# US 10,313,319 B2 · Efficient use of keystreams

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,313,319 B2
- Document ID: US10313319B2
- Status: Granted
- Kind: B2
- Application number: 15/945,975
- Filed: 2018-04-05
- Published: 2018-08-16
- Granted: 2019-06-04
- Earliest claimed: 2014-12-11
- Assignees: Amazon Technologies, Inc.
- Applicants: Amazon Technologies, Inc.
- Inventors: Matthew John Campagna
- Web page: https://patentgrep.com/patent/US10313319B2

## CPC

- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]}
- H04L 9/0662: {with particular pseudorandom sequence generator}
- H04L 9/0822: {using key encryption key}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04L 63/123: {received data contents, e.g. message integrity}
- H04L 2463/061: applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Performing cryptographic operations such as encryption and decryption may be computationally expensive. In some contexts, initialization vectors and keystreams operable to perform encryption operations are generated and stored in a repository, and later retrieved for use in performing encryption operations. Multiple devices in a distributed system can each generate and store a subset of a larger set of keystreams.

## Claims

### Claim 1

A system comprising memory to store instructions that, as a result of execution by one or more processors, cause the system to:
provide a key to a plurality of devices;
cause the plurality of devices to collectively generate a set of keystreams using the key and a plurality of initialization vectors, a first portion of the plurality of initialization vectors being reserved for use by a first device of the plurality of devices and a second portion of the plurality of initialization vectors being reserved for use by a second device of the plurality of devices;
identify a keystream of the set of keystreams that is unused for performance of cryptographic operations; and
cause the keystream to be used to perform a cryptographic operation.

### Claim 2 (depends on 1)

The system of claim 1, wherein the instructions that, as result of execution, cause the system to cause the keystream to be used to perform the cryptographic operation cause the system to perform the cryptographic operation in response to a request submitted to the system.

### Claim 3 (depends on 1)

The system of claim 1, the set of keystreams is generated using a block cipher mode of operation.

### Claim 4 (depends on 3)

The system of claim 3, wherein block cipher mode of operation is Advanced Encryption Standard Counter with CBC-MAC (AES-CCM).

### Claim 5

A computer-implemented method, comprising:
providing a key to a plurality of devices;
causing the plurality of devices to collectively generate a set of keystreams using the key and a plurality of initialization vectors, a first portion of the plurality of initialization vectors being reserved for use by a first device of the plurality of devices and a second portion of the plurality of initialization vectors being reserved for use by a second device of the plurality of devices;
identifying a keystream of the set of keystreams that is unused for performance of cryptographic operations; and
causing the keystream to be used to perform a cryptographic operation.

### Claim 6 (depends on 5)

The computer-implemented method of claim 5, wherein causing the keystream to be used to perform the cryptographic operation comprises performing the cryptographic operation on a cryptographic key of a set of cryptographic keys that is managed by a key management service.

### Claim 7 (depends on 5)

The computer-implemented method of claim 5, wherein causing the keystream to be used to perform the cryptographic operation comprises encrypting a data object to produce an encrypted data object.

### Claim 8 (depends on 7)

The computer-implemented method of claim 7, further comprising obtaining the data object using a second key, wherein the second key is different from the key.

### Claim 9 (depends on 5)

The computer-implemented method of claim 5, wherein each device of the plurality of devices is a security module.

### Claim 10 (depends on 5)

The computer-implemented method of claim 5, wherein causing the plurality of devices to collectively generate the set of keystreams includes causing each device of the plurality of devices to generate a set of initialization vectors unused by any other device in the plurality of devices for generating keystreams.

### Claim 11 (depends on 10)

The computer-implemented method of claim 10, wherein:
causing the keystream to be used to perform the cryptographic operation results in a set of encrypted data objects; and
the method further comprises causing the set of encrypted data objects to be stored outside of the device.

### Claim 12 (depends on 10)

The computer-implemented method of claim 10, wherein the key is programmatically unexportable from each device of the plurality of devices.

### Claim 13

A non-transitory computer-readable storage medium comprising executable instructions that, if executed by one or more processors of a computer system, cause the computer system to at least:
provide a key to a plurality of devices;
cause the plurality of devices to collectively generate a set of keystreams using the key and a plurality of initialization vectors, a first portion of the plurality of initialization vectors being reserved for use by a first device of the plurality of devices and a second portion of the plurality of initialization vectors being reserved for use by a second device of the plurality of devices; and
cause a keystream of the set of keystreams that is unused for performance of cryptographic operations to be used to perform a cryptographic operation.

### Claim 14 (depends on 13)

The non-transitory computer-readable storage medium of claim 13, wherein the cryptographic operation utilizes a stream cipher.

### Claim 15 (depends on 14)

The non-transitory computer-readable storage medium of claim 14, wherein the stream cipher uses authenticated encryption.

### Claim 16 (depends on 13)

The non-transitory computer-readable storage medium of claim 13, wherein the instructions that cause the plurality of devices to collectively generate the set of keystreams, if executed , cause the computer system to generate the set of keystreams using information specific to the plurality of devices.

### Claim 17 (depends on 16)

The non-transitory computer-readable storage medium of claim 16, wherein the initialization vectors are determinable using the information specific to the plurality of devices.

### Claim 18 (depends on 13)

The non-transitory computer-readable storage medium of claim 13, wherein the instructions to cause the keystream to be used to perform the cryptographic operation include instructions to:
make available, to a device of the plurality of devices a first encrypted data object, wherein the first encrypted data object is encrypted using a second key accessible to the plurality of devices; and
obtain a second encrypted data object, wherein the second encrypted data object is encrypted using the key and the keystream.

### Claim 19 (depends on 18)

The non-transitory computer-readable storage medium of claim 18, wherein the data object is a cryptographic key.

### Claim 20 (depends on 13)

The non-transitory computer-readable storage medium of claim 13, further comprising instructions that, if executed by the one or more processors, cause the computer system to store an indication that the keystream was used for the performance of the cryptographic operation.