Scalable and secure key management for cryptographic data processing
A method and system for secure and scalable key management for cryptographic processing of data is described herein. In the method, a General Purpose Cryptographic Engine (GPE) receives key material via a secure channel from a key server and stores the received Key encryption keys (KEKs) and/or plain text keys in a secure key cache. When a request is received from a host to cryptographically process a block of data, the requesting entity is authenticated using an authentication tag included in the request. The GPE retrieves a plaintext key or generate a plaintext using a KEK if the authentication is successful, cryptographically processes the data using the plaintext key and transmits the processed data. The system includes a key server that securely provides encrypted keys and/or key handles to a host and key encryption keys and/or plaintext keys to the GPE.
1. A method of secure key handling and cryptographic processing of data, comprising:
receiving a request in a cryptography engine from an entity to cryptographically process a block of data, the request including a key handle having an authentication tag and an index;
authenticating the requesting entity using the authentication tag;
referencing a key from a plurality of keys using the index if the requesting entity is authenticated successfully;
cryptographically processing the block of data using the key; and
transmitting the processed data.
2. The method of claim 1 wherein authenticating further comprises using a shared secret to authenticate the requesting entity.
3. The method of claim 2 , wherein authenticating further comprises decrypting the key handle using the shared secret.
4. The method of claim 1 , wherein authenticating further comprises using a one-time password to authenticate the requesting entity.
5. The method of claim 1 , further comprising, prior to receiving a request to cryptographically process data, receiving the plurality of keys via a secure communications channel from a key server.
6. The method of claim 5 , further comprising storing the received keys in a secure key cache.
7. The method of claim 1 , wherein the authentication tag is assigned by a server.
8. A general purpose cryptographic engine (GPE) for secure key management and cryptographic processing of data, comprising:
a secure memory configured to store a plurality of keys;
a security processing unit configured to receive a request from a requesting entity to cryptographically process a block of data, the request including a key handle, wherein the key handle includes an authentication tag and an index that enables retrieval of a key from the secure memory; and
a key manager coupled to the security processing unit and configured to authenticate the requesting entity based on the authentication tag and to retrieve the key based on the index if the host is authenticated successfully;
wherein the security processing unit is further configured to cryptographically process the block of data using the retrieved key and to transmit the processed data.
9. The GPE of claim 8 , wherein the GPE and the requesting, entity are on the same device.
10. The GPE of claim 8 , wherein the key manager is configured to authenticate the requesting entity using a shared secret.
11. The GPE of claim 10 , wherein the key manager is configured to decrypt the key handle using the shared secret.
12. The GPE of claim 8 , further comprising a secure key cache coupled to the key manager and configured to store the retrieved key.
13. The GPE of claim 8 , wherein the key manager is configured to use a One-Time Password (OTP) to authorize release of the key and to increment one OTP.
14. The GPE of claim 13 , wherein the stored authentication tag is assigned by a server.
15. The GPE of claim 8 , wherein the key manager is further configured to enforce security policies.