Secure digital signing
A public-private key cryptographic scheme is described for granting authenticating a client to a remote device or service in order to access a secure resource. The client is provided the public key, but the private key is stored in a hardware security module (HSM) that the client is not able to access. The client requests a digital signature be generated from the private key from a secure vault service. The secure vault service accesses the HSM and generates the digital certificate, which is then passed to the client. The digital certificate may be added to a security token request submitted to an identity provider. The identity provider determines whether the digital signature came from the private key. If so, the identity provider provides authenticates the client and provides an access token that is usable by the client for authentication to the remote device with the secure resource.
1. A method for authenticating a client to access a secure resource on a remote device using a public key and a private key, wherein the private key is stored in a hardware security module (HSM) away from the client, the method comprising:
generating, at the client, a security token comprising a client identifier and the public key;
requesting, at the client, a digital signature generated from the private key stored in the HSM, wherein the HSM is located away from the client;
receiving, at the client, the digital signature generated from the private key stored in the HSM;
attaching, at the client, the digital signature to the security token to generate a signed security token;
transmitting, from the client, the signed security token to the identity provider in a request for the access token; and
receiving, at the client, the access token from the identity provider, wherein the access token is usable for accessing the secure resource on the remote device.
2. The method of claim 1 , wherein the security token comprises a JSON web token (JWT).
3. The method of claim 2 , wherein the digital signature comprises a JSON Web Signature (JWS).
4. The method of claim 1 , further comprising requesting the public key from a secure vault that is remote from the client.
5. The method of claim 1 , further comprising automatically modifying the private key in the HSM.
6. The method of claim 1 , wherein the digital signature is generated from an asymmetric cryptography algorithm using the private key.
7. The method of claim 1 , wherein the asymmetric cryptography algorithm comprises an at least one of RSA®, Elliptic Curve Cryptography (ECC), or Digital Security Algorithm (DSA).
8. The method of claim 1 , wherein the client comprises a first cloud service attempting to access the secure resource at a second cloud service.
9. The method of claim 1 , wherein the secure resource comprises a file to be downloaded to the client.
10. The method of claim 1 , wherein the access token comprises a client assertion portion that is generated from the private key.
11. The method of claim 1 , wherein the private key is not shared with the client.
12. The method of claim 1 , wherein the private key is not shared outside of the HSM.
13. A system for generating a digital signature from a private key being stored in a hardware security module to be used in authenticating a client to access a secure resource on a remote device, the system comprising:
memory embodied with executable instructions for accessing the HSM to generate the digital signature from the private key upon request of the client; and
at least one processor programmed to:
receive, at a secure vault, a security token comprising a client identifier associated with the client or a user of the client,
generate the digital signature from the private key stored in the HSM, and
transmit the digital signature generated from the private key stored in the HSM to the client for use, by the client, to obtain an access token to a secure resource on a remote device.
14. The system of claim 13 , wherein the digital signature is attached to a security token generated by the client to create a signed signature token for use by the client to obtain the access token.
15. The system of claim 13 , wherein the digital signature comprises a JSON Web Signature (JWS).
16. The system of claim 13 , wherein the at least one processor is further programmed to:
wait a predetermined period of time to change the private key in the HSM,
incident to expiration of the period of time, issue a new private key, and
replace the private key in the HSM with the new private key.
17. The system of claim 16 , wherein the at least one processor is further programmed to seamlessly rotate the private key in the HSM with the new private key without user interaction, wherein the private key is replaced with the new private key in a seamless manner for reducing impact to generating digital signatures.
18. Computer-storage memory embodied with executable instructions executable that cause one or more processors to perform operations for authenticating a client to access a secure resource on a remote device using a public key and a private key, wherein the private key is stored in a hardware security module (HSM) away from the client, the operations comprising:
generating, at the client, a security token comprising a client identifier and the public key;
requesting, at the client, a digital signature generated from the private key stored in the HSM, wherein the client does not have access to the HSM;
receiving, at the client, the digital signature generated from the private key;
attaching, at the client, the digital signature to the security token to generate a signed security token;
transmitting, from the client, the signed security token to an identity provider in a request for the access token;
receiving, at the client, the access token that is usable to access the secure resource on the remote device; and
storing the access token on the client.
19. The computer-storage memory of claim 18 , further comprising:
transmitting the access token to the remote device; and
receiving the secure resource incident to the remote device authenticating the client with the access token.
20. The computer-storage memory of claim 18 , wherein the HSM is not accessible by the client.