Cryptographic services utilizing commodity hardware
The solution herein describes a software module that works in combination with certain hardware (e.g., a particular chipset) to obtain the level of security provided by an HSM. The software module can be implemented on a commodity server. The software module can utilize an HSM or key custodian to obtain cryptographic keys. The cryptographic keys may be stored on the commodity server within a secure memory space managed by the commodity server's chip set. While stored, access to the cryptographic keys may be managed by the chip set. The chip set can ensure that only protected applications associated with the cryptographic keys may access said keys.
1. A computer-implemented method for performing a cryptographic operation by a computing device, the method comprising:
receiving, at a protected application executing on the computing device from a trusted key custodian, a cryptographic key to be used in performing the cryptographic operation in response to future requests, the cryptographic key being received from the trusted key custodian in encrypted form, the computing device storing instructions of the protected application within a secure memory, wherein the secure memory is allocated and managed by a chip set of the computing device;
sending, by the protected application to a hardware security module (HSM), a request to decrypt the cryptographic key;
receiving, by the protected application from the HSM, the cryptographic key as decrypted by the HSM;
generating, by the chip set, an encrypted key using the cryptographic key as decrypted by the HSM;
receiving, at a network interface of the computing device from a requesting device, a first request to perform the cryptographic operation on first data in the first request;
retrieving, by the protected application using the chip set, the encrypted key from the secure memory;
performing, by the protected application, the cryptographic operation on the first data using the encrypted key to obtain encrypted first data; and
sending the encrypted first data to the requesting device.
2. The computer-implemented method of claim 1 , further comprising:
receiving, at the network interface of the computing device from the requesting device, encrypted second data;
retrieving, by the protected application using the chip set, the encrypted key from the secure memory;
decrypting, by the protected application and the chip set, the encrypted second data to obtain decrypted second data; and
sending the decrypted second data to the requesting device.
3. The computer-implemented method of claim 1 , wherein the the hardware security module is distinct from the computing device.
4. The computer-implemented method of claim 1 , further comprising:
encrypting, by the chip set, the cryptographic key using a device-specific key to obtain the encrypted key; and
storing the encrypted key in the secure memory managed by the chip set of the computing device.
5. The computer-implemented method of claim 1 , wherein contents of the secure memory are cryptographically hashed by the chip set utilizing a device-specific key.
6. The computer-implemented method of claim 1 , wherein a process of the protected application is allowed access to the secure memory by the chip set, and wherein access the secure memory by a second process is restricted by the chip set, the second process being associated with a different application.
7. The computer-implemented method of claim 1 , further comprising:
establishing, by the protected application, a secure communications channel with the HSM, wherein sending the request to decrypt the cryptographic key is sent via the secure communications channel,
and wherein the cryptographic key as decrypted by the HSM is received over the secure communications channel in response to the request.
8. The computer-implemented method of claim 1 , wherein the cryptographic key is received as part of an initialization process associated with the protected application.
9. A computing device for performing a cryptographic operation comprising:
a hardware processor; and
one or more computer readable medium storing instructions that, when executed by the hardware processor, cause the computing device to perform operations comprising:
receiving, at a protected application executing on the computing device from a trusted key custodian, a cryptographic key to be used in performing the cryptographic operation in response to future requests, the cryptographic key being received from the trusted key custodian in encrypted form, the computing device storing instructions of the protected application within a secure memory, wherein the secure memory is allocated and managed by a chip set of the computing device;
sending, by the protected application to a hardware security module (HSM), a request to decrypt the cryptographic key;
receiving, by the protected application from the HSM, the cryptographic key as decrypted by the HSM;
generating, by the chip set of the computing device, an encrypted key using the cryptographic key as decrypted by the HSM;
receiving, at a network interface of the computing device from a requesting device, a first request to perform the cryptographic operation on first data in the first request;
retrieving, by the protected application using the chip set, the encrypted key from the secure memory;
performing, by the protected application and the chip set, the cryptographic operation on the first data using the encrypted key to obtain encrypted first data; and
sending the encrypted first data to the requesting device.
10. The computing device of claim 9 , the instructions further causing the computing device to perform operations comprising:
receiving, at the network interface of the computing device from the requesting device, encrypted second data;
retrieving, by the protected application using the chip set, the encrypted key from the secure memory;
decrypting, by the protected application and the chip set, the encrypted second data to obtain decrypted second data; and
sending the decrypted second data to the requesting device.
11. The computing device of claim 9 , wherein the hardware security module is distinct from the computing device.
12. The computing device of claim 9 , the instructions further causing the computing device to perform operations comprising:
encrypting, by the chip set, the cryptographic key using a device-specific key to obtain the encrypted key; and
storing the encrypted key in the secure memory managed by the chip set of the computing device.
13. The computing device of claim 9 , wherein contents of the secure memory are cryptographically hashed by the chip set utilizing a device-specific key.
14. The computing device of claim 9 , wherein a process of the protected application is allowed access to the secure memory by the chip set, and wherein access the secure memory by a second process is restricted by the chip set, the second process being associated with a different application.
15. The computing device of claim 9 , the instructions further causing the computing device to perform operations comprising:
establishing, by the protected application, a secure communications channel with the HSM, wherein sending the request to decrypt the cryptographic key is sent via the secure communications channel,
and wherein the cryptographic key as decrypted by the HSM is received over the secure communications channel in response to the request.
16. The computing device of claim 9 , wherein the cryptographic key is received as part of an initialization process associated with the protected application.