Cryptographic systems and methods
View Patent ↗Systems and methods are described that use cryptographic techniques to improve the security of applications executing in a potentially untrusted environment associated with a software application. Embodiments of the disclosed systems and methods may, among other things, facilitate cryptographic operations within an execution environment associated with browser software of a client system while maintaining security of cryptographic keys imported into the environment. As the security of keys is maintained in an execution environment implementing embodiments of the disclosed systems and methods, users and/or systems may be more willing to consign their keys for use in connection with cryptographic operations performed in such environments.
1. A method performed by a system comprising a processor and a non-transitory computer-readable storage medium storing instructions that, when executed, cause the system to perform the method, the method comprising:
receiving a wrapped user key in an execution environment of the system associated with a software application from a key wrapping module executing in a protected execution environment of the system, the wrapped user key being associated with a user, the execution environment associated with the software application being different than the protected execution environment of the system;
generating, by a protected client module executing within the execution environment associated with the software application provisioned to the system by a trusted service, a protected user key, the protected user key being generated using the wrapped user key and a protected private key associated with the protected client module; and
performing, by the protected client module, at least one secure operation within the execution environment associated with the software application using the protected user key.
2. The method of claim 1 , wherein the execution environment associated with the software application comprises a sandboxed execution environment.
3. The method of claim 1 , wherein the software application comprises a browser application.
4. The method of claim 3 , wherein the protected client module comprises a script application executing within the execution environment associated with the browser application.
5. The method of claim 1 , wherein the wrapped user key comprises a user key wrapped using a public key provisioned by the trusted service corresponding to the protected private key.
6. The method of claim 1 , wherein the protected private key comprises a white-box protected private key.
7. The method of claim 6 , wherein the protected user key comprises a white-box protected user key.
8. The method of claim 1 , wherein the method further comprises:
receiving a wrapped server key associated with a server in the execution environment associated with the software application;
generating, by the protected client module executing within the execution environment associated with the software application, a protected server key based on the wrapped server key and the protected private key.
9. The method of claim 8 , wherein the wrapped server key comprises a server key wrapped using a public key provisioned by the trusted service corresponding to the protected private key.
10. The method of claim 9 , wherein the protected server key comprises a white-box protected server key.
11. The method of claim 8 , wherein performing the at least one secure operation further comprises performing the at least one secure operation further using the protected server key.
12. The method of claim 1 , wherein the secure operation comprises a cryptographic transaction.
13. The method of claim 1 , wherein the secure operation comprises an encryption operation.
14. The method of claim 1 , wherein the secure operation comprises a decryption operation.
15. The method of claim 1 , wherein the secure operation comprises a cryptographic signature operation.
16. The method of claim 1 , wherein the secure operation comprises a cryptographic signature verification operation.