PERSONAL PRIVATE KEY ENCRYPTION DEVICE

Methods and systems for managing the security of private keys in a distributed system are disclosed. The distributed system may include insecure data processing systems that utilize signatures generated using private keys. The private keys may be subject to undesired dissemination if obtained by the insecure data processing systems. To improve the security of the private keys, a security device may be utilized. The security device may facilitate review and signing of data structures to obtain signatures without disclosure of private keys to insecure data processing systems.

FIELD OF THE DISCLOSED EMBODIMENTS

Embodiments disclosed herein relate generally to key management. More particularly, embodiments disclosed herein relate to systems and methods for key management in distributed systems.

BACKGROUND

Computing devices may store data and used stored data. For example, computing devices may utilize data when providing computer implemented services. Different computing devices may perform similar and/or different functions. To operate as a distributed system, all or a portions of the computing devices may need to be able to verify communications from the other computing devices.

DETAILED DESCRIPTION

Various embodiments and aspects disclosed herein will be described with reference to details discussed below, and the accompanying drawings will illustrate the various embodiments. The following description and drawings are illustrative of the embodiments disclosed herein and are not to be construed as limiting the embodiments disclosed herein. Numerous specific details are described to provide a thorough understanding of various embodiments of embodiments disclosed herein. However, in certain instances, well-known or conventional details are not described in order to provide a concise discussion of embodiments disclosed herein.

Reference in the specification to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in conjunction with the embodiment can be included in at least one embodiment disclosed herein. The appearances of the phrase “in one embodiment” in various places in the specification do not necessarily all refer to the same embodiment.

In general, embodiments disclosed herein relate to methods and systems for managing the security of private keys in a distributed system. The distributed system may include insecure data processing systems that utilize signatures generated using private keys. The private keys may be subject to undesired dissemination if obtained by the insecure data processing systems.

To improve the security of private keys, a security device may be utilized. The security device may be hardened devices that may operably connect to insecure data processing systems. Data structures for signing consideration by a user may be obtained by the security device. The security device may present information regarding the obtained data structures to a user via a display of the security device. The information may allow the user to decide whether signatures for any of the data structures should be generated.

The security device may include one or more interface elements that allow the security device to directly obtain input from the user. The input may indicate whether signing authorization for any of the data structures is granted.

The security device may also include one or more user interface elements for obtaining security information such as passcodes or biometric information required for signing authority to be granted.

When a data structure is authorized for signing, the security device may generate a signature for the data structure using a copy of a private key associated with the user locally stored in the security device. The private key may not be accessible.

When signatures are generated, they may be provided to other devices such as operably connected insecure data processing systems for use and/or distribution.

By doing so, embodiments disclosed herein may facilitate secure generation of signatures with reduced risk of undesired private key dissemination. By doing so, insecure data processing systems may be used in a distributed system with reduced risk of private keys being compromised.

In an embodiment, a computer-implemented method for managing security in a distributed system comprising an insecure data processing system is provided. The method may include obtaining, by a security device and from the insecure data processing system, a data structure for signing; presenting information regarding the data structure to a user of the insecure data processing system via a display of the security device; obtaining user input from the user, the user input being responsive to the presented information, and the user input being obtained with an interface element of the security device; making a determination that the user input indicates signing approval from the user for the data structure; based on the determination: generating a signature using the data structure and a private key associated with the user; and providing the data structure to the insecure data processing system. An insecure data processing system may be a computing device having software and/or hardware components whose security status has not be identified.

Obtaining the data structure may include emulating a storage device; presenting the emulated storage device to the insecure data processing system; and receiving the data structure via a storage command from the insecure data processing system, the storage command being directed to the emulated mass storage device.

Providing the data structure to the insecure data processing system may include presenting the signature to the insecure data processing system as a data structure stored on the emulated mass storage device; receiving a read command for the signature from the insecure data processing system and directed toward the emulated mass storage device; generating a read response based on the signature; and sending the read response to the insecure data processing system.

Presenting the signature to the insecure data processing system may include participating in a flush of the emulated mass storage device by the insecure data processing system.

The computer-implemented method may also include enrolling the security device with the insecure data processing system prior to obtaining the data structure.

The private key may be inaccessible to the insecure data processing system from the security device.

Presenting information regarding the data structure to the user of the insecure data processing system via the display of the security device may include generating a reduced size representation of the data structure; and displaying a portion of the reduced size representation of the data structure on the display of the security device.

The reduced size representation may include a hash of the data structure.

Presenting information regarding the data structure to the user of the insecure data processing system via the display of the security device further may include coordinating with a second insecure data processing system operably connected to the insecure data processing system to generate a copy of the reduced size representation of the data structure to facilitate comparison of the reduced size representation and the copy of the reduced size representation by the user.

Coordinating with the second insecure data processing system may include identifying a portion of the data structure corresponding to a hash type identifier; and generating the hash based on the hash type identifier. For example, a hash type identifier (e.g., how a hash is to be generated, the hash size, etc.) may be included in the data structure.

A non-transitory media may include instructions that when executed by a processor cause the computer-implemented method to be performed.

A data processing system may include the non-transitory media and a processor, and may perform the computer-implemented method when the computer instructions are executed by the processor.

Turning toFIG.1, a block diagram illustrating a system in accordance with an embodiment is shown. The system shown inFIG.1may facilitate performance of workloads (e.g., computer-implemented workloads performed by executing computing instructions with at least one processor of one or more data processing systems). The system may include, but is not limited to data processing system100.

Data processing system100may provide the computer implemented services (in isolation or cooperation with other data processing system not illustrated inFIG.1). For example, data processing system100may independently and/or cooperatively (e.g., with other devices) provide any number and type of computer implemented services.

For example, data processing systems100may provide computer implemented services to users and/or other computing devices operably connected to data processing system100. The computer implemented services may include any type and quantity of services including, for example, database services, instant messaging services, video conferencing services, etc. Different systems may provide similar and/or different computer implemented services.

Due to the distributed nature of the system illustrated inFIG.1, the components ofFIG.1may implement processes for (i) command and control (e.g., determining whether to follow a request, action, instruction, etc.), (ii) verify whether communications are authentic, and/or (iii) perform other types of processes to manage coordination within the environment. To do so, the components ofFIG.1may utilize key (e.g., public/private) to sign various data structures. Signing a data structure using a key may allow other entities to verify the identity of the entity that caused the data structure to be signed (e.g., signed with a private key and verifiable using a public key). Consequently, various entities in a distributed system may be able to communicate information to one another in a verifiable manner. The communicated information may be used, for example, for command and control purposes or for other reasons.

To facilitate command and control, the system ofFIG.1may include control plane110. Control plane110may manage the operation of various devices, such as data processing system100and/or other devices not illustrated inFIG.1. For example, control plane110may limit or authorize actions of data processing system100. Control plane110may do so on the basis of permissions or other access/operational controls tied to users (e.g., people). For example, for a given user, control plane110may enable and/or prevent various actions of data processing system100to be performed. Thus, control plane110may identify which user is attempting to initiate a particular action and enable/prevent the action from being initiated on the basis of the identity of the user.

To identify which user is attempting to initiate a particular action (or, more broadly speaking, whether a user has attested to a data structure), a signature may be utilized. The signature may include information usable to ascertain whether the information in the signature was generated using a private key associated with the user. For example, a public key associated with the identity of a user may be used to ascertain whether the signature was generated using a private key associated with the user. If the signature is verified as being generated using the private key of the user, then the system ofFIG.1may treat the information included in the signature as being verified as being from the user (e.g., a signature may include an ingest data structure and an encrypted version of the data structure encrypted using the user's private key, the user's public key may be used to decrypt the encrypted version to obtain a second copy of the ingest data structure, and a match between the data structure and the obtained copy of the data structure may indicate that the user associated with the public/private keys authorized signing of the data structure to indicate that user agrees with the information in the ingest data structure).

However, the command and control approach via signature implemented by data processing system100and control plane110may be predicated on secrecy of the private key of a user. If other entities are able to utilize the private key of the user, the signature based approach to command and control may be breached thereby resulting in undesired action being performed through use of signatures by the other entities. For example, the other entities may generate and use signatures to indicate that the user associated with the private key has requested that certain actions be performed (and, more broadly, that certain data structures, which may be used for other purposes, are from the user) while the user has made no such requests.

For example, consider a scenario where a user is using data processing system100. Data processing system100may be implemented with a large number of hardware and/or software components. Any of these components may be compromised by a third party. If the user's private key is communicated to data processing system100, then the user's private key may also be compromised through actions of the compromised hardware and/or software components.

In general, embodiments disclosed herein relate to systems, methods, and devices for managing operation of a distributed system (e.g., like the system shown inFIG.1) through use of signatures. To manage the distributed system, the system ofFIG.1may include security device102.

Security device102may facilitate generation and distribution of signatures while maintaining the privacy of a private key used to generate the signatures. To do so, security device102may (i) obtain copies of data structures for signing consideration by a user, (ii) present information regarding the data structures to the user, (iii) obtain input regarding the data structures directly from the user, (iv) sign or reject the data structures using the user's private key depending on the corresponding input obtained directly from the user, and (v) distribute the signed data structures. While performing these functions, security device102may maintain secrecy of the user's private key. For example, security device102may not expose the user's private key to data processing system100, or other entities.

To obtain data structures for signing consideration and distribute signed data structures, security device102may operably connect to data processing system100. When operably connected to data processing system100, security device102may implement processes for limiting communications to only those required for obtaining the data structures and providing signed data structures. For example, security device102may present itself as a mass storage device (e.g., through emulation) or other type of device with a limited number of functions available to data processing system100. These functions may include, for example, storing data structures in the mass storage device and reading data structures from the mass storage device. Security device102may be hardened to ignore communications from data processing system100directed to other types of functions.

By doing so, security device102may generate signatures on behalf of a user in a manner that does not expose the user's private key to potentially compromised hardware and/or software components. Refer toFIGS.2A-2Bfor additional details regarding security device102.

Any of security device102, data processing system100, and security device102may be implemented using a data processing system (e.g., a computing device) such as a host or server, a personal computer (e.g., desktops, laptops, and tablets), a “thin” client, a personal digital assistant (PDA), a Web enabled appliance, a system on a chip, an embedded computing device, a mobile phone (e.g., Smartphone), or any other type of data processing device or system. For additional details regarding data processing systems, refer toFIG.5.

Any of data processing system100and control plane110may be implemented with multiple computing devices. The computing device may form a distributed system operably connected via one or more networks. The computing devices may manage their operation using a command and control scheme which may utilize signatures.

The functionality of control plane110may be performed, in part, as a shared service (e.g., distributed application). For example, the shared service may include agents hosted by various computing devices (not shown).

Security device102, data processing system100, and/or control plane110may perform all, or a portion, of the methods illustrated inFIG.3.

Any of the components illustrated inFIG.1may be operably connected to each other (and/or components not illustrated) with a communication system105. In an embodiment, communication system105includes one or more networks that facilitate communication between any number of components. The networks may include wired networks and/or wireless networks (e.g., and/or the Internet). The networks may operate in accordance with any number and types of communication protocols (e.g., such as the internet protocol).

While illustrated inFIG.1as included a limited number of specific components, a system in accordance with an embodiment may include fewer, additional, and/or different components than those illustrated therein.

As discussed above, the system ofFIG.1may facilitate review and signing of data structures without exposing a user's private key through use of a security device. Turning toFIG.2A, a diagram of security device102in accordance with an embodiment is shown.

Security device102may be implemented using a hardware device. The hardware device may include functionality (i) to communicate with data processing systems to obtain data structures and provide signed data structures, (ii) present information regarding obtained data structures to a user of security device102, the information usable by the user to evaluate whether to authorize signing of any data structure, (iii) obtain user feedback regarding whether a data structures is to be signed, (iv) prevent use of security device102by persons other than the user (e.g., for which a copy of the user's private key is stored in security device102), (v) sign data structures on behalf of the user and based on the user feedback without exposing the user's private key to users of security device102or other devices, and/or (vi) distribute signed data structures.

To provide the above noted functionality, security device102may include one or more of device interface200, display202, interface element210, interface element212, and interface element214. Each of these components of security device102is discussed below.

Device interface200may include a physical device that allows security device102to operably connect to other devices. For example, device interface200may include one or more of (i) a serial interface device (e.g., a plug an chipset), (ii) a universal serial bus interface device (a plug and chipset), (iii) a wireless communication device such as a bluetooth chipset, a wireless local area network chipset, or a near field communications chipset, (iv) optical communication devices such as a camera that may receive information from a display of another device (e.g., which may display text or a graphical code which may be imaged by the camera), and/or (v) other types of communication devices. In any of the above examples, the operable connection established via these devices may be a direct operable connection with another device rather than an indirect operable through a network or other intermediary.

In an embodiment, device interface200presents security device102as a mass storage device to other devices. For example, device interface200may present security device102as a plug and play compatible mass storage device. Consequently, a broad range of data processing systems (e.g., compatible with mass storage devices and/or plug and play devices) may be able to natively connect and communicate with security device102. Accordingly, data processing systems may not need to host any specialized hardware and/or software components for cooperative operation with security device102.

By presenting itself as a mass storage device, an operably connected data processing system may interact with it by storage data (e.g., for signing consideration) in it and reading data (e.g., signatures) from it. In an embodiment, security device102emulates the operation of a universal serial bus thumb drive. Accordingly, a data processing system to which security device102operably connects may tread security device102as a storage device and use its pre-existing functionality for interacting with storage devices to interact with security device102.

Display202may include a physical display such as an alphanumeric display, pixel based display, or other type of display that may be used to present information to a user in the vicinity of security device102. Display202may be used, for example, to display portions of obtained data structures, other data structures (e.g., reduced size data structures such as hashes of all or a portion of data structure) generated based on the obtained data structures, and/or other types of information. A user may use the presented information to decide whether a data structure should be signed.

For example, the user may be concerned that a compromised portion of an operably connected data processing system may modify or otherwise inject data in to a data structure obtained from it by security device102. To verify the integrity of the data structure, the user may review portions of the data structures as interpreted by security device102rather than as interpreted by the data processing system which may be subject to compromise. Reduced size data structure derived from obtained data structures may also or alternatively be presented to the user via security device102. If the user has a trusted source that may also obtain similar reduced size data structures based on the data structure, then the user may make compare the two reduced size data structures to verify that the data structure obtained from the data processing system has not been compromised.

For example, consider a scenario where another data processing system that is trusted by the user sends a data structure to the data processing system to which security device102is operably connected. If the data processing system is compromised, then the data processing system may compromise the data structure through modification prior to providing the data structure to security device102. To determine whether the data structure has been compromised, security device102may obtain a hash based on the data structure and display it to the user via display202. The other data processing system may obtain a similar hash for the data structure and present the hash to the user (e.g., through the data processing system such as via a webpage, through another communication system such as a message sent via a radio access network to a smart phone associated with the user, etc.). The user may then determine if the copy of the data structure in security device102has been compromised based on the comparison (e.g., if the hashes match, then not compromised).

Interface element210may include a physical device such as a user operable button for obtaining feedback from the user. Security device102may include any number of interface element210.

Interface element212may include a physical device for obtaining information usable to verify that the user of security device102is interacting with security device102. Interface element212may include, for example, one or more biometric sensors such as a finger print scanner, a camera, and/or other types of sensors that may be adapted to identify biometric markers of a user of security device102. The biometric markers may be used to determine whether a person using security device102is the user associated with the private key stored in security device102.

Interface element214may include a physical device such as a rotary wheel for obtaining feedback from the user. Security device102may include any number of interface element214.

The user input obtained via interface elements210-214may be used to, for example, guide the display of information on display202, indicate assent or dissent with respect to signing of various data structures, and/or for other purposes. Any quantity and type of user input may be obtained via interface elements210-214. While described with specific types of interface elements, a security device may include other types of interface elements (e.g., touch sensitive displays, full keypads, etc.) without departing from embodiments disclosed herein.

While illustrated inFIG.2Awith a limited number of specific components, a security device may include additional, fewer, and/or different components without departing from embodiments disclosed herein.

Turning toFIG.2B, a block diagram of security device102in accordance with an embodiment is shown. To provide its functionality, security device102may include signing manager220and storage230. Each of these components is discussed below.

Signing manager220may manage the operation of security device102to facilitate review and signing of data structures. To do so, signing manager220may (i) emulate the operation of mass storage devices and/or universal serial bus compatible external devices, (ii) maintain the privacy of a private key associated with a user in storage230and/or use public keys associated with the user in storage230to enroll security device102, (iii) manage the storage of received data structures234from other devices through the emulated behavior of a mass storage device, (iv) manage the operation of the display of security device102, and/or (v) manager the generation and/or distribution of signatures236based on instructions obtained via interface elements of security device102.

When providing its functionality, signing manager220may perform all or a portion of the methods illustrated inFIG.3.

In an embodiment, signing manager220is implemented using a hardware device including circuitry. The hardware device may be, for example, a digital signal processor, a field programmable gate array, or an application specific integrated circuit. The circuitry may be adapted to cause the hardware device to perform the functionality of signing manager220. Signing manager220may be implemented using other types of hardware devices without departing embodiment disclosed herein.

In one embodiment, signing manager220is implemented using a processor adapted to execute computing code stored on a persistent storage that when executed by the processor performs the functionality of signing manager220discussed throughout this application. The processor may be a hardware processor including circuitry such as, for example, a central processing unit, a processing core, or a microcontroller. The processor may be other types of hardware devices for processing information without departing embodiment disclosed herein.

In an embodiment, storage230is implemented using physical devices that provide data storage services (e.g., storing data and providing copies of previously stored data). The devices that provide data storage services may include hardware devices and/or logical devices. For example, storage230may include any quantity and/or combination of memory devices (i.e., volatile storage), long term storage devices (i.e., persistent storage), other types of hardware devices that may provide short term and/or long term data storage services, and/or logical storage devices (e.g., virtual persistent storage/virtual volatile storage).

Storage230may also be implemented using logical storage. A logical storage (e.g., virtual disk) may be implemented using one or more physical storage devices whose storage resources (all, or a portion) are allocated for use using a software layer. Thus, a logical storage may include both physical storage devices and an entity executing on a processor or other hardware device that allocates the storage resources of the physical storage devices.

Storage230may store data structures including keys232, received data structures234, and/or signatures236. As discussed above, keys232may include private and/or public keys associated with a user. Received data structures234may include any number of data structures obtained from other entities. Signatures236may include any number of signatures generated using keys232(e.g., a private key) and obtained data structures.

Keys232, received data structures234, and signatures236may be implemented using any type of data structure such as, for example, tables, lists, unstructured data, linked lists, databases, etc.

While various data structures have been illustrated and described inFIG.2Bwith specific structures/locations/content, any of the data structures may be stored in different locations, spanned across any number of devices, may be combined with other information, and/or divided into any number of data structures without departing from embodiments disclosed herein.

While security device102has been shown inFIGS.2A-2Bas included specific types and numbers of components, a security device in accordance with an embodiment may include different, fewer, and/or additional components.

In an embodiment, the number and type of components of security device102is reduced to only those necessary for security device102to provide its functionality, discussed above. Further, the hardware and/or software components of security device102may be verified as not being compromised. Additionally, security device102may generally be hardened such that security device102is incapable of performing other functions than those discussed herein and/or modification of its operation (e.g., absent physical attack through modification of its hardware components). By doing so, the security of security device102may be improved when compared to general purpose or configurable devices.

As discussed above, the components ofFIG.1may perform various methods to manage generation and distribution of signatures.FIG.3illustrates examples of methods that may be performed by the components ofFIG.1when providing their functionalities. In the diagrams discussed below and shown inFIG.3, any of the operations may be repeated, performed in different orders, and/or performed in a parallel with other operations and/or a partially overlapping in time manner with other operations.

Turning toFIG.3, a flow diagram illustrating a method of managing signature generation and distribution in accordance with an embodiment is shown. The method may be performed by a security device.

Prior to, during, and/or after the method illustrated inFIG.3, a data processing system may obtain data structures for signing by a user. The data processing system may be insecure by virtue of its configurability and/or components for which their security status has not been resolved. To manage the signing process, a user may utilize a security device, as discussed above.

At operation300, the security device is connected to a data processing system. The security device may be connected by forming an operable connection to the data processing system using an interface device. The operable connection may allow data structure to be transferred between the security device and the data processing system.

At operation302, the security device is enrolled with the data processing system. The security device may be enrolled by providing the data processing system with a public key of a user for which the security devices maintains secrecy of a private key.

In an embodiment, the public key is wrapped in a cryptographically signed certificate. The certificate may be used to identify a manufacturer of the security device and/or provide a publicly verifiable way to attest to the authenticity of the security device against a well-known public key. Consequently, attestations by the manufacturer may be used to identify the security and key handling practices implemented by the security device.

At operation304, a data structure is obtained from the data processing system. The data structure may be obtained via the operable connection.

At operation306, information regarding the data structure is presented to a user of the security device for review. The information may be presented by displaying the information on a display of the security device. The interface elements of the security device may allow for the information to be scrolled through. The information may include, for example, portions of the data structure and/or reduced size representations of the data structure. Other types of information may be presented to the user via the display without departing from embodiments.

The information presented to the user may allow the user to investigate the data structure and make a decision with respect to whether to sign the data structure.

At operation308, input from the user is obtained by the security device. The user input may be responsive to the presented information. For example, the input may indicate whether a data structure associated with information presented in operation306is to be signed.

In an embodiment, the information includes a passcode or other security data. The passcode may be required to be entered for the security device to sign the data structure.

In an embodiment, the information includes biometric information. The biometric may be compared to known biometric information (e.g., stored in the security device) for the user. The biometric information may need to match the known biometric information for the security device to sign the data structure.

Any type and quantity of information may be obtained via the user input.

At operation310, a determination is made regarding whether the user input indicates signing approval for the data structure. The determination may be made based on the information obtained via the user input. For example, input of the security data and/or providing of the biometric data may indicate that signing approval for the data structure has been granted.

When signing approval for the data structure is granted, the method may proceed to operation312. When signing approval for the data structure is not granted, the method may proceed to operation316.

At operation312, a signature is generated using the data structure and a private key. For example, the data structure and the private key of a key-pair may be ingested by a function that generates the signature. The data structure may be recovered from the signature using the public key of a key-pair. The signature may be cryptographically secure against recovery of the private key through analysis.

At operation314, the signature is provided to the data processing system. The signature may be provided to the data processing system via the operable connection.

In an embodiment, the signature is provided to the data processing system by participating in a flush with the data processing system. For example, the data processing system may eject and then reconnect to the security device which may trigger an update in visibility of data structures stored on the emulated mass storage device and readable by the data processing system. The signature may be provided by, after the flush, a user of the data processing selecting the signature for copying to the data processing system. The copying may result in the signature being distributed to the data processing system.

The signature provided to the data processing system may be distributed by the data processing system to other devices (e.g., control planes and/or other systems).

The method may end following operation314.

Returning to operation310, the method may proceed to operation316following operation310when it is determined that signing approval for the data structure is not indicated by the user input.

At operation316, a signature is not generated for the data structure. The signature may not be generated by, for example, discarding the data structure.

The method may end following operation316.

Using the method illustrated inFIG.3, signatures for data structures stored on insecure data processing systems may be obtained while reducing risk of dissemination of private keys used to obtain the signatures.

To further clarify embodiments disclosed herein, now consider an example scenario as illustrated inFIGS.4A-4Ein which a data processing system100obtains a data structure which may need to be signed for security purposes. However, data processing system100may be insecure. Prior to obtaining the data structure, security device102may operably connect to data processing system100and/or enroll with it.

Turning toFIGS.4A-4E, diagrams illustrating actions that may be performed by components of a system similar to that ofFIG.1in accordance with an embodiment is shown. InFIGS.4A-4E, actions performed by various components are highlighted with numbered circles and interactions between components (e.g., data transmissions) are shown using lines terminating in arrows.

Turning toFIG.4A, to facilitate signing of the data structure, data processing system100may, at block1, store a copy of the data structure in security device102. For example, from the perspective of data processing system100, security device102may be a mass storage device.

Turning toFIG.4B, security device102may display verification information400on display202. The user may review verification information400. The verification information may include any type of information usable by the user to make an informed decision with respect to whether to sign the data structure. The user may use any of interface elements210-214to manage the process of revising verification information400. For example, interface element214may be used to provide user feedback to security device102that causes various portions of the data structure to be displayed as verification information400.

Turning toFIG.4C, after reviewing verification information400, the user may use a finger420to actuate various interface elements210-214. Security device102may monitor the actuation of interface elements210-214to obtain user input. The user input may include an indication of whether signing of the data structure is authorized, or not authorized. The user input may also include security information such as a passcode required for signing authorization to be granted. The interface elements may be actuated in any order and in any manner. For example, inFIG.4C, the oversized arrows indicate that various actuations of interface elements214and interface elements (e.g.,210) may be made to provide input to security device102. The user input (e.g.,402) may be displayed, entirely, in part, and/or in an obfuscated manner so as to reduce the likelihood of the input being obtained by others in proximity to security device102.

Turning toFIG.4D, the user may use interface element212to provide biometric information to security device102. For example, if interface element212is implemented with a fingerprint scanner, then the user may place finger420proximate to interface element212to provide the biometric information. While doing so, display202may provide information such as input404and process indicator406regarding the process of acquiring the biometric information. Process indicator406may be shown on display202and which may indicate whether the biometric information has been obtained by security device102. Input404may indicate information regarding the collected biometric information (e.g., whether it matches that expected for the user). The biometric information may be required for signing authorization for the data structure to be granted.

In this example scenario, using the input from the user, security device102may deduce that the user wishes for a signature for the data structure to be generated and distributed. Consequently, the signature may be generated using the data structure and a private key stored in security device102.

Turning toFIG.4E, to distribute the signature, the signature may be provided to data processing system100. When received, at operation2, data processing system100may utilize the signature and/or forward the signature to other entities such as control planes that may use the signature for control purposes. For example, the control plane may use a copy of the user's public key to determine that the user signed the data structure, and may take action as specified in the data structure to the extent that the user has rights to implement actions indicated by the data structure.

Thus, as illustrated in these figures, embodiments disclosed herein may provide a system for managing signature generation and distribution that reduces the risk of unintended dissemination of private keys. By doing so, the security of a distributed system may be improved, and the burden on data processing system of the distributed system may be reduced by allowing for insecure data processing systems to be used for signature distribution.

Any of the components illustrated inFIGS.1-4Emay be implemented with one or more computing devices. Turning toFIG.5, a block diagram illustrating an example of a data processing system (e.g., a computing device) in accordance with an embodiment is shown. For example, system500may represent any of data processing systems described above performing any of the processes or methods described above. System500can include many different components. These components can be implemented as integrated circuits (ICs), portions thereof, discrete electronic devices, or other modules adapted to a circuit board such as a motherboard or add-in card of the computer system, or as components otherwise incorporated within a chassis of the computer system. Note also that system500is intended to show a high level view of many components of the computer system. However, it is to be understood that additional components may be present in certain implementations and furthermore, different arrangement of the components shown may occur in other implementations. System500may represent a desktop, a laptop, a tablet, a server, a mobile phone, a media player, a personal digital assistant (PDA), a personal communicator, a gaming device, a network router or hub, a wireless access point (AP) or repeater, a set-top box, or a combination thereof. Further, while only a single machine or system is illustrated, the term “machine” or “system” shall also be taken to include any collection of machines or systems that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein.

In one embodiment, system500includes processor501, memory503, and devices505-508via a bus or an interconnect510. Processor501may represent a single processor or multiple processors with a single processor core or multiple processor cores included therein. Processor501may represent one or more general-purpose processors such as a microprocessor, a central processing unit (CPU), or the like. More particularly, processor501may be a complex instruction set computing (CISC) microprocessor, reduced instruction set computing (RISC) microprocessor, very long instruction word (VLIW) microprocessor, or processor implementing other instruction sets, or processors implementing a combination of instruction sets. Processor501may also be one or more special-purpose processors such as an application specific integrated circuit (ASIC), a cellular or baseband processor, a field programmable gate array (FPGA), a digital signal processor (DSP), a network processor, a graphics processor, a network processor, a communications processor, a cryptographic processor, a co-processor, an embedded processor, or any other type of logic capable of processing instructions.

Processor501, which may be a low power multi-core processor socket such as an ultra-low voltage processor, may act as a main processing unit and central hub for communication with the various components of the system. Such processor can be implemented as a system on chip (SoC). Processor501is configured to execute instructions for performing the operations discussed herein. System500may further include a graphics interface that communicates with optional graphics subsystem504, which may include a display controller, a graphics processor, and/or a display device.

Processor501may communicate with memory503, which in one embodiment can be implemented via multiple memory devices to provide for a given amount of system memory. Memory503may include one or more volatile storage (or memory) devices such as random access memory (RAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), static RAM (SRAM), or other types of storage devices. Memory503may store information including sequences of instructions that are executed by processor501, or any other device. For example, executable code and/or data of a variety of operating systems, device drivers, firmware (e.g., input output basic system or BIOS), and/or applications can be loaded in memory503and executed by processor501. An operating system can be any kind of operating systems, such as, for example, Windows® operating system from Microsoft Mac OS®/iOS® from Apple, Android® from Google®, Linux®, Unix®, or other real-time or embedded operating systems such as VxWorks.

System500may further include 10 devices such as devices (e.g.,505,506,507,508) including network interface device(s)505, optional input device(s)506, and other optional10device(s)507. Network interface device(s)505may include a wireless transceiver and/or a network interface card (NIC). The wireless transceiver may be a WiFi transceiver, an infrared transceiver, a Bluetooth transceiver, a WiMax transceiver, a wireless cellular telephony transceiver, a satellite transceiver (e.g., a global positioning system (GPS) transceiver), or other radio frequency (RF) transceivers, or a combination thereof. The NIC may be an Ethernet card.

Storage device508may include computer-readable storage medium509(also known as a machine-readable storage medium or a computer-readable medium) on which is stored one or more sets of instructions or software (e.g., processing module, unit, and/or processing module/unit/logic528) embodying any one or more of the methodologies or functions described herein. Processing module/unit/logic528may represent any of the components described above. Processing module/unit/logic528may also reside, completely or at least partially, within memory503and/or within processor501during execution thereof by system500, memory503and processor501also constituting machine-accessible storage media. Processing module/unit/logic528may further be transmitted or received over a network via network interface device(s)505.

Processing module/unit/logic528, components and other features described herein can be implemented as discrete hardware components or integrated in the functionality of hardware components such as ASICS, FPGAs, DSPs or similar devices. In addition, processing module/unit/logic528can be implemented as firmware or functional circuitry within hardware devices. Further, processing module/unit/logic528can be implemented in any combination hardware devices and software components.