Server-client key escrow for applied key management system and process
Embodiments described herein relate to apparatuses and methods for registering and storing a local key associated with a local application of a communication device, including, but not limited to, receiving a request from the communication device to register and store the local key, evaluating the request based on at least one first policy, and sending the request to register and store the local key to a secure key storage.
1. A method for registering and storing a local key associated with a local application of a communication device, comprising:
retrieving the local key from a local key store of the communication device to send a request to an applied key management system, the applied key management system implementing a centralized management approach;
sending the request to the applied key management system to register and store the local key at a secure key storage, the request including the local key; and
receiving a response from the applied key management system indicating that the local key is successfully registered and stored in response to acceptance of the local key based on at least one key attribute associated with the local key conforming to one or more policies and the registering and storing of the local key at the secure key storage are authorized by at least one first policy of the one or more policies, wherein the at least one key attribute indicates that security and cryptographic considerations of the local key are acceptable based on the one or more policies.
2. The method of claim 1 , wherein the local key is one or more of a locally-generated encryption key or locally-stored encryption key.
3. The method of claim 1 , wherein the local key comprises one or more of a key file for secure data storage, key data for Secure Shell (SSH), or license key for an application.
4. The method of claim 1 , wherein the secure key storage is one or more of a Hardware Security Module (HSM), key management server, or secure data storage.
5. The method of claim 1 , wherein:
the request is sent over a network link; and
the response is received over the network link.
6. The method of claim 1 , further comprising determining, by the communication device, whether the local key needs to be registered and stored.
7. The method of claim 6 , wherein determining whether the local key needs to be registered and stored comprises determining whether the local key has been previously registered and stored.
8. The method of claim 1 , further comprising:
sending a recovery request to the applied key management system to recover the local key from the secure key storage, wherein the recovery request recovers the registered and stored local key; and
receiving the local key from the applied key management system, wherein recovering the local key from the secure key storage is authorized by at least one second policy.
9. A communication device, comprising:
a local key store;
a memory; and
a processor implementing a client interface; wherein:
the client interface is configured to:
retrieve the local key from the local key store to send a request to an applied key management system, the applied key management system implementing a centralized management approach;
send the request to the applied key management system to register and store the local key at a secure key storage, the request including the local key; and
receive a response from the applied key management system indicating that the local key is successfully registered and stored in response to acceptance of the local key based on at least one key attribute associated with the local key conforming to one or more policies and the registering and storing of the local key at the secure key storage are authorized by at least one first policy of the one or more policies, wherein the at least one key attribute indicates that security and cryptographic considerations of the local key are acceptable based on the one or more policies.
10. A non-transitory processor-readable medium having processor-readable instructions, when executed, causes a processor to:
retrieve a local key from a local key store of a communication device to send a request to an applied key management system, the applied key management system implementing a centralized management approach;
send the request to the applied key management system to register and store the local key at a secure key storage, the request including the local key; and
receive a response from the applied key management system indicating that the local key is successfully registered and stored in response to acceptance of the local key based on at least one key attribute associated with the local key conforming to one or more policies and the registering and storing of the local key at the secure key storage are authorized by at least one first policy of the one or more policies, wherein the at least one key attribute indicates that security and cryptographic considerations of the local key are acceptable based on the one or more policies.
11. A method for registering and storing a local key associated with a local application of a communication device, comprising:
receiving a request from the communication device to register and store the local key, the request including the local key retrieved from a local key store of the communication device;
determining acceptability of the local key based on at least one key attribute associated with the local key conforming to one or more policies, the at least one key attribute indicating security and cryptographic considerations;
evaluating the request based on at least one first policy of the one or more policies to determine authorization of the request; and
sending the request to register and store the local key to a secure key storage in response to determining that the local key is acceptable and that the request is authorized.
12. The method of claim 11 , wherein:
the request is received from the communication device via a first network link; and
the request is sent to the secure key storage via a second network link.
13. The method of claim 11 , wherein:
the request is received from the communication device via a first network link; and
the request is sent to the secure key storage locally.
14. The method of claim 11 , wherein the request comprises one or more of key attributes of the local key, application identifier identifying the local application, user identifier identifying a user authorized to use the local key, device identifier identifying the communication device, or time at which the local key is collected.
15. The method of claim 14 , wherein evaluating the request based on the at least one policy comprises evaluating one or more of the key attributes of the local key, application identifier identifying the local application, user identifier identifying a user authorized to use the local key, device identifier identifying the communication device, or time at which the local key may be collected based on the at least one first policy.
16. The method of claim 11 , further comprising:
receiving a recovery request from the communication device, wherein the recovery request corresponds to recovering the local key from the secure key storage, the recovery request recovering the registered and stored local key;
evaluating the recovery request based on at least one second policy;
sending the recovery request to the secure key storage;
receiving the local key from the secure key storage; and
sending the local key to the communication device.
17. The method of claim 16 , wherein the recovery request received from the communication device comprises one or more of key attribute of the local key, application identifier identifying the local application associated with the local key, user identifier identifying a user authorized to use the local key, device identifier identifying the communication device, or time at which the local key is collected.
18. The method of claim 17 , wherein evaluating the recovery request based on the at least one policy comprises evaluating one or more of the key attribute of the local key, application identifier identifying the local application associated with the local key, user identifier identifying a user authorized to use the local key, device identifier identifying the communication device, or time at which the local key is collected based on the at least one second policy.
19. An applied key management system, comprising:
a memory; and
a processor, the processor configured to:
receive a request from a communication device to register and store a local key, the request including the local key retrieved from a local key store of the communication device;
determine acceptability of the local key based on at least one key attribute associated with the local key conforming to one or more policies, the at least one key attribute indicating security and cryptographic considerations;
evaluate the request based on at least one first policy of the one or more policies to determine authorization of the request; and
send the request to register and store the local key to a secure key storage in response to determining that the local key is acceptable and that the request is authorized.
20. A non-transitory processor-readable medium having processor-readable instructions, when executed, causes a processor to:
receive a request from a communication device to register and store a local key, the request including the local key retrieved from a local key store of the communication device;
determine acceptability of the local key based on at least one key attribute associated with the local key conforming to one or more policies, the at least one key attribute indicating security and cryptographic considerations;
evaluate the request based on at least one first policy of the one or more policies to determine authorization of the request; and
send the request to register and store the local key to a secure key storage in response to determining that the local key is acceptable and that the request is authorized.
21. The method of claim 1 , wherein the response indicates that registering and storing the local key at the secure key storage are authorized by the at least one first policy.
22. The method of claim 11 , wherein evaluating the request based on the at least one first policy comprises determining that the local key is authorized to be registered and stored at the secure key storage based on the at least one first policy.
23. The method of claim 14 , wherein evaluating the request based on the at least one first policy comprises:
generating an action request based on the request received from the communication device, wherein the action request comprises the one or more of key attributes of the local key, the application identifier identifying the local application, the user identifier identifying the user authorized to use the local key, the device identifier identifying the communication device, or the time at which the local key is collected; and
presenting the action request to a policy engine for inspection by the at least one first policy.
24. The method of claim 11 , wherein evaluating the request based on the at least one first policy comprises determining whether the communication device is associated with a node within a hierarchical structure or a classification.
25. The method of claim 1 , wherein the local key is an encryption key used by the local application of the communication device to unlock one or more application functionalities.