Cryptographic processing
Disclosed are various embodiments for cryptographic processing on client devices. A cryptographic service can receive a cryptographic operation request from a client application. The cryptographic operation request can include a key identifier for a private key and data to be cryptographically processed and the cryptographic operation request specifying a cryptographic operation to be performed. A cryptographic provider can then be identified based at least in part on the key identifier for the private key. A request is subsequently sent to the cryptographic provider to perform the cryptographic operation on the data using the private key. A response is then received from the cryptographic provider and sent to the client application.
1 . A system, comprising:
a computing device comprising a processor and a memory; and
machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
receive, through an inter-process communication by a cryptographic service executing on the computing device, a cryptographic operation request from a client application executing on the computing device, the cryptographic operation request comprising a key identifier for a private key and data to be cryptographically processed and the cryptographic operation request specifying a cryptographic operation to be performed, wherein the cryptographic operation request is received as an invocation of a standardized application programming interface (API) of the cryptographic service;
identify, by the cryptographic service, a cryptographic provider based at least in part on the key identifier for the private key;
obtain a user identifier associated with a user of the client application;
retrieve a compliance policy associated with the user identifier;
determine, based on the compliance policy associated with the user identifier, whether the client application is permitted to use the cryptographic provider;
in response to determining that the client application is permitted to use the cryptographic provider, send a request to the cryptographic provider to perform the cryptographic operation on the data using the private key, wherein the cryptographic service implements vendor-specific code of the cryptographic provider to execute the standardized API such that the client application can access the cryptographic operation without implementing a vendor-supplied library of the cryptographic provider;
receive, from the cryptographic provider by the cryptographic service, a request for a passcode used to decrypt the private key stored by the cryptographic provider;
display a prompt on a user interface of the computing device to enter the passcode and receive input of the passcode on the user interface by the cryptographic service; and
provide the passcode from the cryptographic service to the cryptographic provider, wherein the cryptographic provider decrypts the private key using the passcode and executes the cryptographic operation on the data using the decrypted private key.
2 . The system of claim 1 , wherein the machine-readable instructions further cause the computing device to at least:
receive, from the cryptographic provider, a cryptographic result of the cryptographic operation; and
send a reply to the client application, the reply comprising the cryptographic result.
3 . The system of claim 1 , wherein the cryptographic provider is a local credential store.
4 . The system of claim 1 , wherein the cryptographic provider is a remote credential store in data communication with the computing device via a network.
5 . The system of claim 1 , wherein the cryptographic provider is a hardware security module.
6 . The system of claim 1 , wherein the machine-readable instructions further cause the computing device to at least:
obtain an application identifier associated with the client application;
retrieve a second compliance policy associated with the application identifier;
determine that the second compliance policy associated with the application identifier conflicts with the compliance policy associated with the user identifier; and
apply conflict resolution based on compliance policy hierarchy or compliance policy specificity to determine whether the client application is permitted to use the cryptographic provider.
7 . A method, comprising:
receiving, through an inter-process communication by a cryptographic service executing on a computing device, a cryptographic operation request from a client application executing on the computing device, the cryptographic operation request comprising a key identifier for a private key and data to be cryptographically processed and the cryptographic operation request specifying a cryptographic operation to be performed, wherein the cryptographic operation request is received as an invocation of a standardized application programming interface (API) of the cryptographic service;
identifying, by the cryptographic service, a cryptographic provider based at least in part on the key identifier for the private key;
obtaining a user identifier associated with a user of the client application;
retrieving a compliance policy associated with the user identifier;
determining, based on the compliance policy associated with the user identifier, whether the client application is permitted to use the cryptographic provider;
in response to determining that the client application is permitted to use the cryptographic provider, sending a request to the cryptographic provider to perform the cryptographic operation on the data using the private key, wherein the cryptographic service implements vendor-specific code of the cryptographic provider to execute the standardized API such that the client application can access the cryptographic operation without implementing a vendor-supplied library of the cryptographic provider;
receiving, from the cryptographic provider by the cryptographic service, a request for a passcode used to decrypt the private key stored by the cryptographic provider;
displaying a prompt on a user interface of the computing device to enter the passcode and receive input of the passcode on the user interface by the cryptographic service; and
providing the passcode from the cryptographic service to the cryptographic provider, wherein the cryptographic provider decrypts the private key using the passcode and executes the cryptographic operation on the data using the decrypted private key.
8 . The method of claim 7 , further comprising:
receiving, from the cryptographic provider, a cryptographic result of the cryptographic operation; and
sending a reply to the client application, the reply comprising the cryptographic result.
9 . The method of claim 7 , wherein the cryptographic provider is a local credential store.
10 . The method of claim 7 , wherein the cryptographic provider is a remote credential store in data communication with the computing device via a network.
11 . The method of claim 7 , wherein the cryptographic provider is a hardware security module.
12 . The method of claim 7 , further comprising:
obtaining an application identifier associated with the client application;
retrieving a second compliance policy associated with the application identifier;
determining that the second compliance policy associated with the application identifier conflicts with the compliance policy associated with the user identifier; and
applying conflict resolution based on compliance policy hierarchy or compliance policy specificity to determine whether the client application is permitted to use the cryptographic provider.
13 . A non-transitory, computer-readable medium, comprising machine readable instructions that, when executed by a processor of a computing device, cause the computing device to at least:
receive, through an inter-process communication by a cryptographic service executing on the computing device, a cryptographic operation request from a client application executing on the computing device, the cryptographic operation request comprising a key identifier for a private key and data to be cryptographically processed and the cryptographic operation request specifying a cryptographic operation to be performed;
identify, by the cryptographic service, a cryptographic provider based at least in part on the key identifier for the private key;
obtain a user identifier associated with a user of the client application;
retrieve a compliance policy associated with the user identifier;
determine, based on the compliance policy associated with the user identifier, whether the client application is permitted to use the cryptographic provider;
in response to determining that the client application is permitted to use the cryptographic provider, send a request to the cryptographic provider to perform the cryptographic operation on the data using the private key, wherein the cryptographic service implements vendor-specific code of the cryptographic provider to execute the standardized API such that the client application can access the cryptographic operation without implementing a vendor-supplied library of the cryptographic provider;
receive, from the cryptographic provider by the cryptographic service, a request for a passcode used to decrypt the private key stored by the cryptographic provider;
display a prompt on a user interface of the computing device to enter the passcode and receive input of the passcode on the user interface by the cryptographic service; and
provide the passcode from the cryptographic service to the cryptographic provider, wherein the cryptographic provider decrypts the private key using the passcode and executes the cryptographic operation on the data using the decrypted private key.
14 . The non-transitory, computer-readable medium of claim 13 , wherein the machine-readable instructions further cause the computing device to at least:
receive, from the cryptographic provider, a cryptographic result of the cryptographic operation; and
send a reply to the client application, the reply comprising the cryptographic result.
15 . The non-transitory, computer-readable medium of claim 13 , wherein the cryptographic provider is a remote credential store in data communication with the computing device via a network.
16 . The non-transitory, computer-readable medium of claim 13 , wherein the cryptographic provider is a hardware security module.
17 . The non-transitory, computer-readable medium of claim 13 , wherein the machine-readable instructions further cause the computing device to at least:
obtain an application identifier associated with the client application;
retrieve a second compliance policy associated with the application identifier;
determine that the second compliance policy associated with the application identifier conflicts with the compliance policy associated with the user identifier; and
apply conflict resolution based on compliance policy hierarchy or compliance policy specificity to determine whether the client application is permitted to use the cryptographic provider.