Method and apparatus for generating a privilege-based key
Disclosed is a method for generating a privilege-based key using a computer. In the method, a privilege is received from an application, and verified as being associated with the application. The computer cryptographically generates a second key using a first key and the privilege. The second key is provided to the application.
1. A method for generating a privilege-based key, comprising:
receiving, by a client environment, a list of privileges from a key-requesting application, wherein a digital signature is based on the list of privileges and program code of the key-requesting application;
verifying, by the client environment, that the list of privileges is associated with the key-requesting application using the digital signature;
if the list of privileges is verified by the client environment, then:
forwarding, by the client environment, the verified list of privileges to a secure hardware;
cryptographically generating, by the secure hardware, a second key using a first key and the verified list of privileges; and
providing, by the secure hardware, the second key to the key-requesting application.
2. The method of claim 1 , wherein the first key is a shared secret key.
3. The method of claim 1 , wherein the first key is a device key unique to a device.
4. The method of claim 1 , wherein the second key is an encryption key.
5. The method of claim 1 , wherein the second key is a temporary session key.
6. The method of claim 1 , wherein the list of privileges includes a file system permission.
7. The method of claim 1 , wherein the list of privileges includes a resource access right.
8. The method of claim 1 , wherein the list of privileges comprises a 32-bit integer.
9. The method of claim 1 , wherein cryptographically generating the second key using the first key and the list of privileges comprises performing a hash using the first key and the list of privileges as inputs to generate the second key.
10. The method of claim 1 , wherein cryptographically generating the second key using the first key and the list of privileges comprises performing a one-way cryptographic operation using the first key and the list of privileges as inputs to generate the second key.
11. The method of claim 1 , wherein the list of privileges is associated with the key-requesting application by the digital signature.
12. The method of claim 11 , wherein the list of privileges associated with the key-requesting application is declared by a developer of the program code of the key-requesting application, and wherein the program code includes an executable software module.
13. An apparatus for generating a privilege-based key, comprising:
means for receiving a list of privileges from a key-requesting application, wherein a digital signature is based on the list of privileges and program code of the key-requesting application;
means for verifying the list of privileges is associated with the key-requesting application using the digital signature; and
means for forwarding, if the list of privileges is verified, the verified list of privileges;
means for cryptographically generating a second key using a first key and the verified list of privileges; and
means for providing the second key to the key-requesting application.
14. The apparatus of claim 13 , wherein the first key is a shared secret key.
15. The apparatus of claim 13 , wherein the first key is a device key unique to a device.
16. The apparatus of claim 13 , wherein the second key is an encryption key.
17. The apparatus of claim 13 , wherein the second key is a temporary session key.
18. The apparatus of claim 13 , wherein the list of privileges includes a file system permission.
19. The apparatus of claim 13 , wherein the list of privileges includes a resource access right.
20. The apparatus of claim 13 , wherein the list of privileges comprises a 32-bit integer.
21. The apparatus of claim 13 , wherein the means for cryptographically generating the second key using the first key and the verified list of privileges comprises means for performing a hash using the first key and the verified list of privileges as inputs to generate the second key.
22. The apparatus of claim 13 , wherein the means for cryptographically generating the second key using the first key and the verified list of privileges comprises means for performing a one-way cryptographic operation using the first key and the verified list of privileges as inputs to generate the second key.
23. An apparatus for generating a privilege-based key, comprising:
a memory configured to store data;
a processor configured to:
receive a list of privileges from a key-requesting application, wherein a digital signature is based on the list of privileges and program code of the key-requesting application;
verify the list of privileges is associated with the key-requesting application using the digital signature; and
forward, if the list of privileges is verified, the verified list of privileges to a secure hardware; and
the secure hardware configured to:
cryptographically generate a second key using the verified list of privileges and a first key stored in the memory; and
provide the second key to the key-requesting application.
24. The apparatus of claim 23 , wherein the first key is a shared secret key.
25. The apparatus of claim 23 , wherein the first key is a device key unique to a device.
26. The apparatus of claim 23 , wherein the second key is an encryption key.
27. The apparatus of claim 23 , wherein the second key is a temporary session key.
28. The apparatus of claim 23 , wherein the list of privileges includes a file system permission.
29. The apparatus of claim 23 , wherein the list of privileges includes a resource access right.
30. The apparatus of claim 23 , wherein the list of privileges comprises a 32-bit integer.
31. The apparatus of claim 23 , wherein to cryptographically generate the second key using the first key and the verified list of privileges comprises to perform a hash using the first key and the verified list of privileges as inputs to generate the second key.
32. The apparatus of claim 23 , wherein to cryptographically generate the second key using the first key and the verified list of privileges comprises to perform a one-way cryptographic operation using the first key and the verified list of privileges as inputs to generate the second key.
33. A non-transitory computer-readable medium, comprising:
code for causing a computer to receive a list of privileges from a key-requesting application, wherein a digital signature is based on the list of privileges and program code of the key-requesting application;
code for causing the computer to verify the list of privileges is associated with the key-requesting application using the digital signature; and
code for causing the computer to forward, if the list of privileges is verified, the verified list of privileges to a secure hardware configured to cryptographically generate a second key using the verified list of privileges and a first key stored in the memory, and provide the second key to the key-requesting application.
34. The computer-readable medium of claim 33 wherein the first key is a shared secret key.
35. The computer-readable medium of claim 33 , wherein the first key is a device key unique to a device.
36. The computer-readable medium of claim 33 , wherein the second key is an encryption key.
37. The computer-readable medium of claim 33 , wherein the second key is a temporary session key.
38. The computer-readable medium of claim 33 , wherein the list of privileges includes a file system permission.
39. The computer-readable medium of claim 33 , wherein the list of privileges includes a resource access right.
40. The computer-readable medium of claim 33 , wherein the list of privileges comprises a 32-bit integer.
41. The computer-readable medium of claim 33 , wherein to cryptographically generate the second key using the first key and the verified list of privileges comprises to perform a hash using the first key and the verified list of privileges as inputs to generate the second key.
42. The computer-readable medium of claim 33 , wherein to cryptographically generate the second key using the first key and the verified list of privileges comprises to perform a one-way cryptographic operation using the first key and the verified list of privileges as inputs to generate the second key.