Key management system and method
A system and method for private key management in a public key encryption system are disclosed. In one embodiment, the system and method may utilize a “fake” private key to provide the private key management.
1. A key management method for public key encryption, comprising:
storing, remotely from an entity, a plurality of set of encryption keys for entities in the system that have decryption capabilities, the set of encryption keys for each entity having a private encryption key of the entity and a fake private key generated based on the private encryption key corresponding to the private encryption key of the entity;
receiving, from the entity, a piece of ciphertext content and a fake private key; and
obtaining, when the piece of ciphertext content is being decrypted for a particular entity using the private encryption key, the private encryption key of the entity from the remotely stored set of keys for the particular entity based on the fake private key.
2. The method of claim 1 further comprising generating a new private key for the particular entity and a fake private key that corresponds to the new private key for the particular entity and sending the fake private key to the particular entity.
3. The method of claim 2 further comprising decrypting the piece of ciphertext content using the new private key of the entity.
4. The method of claim 2 , wherein obtaining the private key for the particular entity further comprises extracting a uniform resource locator of the cryptographic component from key information and retrieving the new private key of the particular entity based on the uniform resource locator of the cryptographic component and the fake private key.
5. The method of claim 1 , wherein each entity is a computing device with application that has decryption capabilities.
6. The method of claim 1 , wherein each entity is one of an application having a decryption capability, a device having a decryption capability and a user that uses an application with a decryption capability.
7. The method of claim 1 , wherein the fake private key for the particular entity further comprises a pointer to new private key for the particular entity.
8. A key management system, comprising:
one or more entities, each entity having a public key decryption capability using a private encryption key of the entity and a key store;
a computer system having a processor and memory and a cryptographic component, connected to the entities by a computer network, having a metadata encoder that generates a new private encryption key for a particular entity and generates a fake private key generated based on the private encryption key that corresponds to the new private encryption key; and
wherein the cryptographic component sends the fake private key to the particular entity.
9. The system of claim 8 , wherein the cryptographic component performs a decryption process based on a request from the particular client wherein the request includes a piece of ciphertext and the fake private key and the cryptographic component obtains the new private key of the particular entity based on the fake private key to permit the decryption of the ciphertext using the new private key of the particular entity.
10. The system of claim 9 , wherein each entity has a decryption module that performs the decryption of the ciphertext using the new private key of the particular entity.
11. The system of claim 10 , wherein the decryption module further comprises a parser module that receives key information and a meta-information extractor module obtains the new private key for the particular entity based on the fake private key.
12. The system of claim 11 , wherein the meta-information extractor module extracts a uniform resource locator of the cryptographic component from the key information and retrieves the new private key of the particular entity based on the uniform resource locator of the cryptographic component.
13. The system of claim 8 , wherein each entity is a computing device with application that has decryption capabilities.
14. The system of claim 8 , wherein each entity is one of an application having a decryption capability, a device having a decryption capability and a user that uses an application with a decryption capability.
15. The system of claim 8 , wherein the fake private key for the particular entity further comprises a pointer to new private key for the particular entity.
16. A public key encryption system, comprising:
one or more entities, each entity having a public key decryption capability using a private encryption key of the entity and a key store;
a computer system having a processor and memory and a cryptographic component, connected to the entities by a computer network, having a metadata encoder that generates a new private encryption key for a particular entity and generates a fake private key generated based on the private encryption key that corresponds to the new private encryption key; and
wherein the cryptographic component sends the fake private key to the particular entity.
17. The system of claim 16 , wherein the cryptographic component performs a decryption process based on a request from the particular client wherein the request includes a piece of ciphertext and the fake private key and the cryptographic component obtains the new private key of the particular entity based on the fake private key to permit the decryption of the ciphertext using the new private key of the particular entity.
18. The system of claim 17 , wherein each entity has a decryption module that performs the decryption of the ciphertext using the new private key of the particular entity.
19. The system of claim 18 , wherein the decryption module further comprises a parser module that receives key information and a meta-information extractor module obtains the new private key for the particular entity based on the fake private key.
20. The system of claim 19 , wherein the meta-information extractor module extracts a uniform resource locator of the cryptographic component from the key information and retrieves the new private key of the particular entity based on the uniform resource locator of the cryptographic component.
21. The system of claim 16 , wherein each entity is a computing device with application that has decryption capabilities.
22. The system of claim 16 , wherein each entity is one of an application having a decryption capability, a device having a decryption capability and a user that uses an application with a decryption capability.
23. The system of claim 16 , wherein the fake private key for the particular entity further comprises a pointer to new private key for the particular entity.
24. A key management method, comprising:
generating a private key for an entity, the private key decrypting a piece of ciphertext sent to the entity;
storing the generated private key in a key management component having a key storage remote from the entity;
generating, at a key management component, a fake private key using the private encryption key that acts as a pointer to the generated private key; and
sending the fake private key to the entity to store in a key storage, wherein the entity decrypts the piece of ciphertext by making a request using the fake private key.
25. The method of claim 24 further comprising generating a public key for the entity wherein the entity is a new entity.
26. The method of claim 24 , wherein generating the private key for an entity further comprises generating a new private key for an existing entity.
27. The method of claim 24 , wherein the entity is a computing device having a decryption capability.
28. The method of claim 24 , wherein the entity is one of an application having a decryption capability, a device having a decryption capability and a user that uses an application with a decryption capability.
29. The method of claim 24 , wherein the fake private key for the particular entity further comprises a pointer to new private key for the particular entity.