implementation to a virtual disk in volatile memory, makes the cryptographic implementation available to a requesting application, and removes the cryptographic implementation from the virtual disk.
7. The system of claim 1 , wherein the request and exportation is structured as a protocol that securely negotiates cryptographic and security requirements of importers and exporters.
8. The system of claim 7 , wherein the protocol uses a public key encryption scheme and comprises:
a. the second correspondent device sends an import request, including its public key, the security level of its application, and the security level and platform expected for the cryptographic provider, to the first of the correspondent devices;
b. the first of the correspondent devices analyzes the request, taking into account its application security level and its cryptographic suite management policy, searches for a match through its cryptographic providers, and decides to export or not;
c. upon the first of the correspondent devices deciding to export, the first of the correspondent devices creates an export bundle including:
i. its public key;
ii. its application security level;
iii. information about the cryptographic implementation use and implementation;
iv. the cryptographic implementation, encrypted with first correspondent's public key and, if necessary, second correspondent's private key;
d. the bundle is exported to the second of the correspondent devices;
e. the first correspondent receives the bundle, extracts the information and decides to accept it or not, based on the information and its management policy;
f. the second of the correspondent device decrypts the cryptographic implementation with the first correspondent's private key and, if necessary, second of the correspondent devices' public key.
9. The system of claim 8 , wherein the public key encryption scheme is ECIES (Elliptic Curve Integrated Encryption Scheme).
10. The system of claim 9 , wherein the first and second of the correspondent devices are endpoints, each endpoint exporting its cryptographic implementation to the cryptographic suite management unit which is an intermediary in the communication channel between the two endpoints, followed by the execution of a key agreement protocol to generate symmetric keys for each of the two pairs comprising the cryptographic suite management unit and each of the endpoints.
11. The system of claim 10 , wherein the intermediary is configured to translate ciphertexts produced by one first endpoint into ciphertexts of the other second endpoint.
12. The system of claim 11 , wherein the translation comprises:
a. the first endpoint encrypting a plaintext with its symmetric encryption scheme and the key established between the first endpoint and the cryptographic suite management unit during the registration;
b. transmitting the resulting ciphertext to the cryptographic suite management unit;
c. the cryptographic suite management unit decrypting the resulting ciphertext with the first endpoint's encryption/decryption scheme and the key established during its registration, encrypting the resulting plaintext with the second endpoint's encryption scheme and the key established between the second endpoint and the cryptographic suite management unit during the registration, and sending the resulting ciphertext to the second endpoint;
d. the second endpoint decrypting the received ciphertext with its decryption scheme and the key established between the second endpoint and the cryptographic suite management unit during the registration.
13. The system of claim 1 , wherein the cryptographic suite management unit provides dynamic linking of cryptographic implementations for applications executing on the correspondent devices.
14. The system of claim 1 , wherein the cryptographic suite management unit ensures the integrity of the cryptographic implementations being made available to requesting applications.
15. The system of claim 1 , wherein the second cryptographic suite management unit is configured to define policies that govern terms of use of the cryptographic implementation.
16. The system of claim 15 , wherein the policies comprise license terms defining the applications and devices that are permitted to use the cryptographic implementation.
17. The system of claim 15 , wherein the policies comprise license terms defining the timeframe during which the cryptographic implementation is permitted to be used.
18. The system of claim 15 , wherein upon an application or device attempting to use a cryptographic implementation in an unpermitted manner, the cryptographic suite management unit deletes the cryptographic implementation from the suite vault.
19. The system of claim 1 , wherein the second of the correspondent devices provides its public key in the request.