Private key cloud storage

1. A system comprising:

a customer device that is communicatively connected to a network storage, wherein the network storage is configured to store an encrypted private key comprising a private key of an asymmetrical key pair that has been encrypted using a customer secret, and wherein the customer device comprises:

one or more processors;

memory accessible to the one or more processors, the memory storing instructions which, upon execution by the one or more processors, causes the one or more processors to:

retrieve the encrypted private key from the network storage; and

obtain a customer secret; and

a secure execution environment and configured to:

decrypt the encrypted private key using the customer secret to obtain the private key;

temporarily store the private key for use in a cryptographic operation;

perform the cryptographic operation using the private key;

after performing the cryptographic operation using the private key, delete the private key from a memory of the secure execution environment; and

provide a result of the cryptographic operation.

2. The system according to claim 1 , wherein the instructions, upon execution by the one or more processors, further causes the one or more processors to:

configure a first secure link between the secure execution environment of the customer device and an application executing on the customer device; and

obtain the customer secret via the first secure link,

wherein the secure execution environment is configured to provide the result of the cryptographic operation to the application via the first secure link.

3. The system according to claim 1 , wherein the instructions, upon execution by the one or more processors, further causes the one or more processors to:

configure a second secure link for transmission of the encrypted private key between the network storage and the customer device, and/or wherein the secure execution environment is further configured to:

create the asymmetrical key pair comprising the private key;

temporarily store the private key until stored in the network storage; and

encrypt the private key using the customer secret before transmission to the network storage,

wherein the customer device is further configured to transmit the encrypted private key to the network storage.

4. The system of claim 1 , wherein the secure execution environment is embedded in the customer device.

5. The system of claim 1 , wherein the secure execution environment is detachably connected to the customer device.

6. A customer device comprising:

one or more processors;

memory accessible to the one or more processors, the memory storing instructions which, upon execution by the one or more processors, causes the one or more processors to:

retrieve an encrypted private key of an asymmetrical key pair from a network storage; and

obtain a customer secret; and

a secure execution environment and configured to:

decrypt the encrypted private key using the customer secret to obtain a private key;

temporarily store the private key for use in a cryptographic operation;

perform the cryptographic operation using the private key;

after performing the cryptographic operation using the private key, delete the private key from a memory of the secure execution environment; and

provide a result of the cryptographic operation.

7. The customer device according to claim 6 , wherein the instructions, upon execution by the one or more processors, further causes the one or more processors to:

configure a first secure link between a secure execution environment of the customer device and an application executing on the customer device; and

obtain the customer secret via the first secure link,

wherein the secure execution environment is configured to provide the result of the cryptographic operation to the application via the first secure link.

8. The customer device of claim 6 , wherein the secure execution environment is embedded in the customer device.

9. The customer device of claim 6 , wherein the secure execution environment is detachably connected to the customer device.

10. A method comprising:

storing an encrypted private key in a network storage, the encrypted private key comprising a private key of an asymmetrical key pair that has been encrypted using a customer secret;

retrieving, by a customer device, the encrypted private key from the network storage;

decrypting, by a secure execution environment of the customer device, the encrypted private key using the customer secret to obtain the private key;

temporarily storing, by the secure execution environment, the private key for use in a cryptographic operation;

performing, by the secure execution environment, the cryptographic operation using the private key;

after performing the cryptographic operation using the private key, deleting the private key from a memory of the secure execution environment; and

providing a result of the cryptographic operation.

11. The method according to claim 10 , further comprising:

configuring a first secure link between the secure execution environment of the customer device and an application executing on the customer device;

obtaining the customer secret via the first secure link in the secure execution environment; and

providing the result of the cryptographic operation to the application via the first secure link.

12. The method according to claim 11 , further comprising: configuring a second secure link for transmission of the private key between the network storage and the secure execution environment.

13. The method according to claim 10 , further comprising:

creating the asymmetrical key pair comprising the private key in the secure execution environment;

temporarily storing the private key in the secure execution environment until stored in the network storage;

encrypting the private key in the secure execution environment using the customer secret before transmission to the network storage; and

transmit the encrypted private key from the customer device to the network storage.

14. A method comprising:

retrieving, by a customer device, an encrypted private key of an asymmetrical key pair from a network storage;

obtaining, by the customer device, a customer secret;

decrypting, by a secure execution environment of the customer device, the encrypted private key using the customer secret to obtain a private key;

temporarily storing, by the secure execution environment, the private key for use in a cryptographic operation;

performing, by the secure execution environment, the cryptographic operation using the private key;

after performing the cryptographic operation using the private key, deleting the private key from a memory of the secure execution environment; and

providing a result of the cryptographic operation.

15. The method according to claim 14 , further comprising:

configuring a first secure link between a secure execution environment of the customer device and an application executing on the customer device;

obtaining the customer secret via the first secure link in the secure execution environment; and

providing the result of the cryptographic operation to the application via the first secure link.

16. The method according to claim 14 , further comprising:

creating the asymmetrical key pair comprising the private key in the secure execution environment;

temporarily storing the private key in the secure execution environment until stored in the network storage;

encrypting the private key in the secure execution environment using the customer secret before transmission to the network storage; and

transmit the encrypted private key from the customer device to the network storage.