Secure asymmetric key application data sharing
Aspects of providing single sign on (SSO) sessions are described. An access interval key is generated using an access code as a seed to a key derivative function. The access interval key is encrypted using a public key of an SSO-enabled application to generate an encrypted access interval key for a sign on session. The sign on session is established by storing the encrypted access interval key in a memory location of an SSO session map shared by SSO-enabled applications.
1. A method performed by instructions executed by a computing device, the method comprising:
generating, by a single-sign-on (SSO)-enabled application, an access interval key to decrypt an encrypted master key, the access interval key being generated using an access code as a seed to a key derivative function;
retrieving, from a local keychain memory of the computing device, a plurality of public keys corresponding to a plurality of SSO-enabled applications;
encrypting, by the SSO-enabled application, the access interval key using the plurality of public keys to generate a plurality of encrypted access interval keys; and
establishing, by the SSO-enabled application, a sign on session that enables a respective one of the plurality of SSO-enabled applications to decrypt the encrypted master key by storing a corresponding one of the plurality of encrypted access interval keys in a memory location of an SSO session map within the local keychain memory.
2. The method of claim 1 , further comprising:
monitoring, by the SSO-enabled application, at least one memory location of the local keychain memory for presence of at least one of the plurality of public keys.
3. The method of claim 1 , further comprising:
generating, by the respective one of the plurality of SSO-enabled applications, a key pair comprising a public key and a private key; and
storing, by the respective one of the plurality of SSO-enabled applications, the public key in the SSO session map in the local keychain memory.
4. The method according to claim 3 , further comprising:
determining, by the respective one of the plurality of SSO-enabled applications, that an encrypted copy of a key pair is unavailable from at least one of a shared memory or a secure enclave processor; and
wherein the respective one of the plurality of SSO-enabled applications generates the key pair in response to the encrypted copy of the key pair being unavailable.
5. The method of claim 1 , wherein the SSO session map comprises: an SSO session time of the sign on session, and the plurality of encrypted access interval keys corresponding to the plurality of SSO-enabled applications.
6. The method of claim 5 , wherein the SSO session map further comprises the plurality of public keys.
7. The method according to claim 5 , further comprising:
determining that the sign on session is not valid based on the SSO session time; and
clearing the plurality of encrypted access interval keys from memory locations comprising the SSO session map within the local keychain memory.
8. A non-transitory computer-readable medium embodying executable instructions, wherein the instructions, when executed by at least one processor, cause a computing device to at least:
generate, by a single-sign-on (SSO)-enabled application, an access interval key to decrypt an encrypted master key, the access interval key being generated using an access code as a seed to a key derivative function;
retrieve, from a local keychain memory of the computing device, a plurality of public keys corresponding to a plurality of SSO-enabled applications;
encrypt, by the SSO-enabled application, the access interval key using the plurality of public keys to generate a plurality of encrypted access interval keys; and
establish, by the SSO-enabled application, a sign on session that enables a respective one of the plurality of SSO-enabled applications to decrypt the encrypted master key by storing a corresponding one of the plurality of encrypted access interval keys in a memory location of an SSO session map within the local keychain memory.
9. The non-transitory computer-readable medium according to claim 8 , wherein the instructions, when executed by the at least one processor, further cause the computing device to at least:
monitor, by the SSO-enabled application, at least one memory location of the local keychain memory for presence of at least one of the plurality of public keys.
10. The non-transitory computer-readable medium according to claim 8 , wherein the instructions, when executed by the at least one processor, further cause the computing device to at least:
generate, by the respective one of the plurality of SSO-enabled applications, a key pair comprising a public key and a private key; and
store, by the respective one of the plurality of SSO-enabled applications, the public key in the SSO session map in the local keychain memory.
11. The non-transitory computer-readable medium according to claim 10 , wherein the instructions, when executed by the at least one processor, further cause the computing device to at least:
determine, by the respective one of the plurality of SSO-enabled applications, that an encrypted copy of a key pair is unavailable from at least one of a shared memory or a secure enclave processor; and
wherein the respective one of the plurality of SSO-enabled applications generates the key pair in response to the encrypted copy of the key pair being unavailable.
12. The non-transitory computer-readable medium according to claim 8 , wherein the SSO session map comprises: an SSO session time of the sign on session, and the plurality of encrypted access interval keys corresponding to the plurality of SSO-enabled applications.
13. The non-transitory computer-readable medium according to claim 12 , wherein the SSO session map further comprises the plurality of public keys.
14. The non-transitory computer-readable medium according to claim 12 , wherein the instructions, when executed by the at least one processor, further cause the computing device to at least:
determine that the sign on session is not valid based on the SSO session time; and
clear the plurality of encrypted access interval keys from memory locations comprising the SSO session map.
15. A system, comprising:
a computing device comprising at least one processor; and
a memory comprising executable instructions, wherein the instructions, when executed by the at least one processor, cause the computing device to at least:
generate, by a single-sign-on (SSO)-enabled application, an access interval key to decrypt an encrypted master key, the access interval key being generated using an access code as a seed to a key derivative function;
retrieve, from a local keychain memory of the computing device, a plurality of public keys corresponding to a plurality of SSO-enabled applications;
encrypt, by the SSO-enabled application, the access interval key using the plurality of public keys to generate a plurality of encrypted access interval keys; and
establish, by the SSO-enabled application, a sign on session that enables a respective one of the plurality of SSO-enabled applications to decrypt the encrypted master key by storing a corresponding one of the plurality of encrypted access interval keys in a memory location of an SSO session map within the local keychain memory.
16. The system of claim 15 , wherein the instructions, when executed by the at least one processor, further cause the computing device to at least:
monitor, by the SSO-enabled application, at least one memory location of the local keychain memory for presence of at least one of the plurality of public keys.
17. The system of claim 15 , wherein the instructions, when executed by the at least one processor, further cause the computing device to at least:
generate, by the respective one of the plurality of SSO-enabled applications, a key pair comprising a public key and a private key; and
store, by the respective one of the plurality of SSO-enabled applications, the public key in the SSO session map in the local keychain memory.
18. The system of claim 15 , wherein the SSO session map comprises: an SSO session time of the sign on session, and the plurality of encrypted access interval keys corresponding to the plurality of SSO-enabled applications.
19. The system of claim 18 , wherein the SSO session map further comprises the plurality of public keys.
20. The system of claim 18 , wherein the instructions, when executed by the at least one processor, further cause the computing device to at least:
determine that the sign on session is not valid based on the SSO session time; and
clear the plurality of encrypted access interval keys from memory locations comprising the SSO session map.