Cryptography algorithm hopping
AssigneeAmazon Technologies, Inc.
InventorNima Sharifi Mehr
Life of this patent
Estimating the term…
Abstract
A cryptography algorithm hopping model is used to enable computer systems communicating with one another to vary the cryptographic algorithms used for the communications. The cryptography algorithm hopping model specifies a plurality of cryptography algorithms and information sufficient to determine a sequence of the plurality of cryptography algorithms and to determine when to switch from a cryptography algorithm in the sequence to a next cryptography algorithm in the sequence.
Claims20
A computer-implemented method, comprising:
- obtaining, at a first computing device, a cryptography algorithm hopping model that specifies a plurality of cryptography algorithms and information sufficient to determine a sequence of the plurality of cryptography algorithms and to determine when to switch from a cryptography algorithm in the sequence to a next cryptography algorithm in the sequence;
- establishing a first secure communications channel by performing a handshake process with a second computing device, the first secure communications channel associated with a first cryptography algorithm of the plurality of cryptography algorithms;
- receiving, from a third computing device during the handshake process, a cipher suite to use from a set of cipher suites received from the second computing device, the cipher suite containing a second cryptography algorithm;
- communicating with the second computing device over the first secure communications channel by transmitting messages that are encrypted using the first cryptography algorithm;
- using the cryptography algorithm hopping model to determine when to switch to the second cryptography algorithm, the second cryptography algorithm being a next in the sequence relative to the first cryptography algorithm;
- and
- communicating with the second computing device over a second secure communications channel by transmitting messages that are encrypted using the second cryptography algorithm.
A system, comprising:
- a first computing device including memory and a processor, wherein the processor is configured to implement one or more services, wherein the one or more services:
- perform a handshake process with a second computing device to establish a secure communications channel;
- receive, from a third computing device during the handshake process, a cipher suite to use from a set of cipher suites received from the second computing device;
- determine information sufficient to determine when to switch from a cryptography algorithm in a sequence of a plurality of cryptography algorithms to a next cryptography algorithm in the sequence of the plurality of cryptography algorithms, the cipher suite containing the next cryptography algorithm;
- and
- as part of communicating with the second computing device using encrypted messages, switch from a first cryptography algorithm to a second cryptography algorithm in accordance with the information.
A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of one or more processors of a first computing device executing, cause the first computing device to:
- perform a handshake process with a second computing device to establish a secure communications channel;
- encrypt a first message to the second computing device using a first cryptography algorithm;
- receive, from a third computing device during the handshake process, a cipher suite to use from a set of cipher suites received from the second computing device the cipher suite containing a second cryptography algorithm;
- after transmitting the first message to the second computing device, use a cryptography algorithm hopping model to determine to switch to the second cryptography algorithm;
- and
- after determining to switch to the second cryptography algorithm, encrypt a second message to the second computing device using a second cryptography algorithm different from the first cryptography algorithm.
Dependencies are inferred from the claim text.