Data integrity verification
AssigneeAmazon Technologies, Inc.
InventorsGregory Branchek Roth, Gregory Alan Rubin, Matthew John Campagna, Petr Praus
Life of this patent
Estimating the term…
Abstract
A system performs cryptographic operations utilizing information usable to verify validity of plaintext. To prevent providing information about a plaintext by providing the information usable to verify the validity of the plaintext, the system provides the information usable to verify validity of the plaintext to an entity on a condition that the entity is authorized to access the plaintext. The information usable to verify validity of the plaintext may be persisted in ciphertext along with the plaintext to enable the plaintext to be verified when decrypted.
Claims20
A computer-implemented method, comprising:
- as a result of detecting satisfaction of a key rotation condition, obtaining data that encrypts at least a data key and an integrity value associated to the data key;
- decrypting the data using a first cryptographic key to obtain the data key and the integrity value associated to the data key;
- selecting an algorithm to determine information to verify validity of the data;
- determining, in accordance with the algorithm, the information to verify validity of the data;
- in response to determining the integrity value associated to the data key and the information to verify validity of the data match, generating ciphertext by performing an encryption operation on the data key and the integrity value associated to the data key using at least a second cryptographic key different from the first cryptographic key, wherein the data key encodes the data and the information to verify validity of the data, and further wherein the generated ciphertext is decryptable, by the second cryptographic key, to obtain the data key and the information to verify validity of the data;
- and
- providing a response that includes the generated ciphertext.
A system, comprising:
- one or more processors;
- and
- memory including instructions that, as a result of execution by the one or more processors, cause the system to:
- obtain, in satisfaction of a key rotation condition, data that encrypts at least a first cryptographic key and an integrity value associated to the first cryptographic key;
- determine, according to a mode of operation selected from a plurality of supported modes of operation, information usable to verify validity of the data;
- in response to determining the integrity value associated to the first cryptographic key and the information usable to verify validity of the data match:
- decrypt the data using a second cryptographic key to obtain the first cryptographic key and the integrity value associated to the first cryptographic key;
- and
- generate output by performing an encryption operation on the first cryptographic key and the integrity value associated to the first cryptographic key using at least a third cryptographic key different from the second cryptographic key;
- and
- provide the output and a parameter to determine the mode of operation.
A non-transitory computer-readable storage medium storing instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to:
- obtain, based at least in part on an indication to perform a key rotation, data that encrypts at least a first cryptographic key and an integrity value associated to the first cryptographic key;
- decrypt the data using a second cryptographic key to obtain the first cryptographic key and the integrity value associated to the first cryptographic key;
- select an algorithm to determine information to verify validity of the data;
- determine, in accordance with the algorithm, the information to verify validity of the data;
- in response to determining the integrity value associated to the first cryptographic key and the information to verify validity of the data match, generate ciphertext by performing an encryption operation on the first cryptographic key and the integrity value associated to the first cryptographic key using at least a third cryptographic key different from the second cryptographic key, wherein the first cryptographic key encodes the data and the information to verify validity of the data, and further wherein the generated ciphertext is decryptable, by the third cryptographic key, to obtain the first cryptographic key and the information to verify validity of the data;
- and
- provide the ciphertext to another computer system.
Dependencies are inferred from the claim text.