# US 11,115,223 B2 · Cryptographic material distribution and management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,115,223 B2
- Document ID: US11115223B2
- Status: Granted
- Kind: B2
- Application number: 16/523,908
- Filed: 2019-07-26
- Published: 2019-11-14
- Granted: 2021-09-07
- Earliest claimed: 2014-10-21
- Assignees: Amazon Technologies, Inc.
- Applicants: Amazon Technologies, Inc.
- Inventors: Todd Lawrence Cignetti; Andrew Jeffrey Doane; Stefan Popoveniuc; Matthew Allen Estes; Alexander Edward Schoof; Robert Eric Fitzgerald; Peter Zachary Bowen
- Web page: https://patentgrep.com/patent/US11115223B2

## CPC

- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- H04L 9/3247: {involving digital signatures}
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method and apparatus for distributing cryptographic material are disclosed. In the method and apparatus, cryptographic material is obtained and it is determined that the cryptographic material is to be made available for use by one or more computing resources. The cryptographic material is then sent to one or more secure modules, whereby a secure module of the one or more secure modules is programmatically accessible to a computing resource of the one or more computing resources and programmatic access enables the computing resource to request performance of one or more cryptographic operations using the cryptographic material while exporting the cryptographic material to the computing resource is denied.

## Claims

### Claim 1

A computer-implemented method, comprising:
receiving, at a control domain of a host computer system, where the control domain is associated with a first set of privileges for accessing underlying hardware of the host computer system, from a cryptographic material management service of a computing resource service provider, a request to make cryptographic material available to a computing resource executed by the host computer system, where the computing resource is associated with a second set of privileges;
as a result of the control domain authenticating the request, provisioning a secure module for the computing resource to be attached to the computer resource through an interface based at least in part on the first set of privileges; and
providing, by the control domain, the cryptographic material to be stored by the secure module, the cryptographic material being non-exportable from the secure module to the computing resource and use of the cryptographic material for performing one or more cryptographic operations being programmatically available to the computing resource via the interface.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein the secure module is available to the computing resource via an application programming interface (API) function call.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, wherein:
the secure module is a virtual cryptographic device; and
the computing resource detects the secure module as a result of logical attachment of the secure module to the computing resource.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, wherein the secure module is instantiated in a control domain and the computing resource is instantiated in an unprivileged domain.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, wherein the cryptographic material further comprises a private key associated with a digital certificate.

### Claim 6 (depends on 5)

The computer-implemented method of claim 5, wherein the secure module is logically attached to the computing resource via a port of the computing resource.

### Claim 7

A system comprising:
one or more processors; and
memory storing executable instructions that, as a result of being executed by the one or more processors, cause the system to:
in response to obtaining cryptographic material at a first domain of the system associated with a first set of permissions that includes access to hardware of the system, provision a secure module for a computing resource for which the cryptographic material is to be made available, where the computing resource is associated with a second set of permissions lacking permission to at least a portion of the hardware of the system; and
allow the computing resource to access the secure module by at least providing the computing resource with programmatic access, via an interface, to the secure module, where the computing resource requests performance of cryptographic operations using the cryptographic material by the secure module by at least submitting a programmatic request to the secure module and the programmatic request lacks an ability to export the cryptographic material from the secure module to the computing resource.

### Claim 8 (depends on 7)

The system of claim 7, wherein the instructions further include instructions that, as a result of being executed by the one or more processors, cause the system to logically attach the secure module to the computing resource after provisioning the secure module using a port of the computing resource.

### Claim 9 (depends on 8)

The system of claim 8, wherein the instructions further include instructions that, as a result of being executed by the one or more processors, cause the system to cause the computing resource to install a driver associated with the port that detects attachment of the secure module.

### Claim 10 (depends on 7)

The system of claim 7, wherein the instructions that cause the system to provision the secure module further include instructions that, as a result of being executed by the one or more processors, cause the system to provision the secure module with a cryptoprocessor that performs the cryptographic operations using the cryptographic material.

### Claim 11 (depends on 7)

The system of claim 7, wherein the instructions further include instructions that, as a result of being executed by the one or more processors, cause the system to provision the computing resource in response to a request to make the cryptographic material available to the computing resource.

### Claim 12 (depends on 11)

The system of claim 11, wherein the request includes an identifier of the cryptographic material and a customer of a computing resource service provider responsible for providing the computing resource.

### Claim 13 (depends on 7)

The system of claim 7, wherein the computing resource further comprises a virtual computer system.

### Claim 14

A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
obtain, at a first domain associated with a first set of privileges that includes access to hardware of the computer system, a command to provide cryptographic material to a computing resource within a second domain of the computer system and associated with a second of set privileges, the command obtained from a cryptographic material management service of a computing resource service provider;
provision a secure module within the first domain such that the computing resource has access to the secure module through an interface, the computing resource providing requests to the secure module through the interface to perform cryptographic operations while preventing the computing resource from obtaining the cryptographic material from the secure module; and
provide the cryptographic material to the secure module.

### Claim 15 (depends on 14)

The non-transitory computer-readable storage medium of claim 14, wherein the computing resource is a member of a set of computing resources and, as a result of executing the command, the cryptographic material is provided to the set of computing resources.

### Claim 16 (depends on 14)

The non-transitory computer-readable storage medium of claim 14, wherein the cryptographic material further comprises a private key and the cryptographic operations further comprise generating a digital signature based at least in part on the private key.

### Claim 17 (depends on 14)

The non-transitory computer-readable storage medium of claim 14, wherein the secure module further comprises a datastore and a cryptoprocessor, where the datastore maintains the cryptographic material and the cryptoprocessor performs the cryptographic operations.

### Claim 18 (depends on 14)

The non-transitory computer-readable storage medium of claim 14, wherein the computing resource is instantiated in a second domain distinct from the first domain and the second set of privileges lacks at least one privilege to access hardware of the computer system.

### Claim 19 (depends on 14)

The non-transitory computer-readable storage medium of claim 14, wherein the command to provide cryptographic material is associated with a request to provision the computing resource; and
wherein the instructions further comprise instructions that, as result of being executed by the one or more processors, cause the computer system to provision the computing resource prior to provisioning the secure module.

### Claim 20 (depends on 14)

The non-transitory computer-readable storage medium of claim 14, wherein the secure module further comprises at least one of: a virtual smartcard, a virtual hardware secure module, a virtual trusted platform module, and a network-attached device.