Server-client PKI for applied key management system and process
Embodiments described herein relate to obtaining a public key for an application of a communication device, including, but not limited to, receiving a request from the communication device to obtain the public key, evaluating the request based on at least one policy, requesting the public key from a public key infrastructure (PKI) in response to determining that the request is authorized, receiving the public key from the PKI, and sending the public key to the communication device.
1. A method for obtaining a public key for an application of a communication device, the method comprising:
receiving a request from the communication device to obtain the public key;
evaluating the request based on at least one policy;
requesting the public key from a public key infrastructure (PKI) in response to determining that the request is authorized;
receiving the public key from the PKI;
identifying one or more key attributes associated with the public key;
evaluating the one or more key attributes based on at least one second policy;
determining acceptability of the public key based on the one or more key attributes indicating that cryptographic considerations of the public key conforms to the at least one second policy; and
sending the public key to the communication device;
wherein the sending of the public key to the communication device is in response to determining that the public key is acceptable based on the at least one second policy.
2. The method of claim 1 , wherein:
the application is an email application;
the request corresponds to a recipient of an email;
the request comprises an email address corresponding to the recipient; and
the public key is associated with the recipient.
3. The method of claim 1 , wherein:
the request from the communication device is received via a first network link; and
the public key is request from the PKI via a second network link.
4. The method of claim 3 , wherein evaluating the request based on the at least one policy comprises determining whether requesting the public key for the email address corresponding to the recipient is authorized.
5. The method of claim 1 , wherein evaluating the request based on the at least one policy comprises determining whether the communication device is authorized to request the public key based on the at least one policy.
6. The method of claim 1 , further comprising connecting to the PKI.
7. The method of claim 1 , further comprising sending a failure message to the communication device in response to determining that the request is unauthorized.
8. The method of claim 1 , further comprising:
determining whether the public key is received; and
sending the public key in response to determining that the public key has been received.
9. The method of claim 8 , further comprising sending a failure message to the communication device in response to determining that the public key has not been received.
10. An applied key management system for providing a public key to an application of a communication device, the system comprising:
a memory; and
a processor, the processor is configured to:
receive a request from the communication device to obtain the public key;
evaluate the request based on at least one policy;
request the public key from a public key infrastructure (PKI) in response to determine that the request is authorized;
receive the public key from the PKI;
identify one or more key attributes associated with the public key;
evaluate the one or more key attributes based on at least one second policy;
determine acceptability of the public key based on the one or more key attributes indicating that cryptographic considerations of the public key conforms to the at least one second policy; and
send the public key to the communication device in response to determining that the public key is acceptable based on the at least one second policy.
11. The system of claim 10 , wherein:
the application is an email application;
the request corresponds to a recipient of an email;
the request comprises an email address corresponding to the recipient; and
the public key is associated with the recipient.
12. The system of claim 10 , wherein:
the request from the communication device is received via a first network link; and
the public key is requested from the PKI via a second network link.
13. The system of claim 12 , wherein to evaluate the request based on the at least one policy, the processor is further configured to determine whether requesting the public key for the email address corresponding to the recipient is authorized.
14. The system of claim 10 , wherein to evaluate the request based on the at least one policy, the processor is further configured to determine whether the communication device is authorized to request the public key based on the at least one policy.
15. The system of claim 10 , wherein the processor is further configured to connect to the PKI.
16. The system of claim 10 , wherein the processor is further configured to send a failure message to the communication device in response to determining that the request is unauthorized.
17. The system of claim 10 , wherein the processor is further configured to:
determine whether the public key is received; and
send the public key in response to determining that the public key has been received.
18. The system of claim 17 , wherein the processor is further configured to send a failure message to the communication device in response to determining that the public key has not been received.
19. A non-transitory processor-readable medium having processor-readable instructions, such that, when executed, causes a processor to:
receive a request from the communication device to obtain the public key for an application of the communication device;
evaluate the request based on at least one policy;
request the public key from a public key infrastructure (PKI) in response to determine that the request is authorized;
receive the public key from the PKI;
identify one or more key attributes associated with the public key;
evaluate the one or more key attributes based on at least one second policy;
determine acceptability of the public key based on the one or more key attributes indicating that cryptographic considerations of the public key conforms to the at least one second policy; and
send the public key to the communication device in response to determining that the public key is acceptable based on the at least one second policy.
20. The non-transitory processor-readable medium of claim 19 , wherein:
the application is an email application;
the request corresponds to a recipient of an email;
the request comprises an email address corresponding to the recipient; and
the public key is associated with the recipient.
21. The method of claim 1 , wherein:
the public key is for a recipient of a communication from the communication device;
the request includes at least a unique identifier of the recipient; and
wherein evaluating the request comprises determining whether the communication device is authorized to receive the public key for the recipient based on the unique identifier of the recipient being acceptable based on the at least one policy.