Cryptographic key management to prevent data exfiltration
AssigneeAmazon Technologies, Inc.
InventorsAlexis Lynn Carlough, William Frederick Hingle Kruse
Life of this patent
Estimating the term…
Abstract
A cryptographic key management service receives a request, associated with a principal, to use a cryptographic key to perform a cryptographic operation. In response to the request, the service determines whether a rate limit specific to the principal is associated with the cryptographic key. If the rate limit is associated with the cryptographic key, the service generates a response to the request that conforms to the rate limit. The service provides the response in response to the request.
Claims20
A computer-implemented method, comprising:
- receiving, from a client device associated with a principal of a customer of a computing resource service provider, a request to utilize a cryptographic key to perform a decryption operation, the request specifying a grant, the grant specifying a permission delegated to the principal to utilize the cryptographic key to perform a set of cryptographic operations specified by the grant, the set of cryptographic operations including decryption;
- determining that the grant authorizes the request to be fulfilled;
- determining that the grant specifies a rate limit associated with the cryptographic key;
- as a result of the grant specifying the rate limit, generating a response to the request that conforms to the rate limit specified by the grant to obtain a generated response;
- performing the decryption operation to obtain data;
- encrypting the data to obtain encrypted data;
- and
- providing the generated response in response to the request, wherein the generated response includes the encrypted data and information to enable the client device to decrypt the encrypted data.
A system, comprising:
- one or more processors;
- and
- memory including instructions that, as a result of being executed by the one or more processors, cause the system to at least:
- receive a request to use a cryptographic key to perform a cryptographic operation, the request associated with a principal of a customer of a computing resource service provider;
- determine, based at least in part on the request, whether a rate limit specific to the principal is associated with the cryptographic key;
- if the rate limit is associated with the cryptographic key, generate a response to the request that conforms to the rate limit to obtain a generated response;
- use the cryptographic key to perform a decryption operation, resulting in output data;
- encrypt the output data to obtain encrypted data;
- and
- in response to the request, provide, through the generated response, the encrypted data and information to enable decryption of the encrypted data.
A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
- determine, in response to a request, by a principal of a customer of a computing resource service provider, to use a cryptographic key to perform a cryptographic operation, whether a usage rate limitation is associated with the cryptographic key;
- if the usage rate limitation is associated with the cryptographic key, generate a response to the request that enforces the usage rate limitation by at least causing operations to be performed that would not be performed if the usage rate limitation was not associated with the cryptographic key;
- perform the cryptographic operation to obtain output data;
- encrypt the output data, generating encrypted data;
- and
- provide, through the generated response, the encrypted data and information to enable decryption of the encrypted data.
Dependencies are inferred from the claim text.