# US 10,313,117 B1 · Cryptographic key management to prevent data exfiltration

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,313,117 B1
- Document ID: US10313117B1
- Status: Granted
- Kind: B1
- Application number: 15/199,808
- Filed: 2016-06-30
- Granted: 2019-06-04
- Earliest claimed: 2016-06-30
- Assignees: Amazon Technologies, Inc.
- Applicants: Amazon Technologies, Inc.
- Inventors: Alexis Lynn Carlough; William Frederick Hingle Kruse
- Web page: https://patentgrep.com/patent/US10313117B1

## CPC

- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/302: {involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes}
- H04L 9/3271: {using challenge-response}
- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 2209/24: Key scheduling, i.e. generating round keys or sub-keys for block encryption
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A cryptographic key management service receives a request, associated with a principal, to use a cryptographic key to perform a cryptographic operation. In response to the request, the service determines whether a rate limit specific to the principal is associated with the cryptographic key. If the rate limit is associated with the cryptographic key, the service generates a response to the request that conforms to the rate limit. The service provides the response in response to the request.

## Claims

### Claim 1

A computer-implemented method, comprising:
receiving, from a client device associated with a principal of a customer of a computing resource service provider, a request to utilize a cryptographic key to perform a decryption operation, the request specifying a grant, the grant specifying a permission delegated to the principal to utilize the cryptographic key to perform a set of cryptographic operations specified by the grant, the set of cryptographic operations including decryption;
determining that the grant authorizes the request to be fulfilled;
determining that the grant specifies a rate limit associated with the cryptographic key;
as a result of the grant specifying the rate limit, generating a response to the request that conforms to the rate limit specified by the grant to obtain a generated response;
performing the decryption operation to obtain data;
encrypting the data to obtain encrypted data; and
providing the generated response in response to the request, wherein the generated response includes the encrypted data and information to enable the client device to decrypt the encrypted data.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, further comprising:
determining, based at least in part on the rate limit, a number of hashing iterations to be performed to generate a second cryptographic key;
using a hash-based key derivation function to generate the second cryptographic key, the hash-based key derivation function used to perform the number of hashing iterations;
wherein the data is encrypted using the second cryptographic key to obtain the encrypted data; and
wherein the information to enable the client device to decrypt the encrypted data includes inputs to the hash-based key derivation function.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, further comprising:
using an RSA algorithm to generate a public cryptographic key for encryption of the data, the public cryptographic key sized based at least in part on the rate limit;
wherein the data is encrypted using the public cryptographic key to obtain the encrypted data; and
wherein the information to enable the client device to decrypt the encrypted data includes the public cryptographic key to enable the client device to calculate a private cryptographic key.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, further comprising:
providing a challenge to which the client device is required to provide a valid challenge response in order to enable performance of the decryption of the encrypted data;
receiving, from the client device, a challenge response to the challenge;
determining whether the challenge response provided by the client device is valid; and
as result of a determination that the challenge response provided by the client device is valid, performing the decryption operation.

### Claim 5

A system, comprising:
one or more processors; and
memory including instructions that, as a result of being executed by the one or more processors, cause the system to at least:
receive a request to use a cryptographic key to perform a cryptographic operation, the request associated with a principal of a customer of a computing resource service provider;
determine, based at least in part on the request, whether a rate limit specific to the principal is associated with the cryptographic key;
if the rate limit is associated with the cryptographic key, generate a response to the request that conforms to the rate limit to obtain a generated response;
use the cryptographic key to perform a decryption operation, resulting in output data;
encrypt the output data to obtain encrypted data; and
in response to the request, provide, through the generated response, the encrypted data and information to enable decryption of the encrypted data.

### Claim 6 (depends on 5)

The system of claim 5, wherein the instructions further cause the system to evaluate a grant specifying a permission delegated to the principal to utilize the cryptographic key to perform a set of cryptographic operations specified by the grant to determine whether the rate limit specific to the principal is associated with the cryptographic key.

### Claim 7 (depends on 5)

The system of claim 5, wherein the instructions further cause the system to:
generate a challenge;
provide the challenge;
receive, from a client, a second request to use the cryptographic key to perform a second cryptographic operation, the second request including a challenge response to the challenge;
determine whether the challenge response indicates successful completion of the challenge; and
if the challenge response indicates successful completion of the challenge, use the cryptographic key to perform the second cryptographic operation.

### Claim 8 (depends on 5)

The system of claim 5, wherein the instructions further cause the system to:
identify information specified in the request;
determine whether the information specified in the request matches additional authenticated data that is cryptographically bound to encrypted data specified in the request; and
if the information specified in the request matches the additional authenticated data, apply the rate limit specific to the principal such that the rate limit is associated with the cryptographic key.

### Claim 9 (depends on 5)

The system of claim 5, wherein the instructions further cause the system to:
generate a second cryptographic key;
wherein the second cryptographic key is used to encrypt the output data to obtain the encrypted data; and
provide the encrypted data to enable a client to derive the second cryptographic key to decrypt the encrypted data.

### Claim 10 (depends on 5)

The system of claim 5, wherein the instructions further cause the system to:
use a public cryptographic key cryptosystem to generate a public cryptographic key;
wherein the encrypted data is obtained from encrypting the output data with the public cryptographic key; and
wherein the information to enable decryption of the encrypted data includes the public cryptographic key to enable a client receiving the generated response to use the encrypted data and the public cryptographic key to generate a private cryptographic key to decrypt the encrypted data.

### Claim 11 (depends on 5)

The system of claim 5, wherein:
the instructions further cause the system to:
generate a challenge;
provide the challenge to a client;
receive, from the client, a challenge response to the challenge;
determine that the challenge response is valid; and
wherein the cryptographic key is used to perform the cryptographic operation subsequent to the determination that the challenge response is valid.

### Claim 12 (depends on 5)

The system of claim 5, wherein the instructions further cause the system to:
determine, if the rate limit specific to the principal is associated with the cryptographic key, if a token required to perform the cryptographic operation is available from a token container;
if the token required to perform the cryptographic operation is available from the token container, deduct the token from a number of tokens in the token container;
perform the cryptographic operation; and
wherein the cryptographic operation is the decryption operation resulting in the output data.

### Claim 13

A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
determine, in response to a request, by a principal of a customer of a computing resource service provider, to use a cryptographic key to perform a cryptographic operation, whether a usage rate limitation is associated with the cryptographic key;
if the usage rate limitation is associated with the cryptographic key, generate a response to the request that enforces the usage rate limitation by at least causing operations to be performed that would not be performed if the usage rate limitation was not associated with the cryptographic key;
perform the cryptographic operation to obtain output data;
encrypt the output data, generating encrypted data; and
provide, through the generated response, the encrypted data and information to enable decryption of the encrypted data.

### Claim 14 (depends on 13)

The non-transitory computer-readable storage medium of claim 13, wherein the instructions further cause the computer system to:
select a set of prime numbers, the set of prime numbers sized based at least in part on a usage rate specified in the usage rate limitation;
use the set of prime numbers to calculate a cryptographic key pair; and
wherein:
the encrypted data is generated using a public cryptographic key of the cryptographic key pair; and
the information to enable decryption of the encrypted data includes the public cryptographic key to enable a user client that receives the generated response to solve a factoring problem to obtain a private cryptographic key.

### Claim 15 (depends on 13)

The non-transitory computer-readable storage medium of claim 13, wherein the instructions further cause the computer system to:
further provide, through the generated response, a challenge;
receive a second request to use the cryptographic key to perform a second cryptographic operation, the second request specifying a response to the challenge;
determine, based at least in part on the response to the challenge, whether the challenge has been solved successfully; and
if the challenge has been solved successfully, perform the second cryptographic operation to fulfill the second request.

### Claim 16 (depends on 13)

The non-transitory computer-readable storage medium of claim 13, wherein the instructions further cause the computer system to:
access, if the usage rate limitation is associated with the cryptographic key, a token container to determine whether a token required to perform the cryptographic operation is available; and
if the token required to perform the cryptographic operation is available, deduct the token from the token container.

### Claim 17 (depends on 13)

The non-transitory computer-readable storage medium of claim 13, wherein the instructions further cause the computer system to:
select a random numerical value;
determine, based at least in part on the usage rate limitation, hashing iterations to be performed using the random numerical value as input to a hash function;
use the hash function to perform the hashing iterations to obtain a second cryptographic key; and
wherein:
the second cryptographic key is used to encrypt the output data, generating the encrypted data; and
the information to enable decryption of the encrypted data includes the random numerical value and the hashing iterations to be performed.

### Claim 18 (depends on 13)

The non-transitory computer-readable storage medium of claim 13, wherein the instructions further cause the computer system to:
obtain, in response to the request, a grant specifying a permission delegated to a principal to utilize the cryptographic key to perform a set of cryptographic operations specified by the grant; and
evaluate the grant to determine whether the usage rate limitation is associated with the cryptographic key.

### Claim 19 (depends on 13)

The non-transitory computer-readable storage medium of claim 13, wherein the instructions further cause the computer system to:
further provide a challenge;
receive a response to the challenge; and
determine, based at least in part on the response to the challenge, whether the challenge has been solved successfully.

### Claim 20 (depends on 13)

The non-transitory computer-readable storage medium of claim 13, wherein the instructions further cause the computer system to:
identify information specified in the request;
determine whether the information specified in the request matches additional authenticated data that is cryptographically bound to encrypted data specified in the request; and
if the information specified in the request matches the additional authenticated data, apply the usage rate limitation to generate the response to the request that enforces the usage rate limitation.