Enhanced security systems and methods using a hybrid security solution
This disclosure relates to, among other things, electronic device security systems and methods. Certain embodiments disclosed herein provide for protection of cryptographic keys and/or associated operations using both an operating system security service and a software-based whitebox cryptographic security service executing on a device. Leveraging operating system security services and software-based whitebox cryptographic security services may provide enhanced security when compared to using either service alone to protect cryptographic keys and associated operations. In additional embodiments, server-side cryptographic security solutions may be further used to enhance device security implementations.
1. A method for performing cryptographic operations by an application executing on a device comprising a processor and a non-transitory computer-readable medium storing instructions that, when executed by the processor, cause the device to perform the method, the method comprising:
retrieving, by the application executing on the device, an encrypted wrapped private key;
sending, by the application to an operating system security service associated with the device, the encrypted wrapped private key for decryption;
receiving, by the application from the operating system security service, a wrapped private key, the wrapped private key being generated by the operating system security service using the encrypted wrapped private key;
sending, by the application to a software cryptographic service associated with the device, the wrapped private key for unwrapping;
sending, by the application to the software cryptographic service, a cryptographic operation request, the cryptographic operation request comprising first data to be operated on by the software cryptographic service; and
receiving, by the application from the software cryptographic service, second data, the second data being generated by the software cryptographic service using the first data and a private cryptographic key generated at least in part by decrypting the wrapped private key.
2. The method of claim 1 , wherein the encrypted wrapped private key is encrypted using a public key associated with the operating system security service.
3. The method of claim 2 , wherein the wrapped private key is generated by decrypting the encrypted wrapped private key using a private key associated with the operating system security service.
4. The method of claim 1 , wherein the software cryptographic service comprises a whitebox protected cryptographic service.
5. The method of claim 4 , wherein the whitebox protected cryptographic service comprises a secure key box service.
6. The method of claim 1 , wherein the wrapped private key comprises the private cryptographic key encrypted using a wrapping key associated with the software cryptographic service.
7. The method of claim 6 , wherein the method further comprises decrypting, by the software cryptographic service, the wrapped private key using the wrapping key to generate the private cryptopgraphic key.
8. The method of claim 1 , wherein retrieving the encrypted wrapped private key comprises:
receiving, by the application, a first private key package; and
extracting, from the first private key package, the encrypted wrapped private key.
9. The method of claim 8 , wherein the first private key package is retrieved from storage associated with the device.
10. The method of claim 9 , wherein the method further comprises retrieving, by the application, an encrypted first nonce from the storage associated with the device.
11. The method of claim 10 , wherein the method further comprises sending, by the application, the encrypted first nonce to a server service for decryption.
12. The method of claim 11 , wherein the encrypted first nonce is encrypted using a public key associated with the server service.
13. The method of claim 12 , wherein the method further comprises, receiving, from the server service, the first nonce, the first nonce being generated by decrypting the encrypted first nonce.
14. The method of claim 13 , wherein the first private key package is generated based, at least in part, on the first nonce and the encrypted wrapped private key.
15. The method of claim 14 , wherein the first private key package comprises the first nonce XORed with the encrypted wrapped private key.
16. The method of claim 14 , wherein the extracting of the encrypted wrapped private key uses the first nonce received from the server service and the first private key package.
17. The method of claim 12 , wherein the method further comprises generating a second nonce.
18. The method of claim 17 , wherein the method further comprises encrypting the second nonce using the public key associated the server service and transmitting the encrypted second nonce to the server service.
19. The method of claim 18 , wherein the method further comprises generating a second private key package based on the second nonce and the encrypted wrapped private key and transmitting the second private key package to the storage associated with the device.
20. The method of claim 19 , wherein the second private key package comprises the second nonce XORed with the encrypted wrapped private key.