# US 10,374,809 B1 · Digital signature verification for asynchronous responses > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,374,809 B1 - Document ID: US10374809B1 - Status: Granted - Kind: B1 - Application number: 15/377,895 - Filed: 2016-12-13 - Granted: 2019-08-06 - Earliest claimed: 2016-12-13 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Arjun Dasarakothapalli; Morgan Akers; David Alan Blunt; Darin Keith McAdams - Web page: https://patentgrep.com/patent/US10374809B1 ## CPC - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3247: {involving digital signatures} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A server obtains response data for an asynchronous response to a request from a client. The server generates, in response to obtaining the response data, a digital signature for the response data. The server makes available the response data, the digital signature, and location information that indicates a location from which a digital certificate usable to verify the digital signature can be obtained. ## Claims ### Claim 1 A computer-implemented method, comprising: receiving, from a client device, a request; initiating an asynchronous process to fulfill the request; at a time after receipt of the request, causing a certificate authority to issue a digital certificate that encodes a public cryptographic key, the public cryptographic key corresponding to a private cryptographic key; storing the digital certificate in a datastore; obtaining response data for the request that results from the asynchronous process; using the private cryptographic key to digitally sign the response data to result in a digital signature of the response data; generating a token that encodes the response data, the digital signature, and a link to the digital certificate that enables the client device to obtain the digital certificate from the datastore; and providing the token to the client device. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising generating, in response to the request, a cryptographic key pair that includes the public cryptographic key and the private cryptographic key. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein providing the token to the client device includes transmitting the the token to a service to cause the service to provide the the token to the client device. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the token is a JavaScript Object Notation Web Signature token. ### Claim 5 A system, comprising at least one computing device configured to implement one or more services, wherein the one or more services: receive, from a client device, a request; initiate an asynchronous process to fulfill the request; at a time after receipt of the request, cause a certificate authority to issue a digital certificate that encodes a public cryptographic key, the public cryptographic key corresponding to a private cryptographic key; store the digital certificate in a location from which the digital certificate is obtainable; obtain response data for the request that results from the asynchronous process; generate, using the private cryptographic key, a digital signature for the response data, the digital signature verifiable using a digital certificate; generate a token that encodes the response data, the digital signature, and location information that indicates the location; and make available the token. ### Claim 6 (depends on 5) The system of claim 5, wherein the one or more services further: determine, at a time after making available the token, that the digital certificate has been revoked; generate a second digital signature for the response data, the second digital signature verifiable using a second digital certificate; and make available the response data, the second digital signature, and second location information that indicates a second location which the second digital certificate is obtainable. ### Claim 7 (depends on 5) The system of claim 5, wherein the one or more services further generate, in response to the request, a cryptographic key pair that includes the public cryptographic key and the private cryptographic key. ### Claim 8 (depends on 5) The system of claim 5, wherein the one or more services further provide the token to another service to make available the token. ### Claim 9 (depends on 5) The system of claim 5, wherein the location information is a Uniform Resource Identifier corresponding to a datastore in which the digital certificate is stored. ### Claim 10 (depends on 5) The system of claim 5, wherein the token is a JavaScript Object Notation Web Signature token. ### Claim 11 (depends on 5) The system of claim 5, wherein the one or more services further: at a time after making available the token, determine that the public cryptographic key has been compromised; receive a second request to provide a revocation status for the public cryptographic key; and in response to the second request, provide a notification specifying that the public cryptographic key has been revoked such that the public cryptographic key cannot be used to verify the digital signature. ### Claim 12 (depends on 5) The system of claim 5, wherein the one or more services further obtain, from the certificate authority, the location information that indicates the location from which the digital certificate is obtainable. ### Claim 13 A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least: receive a request; initiate an asynchronous process to fulfill the request; at a time after receipt of the request, cause a certificate authority to issue a digital certificate that encodes a public cryptographic key, the public cryptographic key corresponding to a private cryptographic key; store the digital certificate in a location from which the digital certificate is obtainable; obtain response data for the asynchronous response to the request; use the private cryptographic key to digitally sign the response data, resulting in a digital signature of the response data; generate a token that encodes the response data, the digital signature, and location information that indicates the location; and make available the token. ### Claim 14 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the instructions further cause the computer system to obtain, in response to the request, a cryptographic key pair that includes the public cryptographic key and the private cryptographic key. ### Claim 15 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the instructions that cause the computer system to make available the token further cause the computer system to transmit the token to a requestor. ### Claim 16 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the instructions further cause the computer system to: at a time after making available the token, determine that the public cryptographic key has become invalid; identify a second location from which a second public cryptographic key usable to verify the digital signature is obtainable; and make available second location information that indicates the second location. ### Claim 17 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the location information comprises a Uniform Resource Identifier usable to request the public cryptographic key. ### Claim 18 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the instructions further cause the computer system to: at a time after making available the token, determine that the public cryptographic key has been compromised; receive a request to provide a revocation status for the public cryptographic key; and in response to the request, provide a notification specifying that the public cryptographic key has been revoked such that the public cryptographic key cannot be used to verify the digital signature. ### Claim 19 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the token is a JavaScript Object Notation Web Signature token. ### Claim 20 (depends on 13) The non-transitory computer-readable storage medium of claim 13, wherein the instructions further cause the computer system to obtain, from the certificate authority, the location information that indicates the location from which the digital certificate is obtainable.