Flexible controls for certificates
Representative embodiments disclose mechanisms for flexible controls around use of cryptographic material such as encryption/decryption keys, key pairs, certificates, and so forth. The system replaces a local cryptographic agent or cryptographic service provider with a modified agent/service provider that redirects requests to utilize cryptographic key material used in a cryptographic operation to a backend system. The backend system receives the request and identifies a cryptographic process from context data associated with the request. The cryptographic process can have one or more controls attached to one or more operations in the cryptographic process. The controls are conditions that must be completed, in addition to successful completion of the underlying operation, in order to complete the underlying operation. A process owner can easily add, remove, and/or rearrange operations as well as controls to provide flexible controls around the use of cryptographic material.
1. A computer implemented method providing controls for cryptographic material, comprising:
receiving, from a calling process, a set of context parameters;
identifying a cryptographic process based on a subset of the context parameters;
retrieving a cryptographic process definition for the identified cryptographic process from a process store, the cryptographic process definition comprising a plurality of cryptographic process operations and one or more controls attached to one or more of the cryptographic process operations, the one or more controls including an authentication check and a geographic check;
instantiating the cryptographic process; and
for each of the plurality of cryptographic process operations in the instantiated cryptographic process:
identifying whether the cryptographic process operation has an attached control; and
responsive to identifying that the cryptographic process operation does have an attached control:
executing the attached control; and
executing the cryptographic process operation.
2. The method of claim 1 further comprising:
responsive to identifying that the cryptographic process operation does not have an attached control, executing the cryptographic process operation.
3. The method of claim 1 wherein the attached control is executed prior to the cryptographic process operation and wherein the cryptographic process operation is executed responsive to successful completion of the attached control.
4. The method of claim 1 wherein the attached control is executed subsequent to the cryptographic process operation and wherein the attached control is executed responsive to successful completion of the cryptographic process operation.
5. The method of claim 1 further comprising creating an entry in an audit trail.
6. The method of claim 1 wherein the attached control comprises one or more of:
an authorization;
an authentication;
a number of times the cryptographic operation can be executed;
a time span when the cryptographic operation can be executed; and
a geographic region.
7. The method of claim 1 wherein the set of context parameters is received via a cryptographic agent residing on the same machine as the calling process.
8. The method of claim 1 wherein the cryptographic process performs at least one of:
signing a hash or digest;
requesting a new cryptographic certificate;
requesting generation of a new cryptographic key pair; and
requesting renewal of a cryptographic certificate or cryptographic key pair.
9. The method of claim 1 further comprising:
presenting a user interface having a representation of the plurality of cryptographic process operations and the one or more controls;
receiving an ordered sequence of the plurality of cryptographic process operations;
receiving an attachment of a subset of the one or more controls to at least one cryptographic process operation; and
creating the cryptographic process definition based on the received ordered sequence and received attachment.
10. The method of claim 1 wherein instantiating the cryptographic process comprises sending the cryptographic process definition to an execution engine.
11. A system comprising:
a memory; and
a processor coupled to the memory storing executable instructions, which when executed by the processor cause the processor to perform operations comprising:
receiving, from a calling process, a set of context parameters;
identifying a cryptographic process based on a subset of the context parameters;
retrieving a cryptographic process definition for the identified cryptographic process from a process store, the cryptographic process definition comprising a plurality of cryptographic process operations and one or more controls attached to one or more of the cryptographic process operations, the one or more controls including an authentication check and a geographic check;
instantiating the cryptographic process; and
for each of the plurality of cryptographic process operations in the instantiated cryptographic process:
identifying whether the cryptographic process operation has an attached control; and
responsive to identifying that the cryptographic process operation does have an attached control:
executing the attached control; and
executing the cryptographic process operation.
12. The system of claim 11 further comprising:
responsive to identifying that the cryptographic process operation does not have an attached control, executing the cryptographic process operation.
13. The system of claim 11 wherein the attached control is executed prior to the cryptographic process operation and wherein the cryptographic process operation is executed responsive to successful completion of the attached control.
14. The system of claim 11 wherein the attached control is executed subsequent to the cryptographic process operation and wherein the attached control is executed responsive to successful completion of the cryptographic process operation.
15. The system of claim 11 further comprising creating an entry in an audit trail.
16. The system of claim 11 wherein the attached control comprises one or more of:
an authorization;
an authentication;
a number of times the cryptographic operation can be executed;
a time span when the cryptographic operation can be executed; and
a geographic region.
17. The system of claim 11 wherein the set of context parameters is received via a cryptographic agent residing on the same machine as the calling process.
18. The system of claim 11 wherein the cryptographic process performs at least one of:
signing a hash or digest;
requesting a new cryptographic certificate;
requesting generation of a new cryptographic key pair; and
requesting renewal of a cryptographic certificate or cryptographic key pair.
19. The system of claim 11 further comprising:
presenting a user interface having a representation of the plurality of cryptographic process operations and the one or more controls;
receiving an ordered sequence of the plurality of cryptographic process operations;
receiving an attachment of a subset of the one or more controls to at least one cryptographic process operation; and
creating the cryptographic process definition based on the received ordered sequence and received attachment.
20. A non-transitory computer storage medium comprising executable instructions that, when executed by a processor of a machine, cause the machine to perform acts comprising:
receiving, from a calling process, a set of context parameters;
identifying a cryptographic process based on a subset of the context parameters;
retrieving a cryptographic process definition for the identified cryptographic process from a process store, the cryptographic process definition comprising a plurality of cryptographic process operations and one or more controls attached to one or more of the cryptographic process operations, the one or more controls including an authentication check and a geographic check;
instantiating the cryptographic process; and
for each of the plurality of cryptographic process operations in the instantiated cryptographic process:
identifying whether the cryptographic process operation has an attached control; and
responsive to identifying that the cryptographic process operation does have an attached control:
executing the attached control; and
executing the cryptographic process operation.