[KEYPROV] Invention disclosure: VSD (Virtual Security Domain) for Key Management

[Anders Rundgren <[e-mail]>]

In GP (GlobalPlatform) an SE (Security Element) may have predefined
security domains in the form of cryptographic keys allowing multiple
parties securely sharing the SE.

The invention described here extends this notion by optionally allowing
each issuer during a provisioning session associate provisioned data
with a public key, coined KMK (Key Management Key).   I.e. there are no
predefined security domains; they are created dynamically as needed by
the issuers which is primarily of interest in mobile phones where owner-
ship to a built-in SE would be difficult to determine in advance.

Subsequent (post provisioning) operations must include a fresh signature
using the KMK's private key over a MAC or hash of the target object to be
managed.  This is performed in an E2ES (End to End Secured) procedure
between the issuer and SE.

The very same KMK can also be used to perform secure remote lookups of
keys in a container which improves the robustness of the KM process.

Detailed information is available in:

http://webpki.org/papers/keygen2/sks-api-arch.pdf

This invention is hereby put in the public domain.

Anders