BACKGROUND OF THE INVENTION

1. Field of the Invention

[0001] The present disclosure relates generally to systems and methods for providing a trusted key store.

2. Description of The Related Art

[0002] Electronic transaction devices, such as point of sale devices, often have limited secure storage for storing things like encryption keys. As the number of keys that are managed grows, the amount of secure storage that may be used for other purposes may be reduced.

SUMMARY OF THE INVENTION

[0003] Systems and methods for providing a trusted keystore are disclosed. In one embodiment, in an information processing apparatus comprising at least one computer processor, a method for providing a trusted keystore may include: (1) selecting and storing a root Key Block Protection Key (KBPK) in a trusted domain; (2) for each key class: creating a keyblock with a class KBPK; and storing the keyblock in an untmsted keystore in an untmsted domain; (3) loading keyblocks to a trusted key manager in the trusted domain; (4) decrypting the keyblocks with an encryption class key; (5) verifying the keyblocks under a MAC class key; (6) loading class keyblocks to the trusted key manager from the untmsted keystore; (7) writing the keyblocks to the untmsted keystore; and (8) writing class keyblock MACs in a hierarchy to the untmsted keystore. The number of levels in the hierarchy is based on an amount of available storage in the trusted domain [0004] In one embodiment, the root KPBK may be pre-programed.

[0005] In one embodiment, the keyblock may be created using the root

KBPK.

[0006] In one embodiment, the step of loading class keyblocks to the trusted key manager from the untmsted keystore may include authorizing and decrypting the class keyblocks with the root KBPK to get a class KBPK and a keyblockheader.

[0007] In one embodiment, the step of writing the keyblocks to the untmsted keystore may include creating the keyblock with a key, a keyblockheader payload, and a keyblock KBPK.

[0008] In one embodiment, the step of hierarchically writing class keyblock MACs to the untmsted keystore may include creating a MAC for all keyblocks in a keyblock class.

[0009] In one embodiment, the method may further include verifying all the keyblocks under the MAC class key after hierarchically writing class keyblock MACs to the untmsted keystore.

[0010] According to another embodiment, in a trusted key manager comprising at least one computer processor, a method for exercising a key in a trusted keystore may include: (1) receiving a request from an application to exercise a key in an untmsted keystore; (2) reading a keyblock including the key from the untmsted keystore; (3) decrypting and verifying keyblocks in a hierarchy that are below the read keyblock; (4) loading a class Keyblock Protection Key (KBPK) MAC; (5) verifying the class KBPK MAC; (6) tmsting the class KeyBlocks MAC; (7) extracting the key from the keyblock; and (8) loading the key to an engine. The engine may exercise the key. [0011] In one embodiment, the exercise may include at least one of PIN encryption using the key and message authentication using the key.

[0012] In one embodiment, the method may further include verifying that the application is authorized to exercise the key.

[0013] In one embodiment, the engine may perform a cryptographic operation with the key.

[0014] According to another embodiment, a trusted keystore system may include: an untrusted domain comprising an untmsted keystore and an untmsted key manager; a trusted domain comprising a trusted key manager and an engine; and persistent storage. The trusted key manager may select and store a root Key Block Protection Key (KBPK) in the trusted domain. For each key class, the trusted key manager may create a keyblock with a class KBPK and store the keyblock in the untmsted keystore. The untmsted key manager may load keyblocks to a tmsted key manager in the trusted domain, and the trusted key manager may decrypt and verifies keyblocks under a MAC class key. The untmsted key manager may load class keyblocks to the tmsted key manager from the untmsted keystore, may write the keyblocks to the untmsted keystore via the untmsted key manager, and may write class keyblock MACs in a hierarchy to the untmsted keystore via the untmsted key manager. The number of levels in the hierarchy is based on an amount of available storage in the tmsted domain.

[0015] In one embodiment, the root KPBK may be pre-programed in a system-on-a-chip.

[0016] In one embodiment, the keyblock may be created using the root

KBPK. [0017] In one embodiment, the trusted key manager may authorize and decrypt the class keyblocks with the root KBPK to get a class KBPK and a keyblockheader.

[0018] In one embodiment, the keyblock may be created with a key, a keyblockheader payload, and a keyblock KBPK.

[0019] In one embodiment, the untmsted key store may create a MAC for all keyblocks in a keyblock class.

[0020] In one embodiment, the trusted key manager receives a request from an application to exercise a key in the untmsted keystore, may read a keyblock including the key from the untmsted keystore via the untmsted key manager, may decrypt and verify keyblocks in a hierarchy that are below the read keyblock, may load a class Keyblock Protection Key (KBPK) MAC, may verify the class KBPK MAC; may extract the key from the keyblock, and may load the key to an engine. The engine may exercise the key.

[0021] In one embodiment, the exercise may include at least one of PIN encryption using the key and message authentication using the key.

[0022] In one embodiment, the engine may perform a cryptographic operation with the key.

BRIEF DESCRIPTION OF THE DRAWINGS

[0023] For a more complete understanding of the present invention, the objects and advantages thereof, reference is now made to the following descriptions taken in connection with the accompanying drawings in which:

[0024] Figure 1 depicts a system for providing a trusted keystore according to one embodiment; [0025] Figure 2 depicts an exemplary keyblock according to one embodiment;

[0026] Figure 3 depicts an exemplary KBPK hierarchy according to one embodiment;

[0027] Figure 4 depicts an exemplary key hierarchy according to one embodiment;

[0028] Figure 5 depicts an exemplary method for startup and key writing according to one embodiment; and

[0029] Figure 6 depicts an exemplary method for key reading and key exercise according to one embodiment

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

[0030] Embodiments are directed to systems and methods for providing a trusted key store.

[0031] In embodiments, using a key store in an untrusted environment or domain may reduce space required in the trusted environment or domain, may be scalable (e.g., an unbound number of keys can be stored in the key store), may reduce bill of materials cost, may provide robust storage, may facilitate wiping a device while preserving any key content, which may reduce deployment/repair costs, may provide security including replay prevention without requiring monotonic increasing values, such as time, counter, etc., may provide full keystore and individual keyblock security, etc. The keystore may further be optimizable for speed or performance.

[0032] Embodiments may use a message authentication code, or MAC, and an encryption tree to minimize storage space used in the trusted domain, minimize computation effort and/or time in the trusted domain. Embodiments may ensure that the keystore provides replay protection and protection from addition or removal of a keyblock.

[0033] In one embodiment, the secure storage may be configured considering the desired key access speed and an amount of available storage in the trusted domain. For example, if there is more secure storage available, more layers in the hierarchy may be used on the secure side. Thus, less time is required to processing/unwrapping to access the desired key from the untmsted side.

[0034] Referring to Figure 1, a system for providing a trusted keystore is disclosed according to one embodiment. System 100 may include a trusted domain, an untrusted domain, and cloud storage (which may be in the untmsted domain). The untmsted domain may include untmsted keystore 110, untmsted key manger 120, and key loader 130. The trusted domain may include trusted key manger 140 and one or more engine 150. Persistent storage 160 may be stored in the cloud, or in any suitable storage. In one embodiment, persistent storage may be encrypted.

[0035] Application 170 may be provided in the untmsted domain. In one embodiment, application 170 may be a consumer of a key.

[0036] The trusted domain may be any environment that includes software and/or hardware that support an area of sufficient security to protect keys in plaintext (i.e., unencrypted), and may exercise the keys with the required algorithm.

[0037] The untmsted domain may include general purpose software that may exercise or use the keys.

[0038] In one embodiment, the untmsted domain and the tmsted domain may exist in an electronic device, such as a point of sale device. [0039] In one embodiment, untmsted key store 110 may store keys in

“keyblocks.” For example, referring to Figure 2, each keyblock 200 may include header (KBH) 205, key 210, and MAC 215, which may be based on a keyblock protection key (KBPK).

[0040] The KBPK may derive two keys to protect keyblock 200: an encryption key and a MAC. The KBPKs may be arranged in a hierarchy, with a root KBPK having one or more class KBPKs, and each class KBPK having one or more Keyblock KBPKs. An example hierarchy is illustrated in Figure 3.

[0041] In one embodiment, from the root KBPK, all other KBPKs may be determined from the encrypted KBPKs. The root KBPK may be used to recover the class KBPKs, which may be used to recover the KeyBlock KBPKs.

[0042] An exemplary KBPK hierarchy is provided in Figure 3.

[0043] Referring again to Figure 1, in one embodiment, untmsted key manger 120 may interface with key loader 130. Keyloader 130 may interface with trusted key manager 140.

[0044] Persistent storage 150 may store the root KBPK. Additional

KBPKs in the hierarchy may be stored in persistent storage 160 as is necessary and/or desired.

[0045] The trusted domain may include one or more engines 150. Each engine 150 may include hardware and software to implement a cryptographic algorithm, such as DES, AES, etc. Keys are an input to engine 150, and the output may be an encryption or decryption of the transaction.

[0046] Referring to Figure 4, a key hierarchy is disclosed according to one embodiment. Key hierarchy 400 may include root key 410 which may have a plurality of class keys class 1 key 420 ₁ , class 2 key 420 ₂ , class 3 key 4203, ... class n key 420 _n . Each class key 420 may have one or more keys 430i, 430 ₂ , 430 , 430 ₄ , 430S, 430 ₆ , ... 430 _n .

[0047] In one embodiment, the hierarchy of keys may be based on the class or type of key, and may be optimized based on key usage. For example, there may be a limited number of keys under each key.

[0048] Although three levels of keys are illustrated, it should be recognized that a larger number of levels, or a smaller number of levels, may be used as is necessary and/or desired. Similarly, the number of classes of keys may be greater or fewer as is necessary and/or desired.

[0049] In Figure 4, three classes of keys are illustrated. The end keys - the key at the end or bottom of the tree such as keys 330 - are used to protect data. The other keys - keys 310 and 320 - are used to protect keys 330.

[0050] The hierarchy disclosed in Figure 4 may support a plurality of operations, such as encryption and decryption of data given a RootKey; MAC generation and/or verification of each parent key given a RootKey; MAC generation/verification of all data given a RootKey, etc.

[0051] A similar key hierarchy can exist for Integrity /Authenticity, such as for MACing.

[0052] Referring to Figure 5, a method depicting a process of startup and key writing is provided according to one embodiment. In the startup process, in step 505, a unique root key may be selected as a root KBPK. In one embodiment, the unique root key may be pre-programmed such a on a system on a chip. Other sources of the unique root key may be used as is necessary and/or desired. [0053] In one embodiment, the root KBPK may be saved to persistent storage in a trusted domain.

[0054] In step 510, for each class of key, a keyblock with a Class KBPK may be created and stored in an untmsted keystore. In one embodiment, the trusted key manager may create a keyblock for each class using the Root KBPK. It may then store the keyblocks for each class in the untmsted keystore.

[0055] The process may be repeated for each class of key.

[0056] Next, the keys are written. In the writing process, in step 515, the keyblocks may be loaded to the tmsted key manager in the trusted domain by the untmsted key loader. In one embodiment, the keyblock may be decrypted and verified. For example, all keyblocks under the MAC class key may be decrypted and verified.

[0057] In step 520, class keyblocks may be loaded to the tmsted key manager from the untmsted keystore. In one embodiment, the tmsted key manager may use the root KBPK to authorize and decrypt the class keyblocks with the root KBPK to get the class KBPK for the class and the keyblockheader.

[0058] In step 525, keyblocks may be written to the untmsted keystore.

For example, the tmsted key manager may create a keyblock with a key, keyblockheader payload, and keyblock KBPK as the KBPK. The keyblock may then be written to the untmsted key store.

[0059] The process may be repeated for each keyblock.

[0060] In step 530, class Keyblocks MACs may be written to the untmsted keystore. In one embodiment, a MAC may be created for all keyblocks in a given keyblock class, and may be written to the untmsted keystore. [0061] For example, all the keyblocks under the MAC class key (not just an individual key) may be verified. Thus, there is verification that no keys have been removed or added.

[0062] A result of the generation of the MACs is a MAC hierarchy tree.

[0063] Referring to Figure 6, a method depicting a process of key reading and key exercise is provided according to one embodiment.

[0064] In the key reading process, in step 605, an application may request to exercise a key. For example, an application may need to perform an operation that exercises a key, such as PIN encryption, message authentication, etc. In one embodiment, the application may call an API that issues a request to the trusted key manager to exercise the key.

[0065] In step 610, a keyblock may be read from the untrusted keystore by trusted key manager. In order to retrieve the key for a given keyblock, all keyblocks below the corresponding keyblock must be decrypted and verified. Thus, to verify the keystore, all keyblocks under the MAC class key must be decrypted and verified.

[0066] In step 615, the untrusted keystore may load a class KBPK MACs to the trusted key manager. The class KBPK MAC is verified from multiple keys to ensure none are missing. This is different from the MAC of an individual key.

[0067] In step 620, the untrusted class KeyBlocks MAC read may be trusted.

[0068] In step 625, the key may be extracted from the keyblock by the trusted key manager. [0069] In the key exercise process, in step 630, the trusted key manager may load the key to the engine. For example, the trusted key manager may perform various checks to ensure that the application is authorized to exercise the key.

[0070] The trusted key manager may load the key to the engine (the block using the key, with an input such as PIN data, to provide a cryptographic output) for that application.

[0071] In step 635, the key may be exercised in the engine. For example, the application may call an API that causes input data to be provided to the engine, and the cryptographic operation to be performed with the engine. The application will receive the output, e.g., the encrypted PIN.

[0072] It will be appreciated by persons skilled in the art that the present invention is not limited by what has been particularly shown and described hereinabove. Rather the scope of the present invention includes both combinations and sub-combinations of features described hereinabove and variations and modifications thereof which are not in the prior art. It should further be recognized that these embodiments are not exclusive to each other.

[0073] It will be readily understood by those persons skilled in the art that the embodiments disclosed here are susceptible to broad utility and application. Many embodiments and adaptations of the present invention other than those herein described, as well as many variations, modifications and equivalent arrangements, will be apparent from or reasonably suggested by the present invention and foregoing description thereof, without departing from the substance or scope of the invention.

[0074] Accordingly, while the present invention has been described here in detail in relation to its exemplary embodiments, it is to be understood that this disclosure is only illustrative and exemplary of the present invention and is made to provide an enabling disclosure of the invention. Accordingly, the foregoing disclosure is not intended to be construed or to limit the present invention or otherwise to exclude any other such embodiments, adaptations, variations, modifications or equivalent arrangements.