Management of secrets using stochastic processes
AssigneeAmazon Technologies, Inc.
InventorsGregory Branchek Roth, Gregory Alan Rubin
Life of this patent
Estimating the term…
Abstract
A secret is stored in a computing device. The device generates a value determined based at least in part on a substantially random process. As a result of the value satisfying a condition, the device causes the secret to be unusable to perform cryptographic operations such that the device is unable to cause the secret to be restored. The secret may be programmatically unexportable from the device.
Claims20
A computer-implemented method, comprising:
- storing, in a computing device, a secret;
- in response to an input to use the secret to perform a cryptographic operation, generating a value determined based at least in part on a pseudo-random process;
- determining that the value is within a first range relative to a threshold value;
- and
- as a result of the value being within the first range relative to the threshold value and satisfying a condition, causing the secret to be unusable to perform a set of cryptographic operations such that the computing device is unable to cause the secret to be restored, where a cryptographic operation of the set of cryptographic operations includes a hash based at least in part on data comprising the secret and a passcode.
A device, comprising one or more processors and memory to store instructions that, as a result of execution, cause the device to:
- store a secret;
- based at least in part on a random number generator, obtain a value in response to a request to use the secret to perform a cryptographic operation;
- as a result of the value failing to satisfy the condition that the value be within a usage limit, perform the cryptographic operation by at least generating a hash based at least in part on data comprising the secret and a passcode;
- and
- as a result of the value satisfying a condition that the value be within the usage limit, cause the secret to be unusable to perform cryptographic operations such that the device is unable to cause the secret to be restored.
A non-transitory computer-readable storage medium storing thereon instructions that, as a result of execution by one or more processors of a device, cause the device to:
- store a secret;
- generate a hash based at least in part on data comprising the secret and a passcode, the hash used by a password verification system to verify the passcode;
- in response to a request to perform one or more crypotgraphic operations, generate a value determined based, at least in part, on a pseudo-random process, where the request indicates that at least one crypotgraphic operation of the one or more cryptographic operations includes verifying the passcode;
- and
- as a result of the value satisfying a first condition, where the first condition indicates a threshold value, cause the secret to be unusable to fulfill requests to perform the one or more cryptographic operations, wherein the device is unable to cause the secret to be restored.
Dependencies are inferred from the claim text.