Private key updating

1. A method for updating a private key of a host entity having a current private key, the method comprising:

the host entity detecting a need to acquire a new private key to replace the current private key; and

in response to detecting the need to acquire the new private key:

i) the host entity performing a private key update procedure with a key issuer using i) a public key associated with the current private key and ii) the current private key, wherein performing the private key update procedure with the key issuer comprises the host entity negotiating parameters for use in generating the new private key with the key issuer; and

ii) the host entity generating the new private key using the negotiated parameters; and

requesting the key issuer to revoke the current private key.

2. The method of claim 1 , wherein performing the private key update procedure comprises:

the host entity using the public key and the current private key to authenticate itself with the key issuer.

3. The method of claim 1 , further comprising:

prior to detecting the need to acquire a new private key, the host transmitting to the key issuer a registration request message; and

the host receiving a response message responsive to the registration request message, wherein the response message comprises the public key.

4. The method of claim 1 , further comprising:

after generating the new private key, the host entity transmitting to a service provider a registration message comprising the public key and information identifying the key issuer.

5. The method of claim 4 , further comprising:

after generating the new private key, the host entity using the public key and the new private key to authenticate itself with the service provider.

6. The method of claim 1 , wherein detecting a need to acquire a new private key to replace the current private key comprises:

detecting a leakage of the current private key, or

detecting a switch from a first platform provider to a second platform provider, or by a policy.

7. The method of claim 4 , further comprising:

the host entity using the public key and the new private key to authenticate itself with the service provider.

8. The method of claim 1 , wherein the public key is left unchanged in conjunction with performing the private key update procedure.

9. The method of claim 1 , wherein the public key is valid for a group of host entities, and wherein the host entity is the only member of said group of host entities.

10. The method of claim 1 , wherein the host entity is any of a software container, an application container, a virtual machine, a virtualization engine, a software appliance, a web server, a network device, or an end-user device.

11. A method for updating a private key of a host entity, the method comprising:

a key issuer receiving a request from the host entity indicating that the host entity has detected a need to generate a new private key to replace a current private key previously generated by the host entity;

in response to receiving the request, the key issuer performing a private key update procedure with the host entity using i) a public key associated with the current private key and ii) the current private key, wherein performing the private key update procedure with the host entity comprises negotiating parameters for use in generating the new private key with the host entity; and

causing the current private key to be revoked.

12. The method of claim 11 , wherein the private key update procedure comprises:

using the public key and the current private key to verify authentication of the host entity;

establishing a secure session with the host entity using security credentials of the key issuer; and

obtaining a request from the host entity to revoke the current private key.

13. The method of claim 11 , further comprising:

receiving a registration request message transmitted by the host entity; and

transmitting to the host entity a response message responsive to the registration request message, wherein the response message comprises the public key.

14. The method of claim 11 , wherein causing the current private key to be revoked comprises:

determining whether the current private key does not match any private key included in a private key revocation list; and

as a result of determining the current private key does not match any private key included in the private key revocation list, adding the current private key to the private key revocation list.

15. The method of claim 11 , wherein causing the current private key to be revoked comprises:

adding parameters of the current private key to a parameter based private key revocation list.

16. The method of claim 11 , wherein

the public key is registered for use of a service at a service provider, and

the method further comprises:

providing to the service provider an indication that the current private key has been revoked.

17. A host, the host entity comprising:

processing circuitry; and

a storage medium storing instructions that, when executed by the processing circuitry, cause the host entity to:

detect a need to acquire a new private key; and

in response to detecting the need to acquire the new private key:

i) perform a private key update procedure with a key issuer using the public key and the current private key, wherein performing the private key update procedure with the key issuer comprises negotiating parameters for the new private key with the key issuer; and

ii) generate the new private key using the negotiated parameters; and

request the key issuer to revoke the current private key.

18. A key issuer, the key issuer comprising:

a receiver for receiving a request from a host entity indicating that the host entity has detected a need to generate a new private key to replace a current private key previously generated by the host entity;

processing circuitry; and

a storage medium storing instructions that, when executed by the processing circuitry, cause the key issuer to:

perform a private key update procedure with a host entity, wherein performing the private key update procedure with the host entity comprises negotiating parameters for the new private key with the host entity; and

cause the current private key previously generated by the host entity to be revoked.

19. A computer program product comprising a non-transitory computer readable medium storing a computer program, the computer program comprising computer code which, when run on processing circuitry of a host entity, causes the host entity to:

detect a need to acquire a new private key; and

in response to detecting the need to acquire a new private key:

i) perform a private key update procedure with a key issuer using the public key and the current private key, wherein performing the private key update procedure comprises negotiating parameters for the new private key with the key issuer; and

ii) generate the new private key using the negotiated parameters; and

request the key issuer to revoke the current private key.

20. A computer program product comprising a non-transitory computer readable medium storing a computer program, the computer program comprising computer code which, when run on processing circuitry of the key issuer, causes the key issuer to:

process a request from a host entity indicating that the host entity has detected a need to generate a new private key to replace a current private key previously generated by the host entity;

perform a private key update procedure with the host entity, wherein performing the private key update procedure with the host entity comprises negotiating parameters for the new private key with the host entity; and

cause the current private key to be revoked.