BACKGROUND

The invention relates in general to methods and systems for managing cryptographic objects (COs). In particular, it is directed to methods to generate COs through a reference key that is securely stored on and/or derived in a security module (SM) such as a hardware security module (HSM), wherein the methods allow the generated objects to be anchored to this reference key. Such methods notably allow a post-quantum secure generation of COs.

Key management relates to the management of cryptographic keys in a cryptosystem, which involves operations such as the generation, storage, use, destruction and replacement of keys. Key management requires specific cryptographic protocols, key servers, and other procedures.

A key management system (KMS) is a system that generates, distributes and, more generally, manages cryptographic keys for clients (e.g., devices, applications, etc.). A KMS may handle several aspects of security, ranging from secure generation of keys up to secure key handling and storage on the clients. A KMS typically includes a backend functionality for key generation, distribution, and replacement. It may further integrate specific client functionalities for injecting, storing, and managing keys on the clients.

Key management and key management systems are becoming increasingly important for the security of connected devices and applications with the development of the Internet of Things and cloud computing.

HSMs are physical computing devices that protect and manage COs such as encryption keys for performing cryptographic operations such as crypto-processing (e.g., encrypt, decrypt, wrap, unwrap, derive, etc.) and strong authentication. HSMs may typically handle symmetric keys (e.g., AES) and asymmetric keys (e.g., RSA, ECC). They are usually embodied as physical devices (e.g., plug-in cards) that typically attach directly to a computer (e.g., a network server) but may also be implemented in software.

HSMs typically comprise secure crypto-processor chips to prevent tampering and bus probing. In general, HSMs may be designed to provide tamper evidence and tamper resistance (e.g., to delete keys upon tamper detection). HSM systems are sometimes able to securely back up keys they manage. HSMs are typically clustered to provide high availability and, as such, conform to high-availability requirements of modern datacenter environments. HSMs may notably form part of infrastructures such as online banking applications and public key infrastructures.

Amongst other functions, a HSM may rely on specific hardware, which typically exploits a physical process, to create a sufficient source of randomness (e.g., characterized by entropy). The available randomness is, in turn, used to generate random keys.

The functionality of a HSM may be implemented in various ways, for example using a dedicated hardware appliance (preferably with tamper resistance), using a secure server, a software enclave, a trusted platform module (TPM), etc. Thus, various security modules (SM) may be contemplated, which may be used to provide, manipulate, and/or or manage COs.

WO 2018/218349A1 describes a HSM and the mechanism used to connect and use the HSM. For example, this reference may comprise two or more hardware ports each of which is operable to electronically receive given input hardware port-specific cryptographic data thereon to initiate execution of an internal cryptographic process. The reference may comprise two or more segregated hardware port-specific storage spaces each operatively linked to a corresponding one of the hardware porta via a hardware link. However, the reference only describes the mechanism behind a HSM and does not describe a crypto-anchor mechanism through a key pairing to the HSM.

EP 3 432 509 A1 describes a quantum key distribution system including controllers, networks, and channels. The reference relates to an encrypted channel establishment method as well as a communication protocol. However, the reference only describes the quantum key distribution mechanism and does not describe a crypto-anchor mechanism through a key pairing to the HSM.

The security of a network connectivity to a SM may be achieved in various ways, for example, by using quantum safe channel negotiation principles or physical protection from wire-tapping.

It is known that RSA and ECC public/private key pairs are not (or will not be) secure against attacks by a sufficiently powerful quantum computer running a Shor algorithm or a Grover algorithm. Those skilled in the art will understand that these algorithms may be well-matched to quantum computers. Such a security threat will be prevalent in the future, owing to the fast development of quantum computers. It is in fact already a reality if one considers wiretapping.

SUMMARY

According to a first aspect, the present invention is embodied as a method of managing cryptographic objects (COs). This method comprises accessing an entropy-based random number and instructing to store this random number (e.g., to be able to later re-access that same random number). The method comprises generating one or more COs based on a deterministic algorithm. The algorithm may be configured to interact with a security module (SM), such as a hardware security module (HSM), to generate a seed according to both a reference key of the SM and the random number accessed. The method comprises seeding a random number generator with the generated seed to generate the desired COs.

This method allows a trust-anchor to be achieved, whereby the cryptographic objects generated are anchored to the reference key that is securely stored on or derived, on purpose, at the SM. The method is accordingly configured for a secure generation of cryptographic objects, where only the random number used to generate such objects need be stored. The generated COs may be deleted entirely or at least partly after use, as the deterministic algorithm used by the method may be later called again to recreate the same objects, due to the stored random number and the availability of the reference key in the SM. This method may be used to generate post-quantum secure cryptographic keys.

In embodiments, the method further comprises using one or each of the one or more COs generated to perform a cryptographic operation and deleting one or more of the COs previously generated. Thanks to the deterministic scheme used and the fact that the random number has been stored, the previously generated objects (or part thereof) may be safely deleted.

Preferably, the method further comprises regenerating one or more previously deleted COs by accessing the previously stored random number, and, based on the same deterministic algorithm as previously used, interacting with the SM to regenerate the seed according to both the reference key and the previously stored random number. Thus, the random number generator may be seeded with the regenerated seed. Any COs accordingly regenerated may then be used to perform a cryptographic operation, if and as needed.

In embodiments, the SM institutes a key hierarchy and the above method further comprises, at the SM, deriving said reference key based on a key of a deeper key hierarchy level of this hierarchy, prior to generating the seed.

The method preferably relies on two random numbers. That is, said random number may be a first random number, while the method may further comprise, prior to generating the seed: accessing a second entropy-based random number; instructing to store the second random number; and interacting with the SM for it to derive said reference key using both the second random number and the key of the deeper key hierarchy level.

In preferred embodiments, the random number generator is seeded to generate two COs, these including a private key and a public key. Then, the method may further comprise sending out the public key and using the private key to perform a cryptographic operation.

Preferably, sending out the public key comprises sending the public key to a certificate authority for it to issue a digital certificate for said public key.

The steps of accessing the random number, generating the seed, and seeding the random number generator may be, for example, performed by a client communicating with said SM, whereby the public key is sent from the client to the certificate authority.

Preferably, the method further comprises instructing (e.g., at the client) to store the public key on an external storage system that is distinct from the client.

In particular, the method may further comprise: sending said random number to the certificate authority along with the public key for the certificate authority to issue one or more digital certificates for said public key and said random number; and, at the client, instructing to store the random number on a storage system (e.g., distinct from the client). When needed, the cryptographic objects may be recalled by the client and their authenticity may be checked by the client by certificates corresponding to such objects.

In embodiments, clients are configured as containers. In particular, the steps of accessing the random number, generating the seed, and seeding the random number generator are carried out in a container.

In preferred embodiments, the steps of the method are concurrently performed at each client of a set of clients, each communicating with a SM (e.g., either the same SM or respective SMs). In that case, the method comprises performing steps as described above at said each client. Namely, such steps include accessing an entropy-based random number, instructing to store this random number, and, based on a deterministic algorithm, interacting with a SM to generate a seed according to the random number accessed and a reference key of the SM, and seeding a random number generator with the generated seed to generate one or more COs.

In some application scenarios, the deterministic algorithm and the random number accessed are the same for each of the clients of the set, whereby the same one or more COs are generated at each of the clients of the set.

The method may further comprise steps of receiving entropy-based random numbers from one or more certificate authorities, concurrently at the clients and prior to accessing the entropy-based random number.

The method may comprise, at each of the clients of the set, using one or each of the one or more COs generated to perform a cryptographic operation.

In particular, the method may further comprise, after using said one or each of the one or more COs generated to perform said cryptographic operation: deleting said one or more of the COs; and receiving (possibly distinct) random numbers at the clients from one or more certificate authorities, wherein said random numbers correspond to same random numbers as initially accessed by the clients, such that the clients are able to regenerate the same one or more COs as previously generated.

Preferably, the method further comprises, prior to sending said random numbers to the clients, sending, from one or more certificate authorities, public keys of all of the clients to each of the clients, for each client to be configured to verify an authenticity of a random number received thereat. This mechanism enables an all-to-all communication channel to be established amongst the participating clients (e.g., containers), because it enables to regenerate key pairs used for channel encryption.

In embodiments, the method further includes instructing to generate (e.g., locally) said entropy-based random number, prior to accessing it.

Preferably, interacting with the SM comprises: forwarding the random number accessed to the SM; instructing the SM to generate the seed according to the random number forwarded to it and the reference key; and receiving the generated seed.

In preferred embodiments, said seed is generated by encrypting the random number using the reference key. The reference key as used to generate the seed is preferably a key pre-loaded on the SM. In embodiments, the SM further comprises a first key pre-loaded on the SM as a non-extractable token object, and the method further comprises: importing a second key in a wrapped state in the SM; using the first key to unwrap the second key; and using the unwrapped key to generate the seed.

According to another aspect, the invention is embodied as a computerized system for managing COs. The system comprises a random number generator, storage means storing instructions, as well as processing means configured to execute said instructions. In operation, this causes to access an entropy-based random number, instruct to store a random number accessed as per said instructions, and generate one or more COs based on a deterministic algorithm. As explained earlier, this algorithm causes the system to interact with a SM, to generate a seed according to a reference key of the SM and a random number accessed as per said instructions. Executing said instructions further causes to seed the random number generator with a seed as generated as per said instructions, to thereby generate desired COs, in operation of the system.

In preferred embodiments, the above system comprises a subsystem configured to interact with the SM, the latter distinct from said subsystem, for efficiency reasons.

According to a further aspect, the invention is embodied as a computer program product for managing COs. The computer program product comprises a computer readable storage medium having program instructions embodied therewith. The program instructions are executable by one or more processors, to cause to implement all the steps of a method such as described above.

Computerized systems, methods, and computer program products embodying the present invention will now be described, by way of non-limiting examples, and in reference to the accompanying drawings.

