# US 11,121,869 B1 · Decentralized cryptographic key derivation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,121,869 B1
- Document ID: US11121869B1
- Status: Granted
- Kind: B1
- Application number: 16/870,447
- Filed: 2020-05-08
- Granted: 2021-09-14
- Earliest claimed: 2020-05-08
- Assignees: Amazon Technologies, Inc.
- Applicants: Amazon Technologies, Inc.
- Inventors: Eric Crahen; Krutarth Mukesh Gathani
- Web page: https://patentgrep.com/patent/US11121869B1

## CPC

- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- G06F 9/547: {Remote procedure calls [RPC]; Web services}
- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 2463/061: applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Cryptographic keys are generated for components of a distributed system in a decentralized manner. A root key is generated for a universe of components, including capturing data and components for processing the data. A cryptographic key for a processing component is derived from the root key and one or more attributes or identifiers of the processing component, which may be provided in a specific region or domain. Cryptographic keys for capturing components (e.g., cameras) within the region or domain are derived from the cryptographic keys of the processing component and one or more attributes or identifiers of the respective capturing components. The capturing components encrypt data using their respective cryptographic keys and transfer the encrypted data to the processing component, which re-derives the cryptographic keys for such capturing components and decrypts the encrypted data using the re-derived cryptographic keys.

## Claims

### Claim 1

A system comprising:
a first computer device provided within a materials handling facility, wherein the first computer device is connected to a network; and
a plurality of cameras provided within the materials handling facility, wherein each of the plurality of cameras is in communication with the first computer device,
wherein the first computer device is programmed with computer-executable instructions that, when executed, cause the first computer device to at least:
receive a first cryptographic key from a second computer device over the network wherein the first cryptographic key is derived for the first computer device from a root key generated by the second computer device;
derive cryptographic keys for each of the plurality of cameras, wherein each of the cryptographic keys is derived according to a cryptographic function based at least in part on the first cryptographic key and an identifier of one of the cameras;
distribute the cryptographic keys to the plurality of cameras, wherein each of the cryptographic keys is distributed to one of the cameras, and wherein a second cryptographic key derived according to the cryptographic function based at least in part on the first cryptographic key and a first identifier of a first camera of the plurality of cameras is one of the cryptographic keys distributed to the first camera;
receive first imaging data from the first camera;
in response to receiving the first imaging data,
determine that the first imaging data was received from the first camera;
derive at least a third cryptographic key according to the cryptographic function based at least in part on the first cryptographic key and the first identifier;
decrypt the first imaging data received from the first camera based at least in part on the third cryptographic key;
store the decrypted first imaging data on the first computer device; and
process the decrypted first imaging data to detect at least one object depicted within the first imaging data.

### Claim 2 (depends on 1)

The system of claim 1, wherein a fourth cryptographic key derived according to the cryptographic function based at least in part on the first cryptographic key and a second identifier of a second camera of the plurality of cameras is one of the cryptographic keys distributed to the second camera, and
wherein the computer-executable instructions, when executed, further cause the first computer device to at least:
receive second imaging data from the second camera;
in response to receiving the second imaging data,
determine that the second imaging data was received from the second camera;
derive at least a fifth cryptographic key according to the cryptographic function based at least in part on the first cryptographic key and the second identifier, wherein the fifth cryptographic key is not the third cryptographic key;
decrypt the second imaging data received from the second camera based at least in part on the fifth cryptographic key;
store the decrypted second imaging data on the first computer device; and
process the decrypted second imaging data to detect at least one object depicted within the second imaging data.

### Claim 3 (depends on 1)

The system of claim 1, wherein the root key is a string of characters of at least thirty-two raw bytes randomly generated by the second computer device at a first interval,
wherein the cryptographic function is a hash-based message activation code function,
wherein the cryptographic keys are derived for each of the plurality of cameras at a second interval, and
wherein the second interval is shorter than the first interval.

### Claim 4 (depends on 1)

The system of claim 1, wherein the cryptographic function derives the cryptographic keys for the plurality of cameras based at least in part on the first cryptographic key, the identifier of the one of the cameras, and one or more of:
a date or a time that the cryptographic keys are valid;
a duration for which the cryptographic keys are valid;
an identifier of a facility in which one of the first computer device and the plurality of cameras are provided;
an identifier of a region in which the materials handling facility is located; or
an identifier of a domain of at least the first computer device and the plurality of cameras.

### Claim 5

A method comprising:
deriving, by a first computer device provided within a facility, a first cryptographic key for a first capturing component provided within the facility, wherein the first cryptographic key is derived for the first capturing component at a first time based at least in part on a second cryptographic key derived for at least the first computer device by a second computer device and at least one of an attribute or an identifier of the first capturing component, and wherein the second computer device is not provided within the facility;
transmitting, by the first computer device, the first cryptographic key to the first capturing component;
capturing first data by the first capturing component;
encrypting, by the first capturing component, the first data using the first cryptographic key;
transmitting, by the first capturing component, the encrypted first data to the first computer device;
receiving, by the first computer device, the encrypted first data from the first capturing component; and
in response to receiving the encrypted first data,
determining, by the first computer device, the at least one of the attribute or the identifier of the first capturing component;
deriving, by the first computer device, a third cryptographic key for the first capturing component at a second time, wherein the third cryptographic key is derived based at least in part on the second cryptographic key and the at least one of the attribute or the identifier of the first capturing component, and wherein the second time follows the first time; and
decrypting, by the first computer device, the encrypted first data using the third cryptographic key.

### Claim 6 (depends on 5)

The method of claim 5, further comprising:
generating, by a second computer device, a root key for a system comprising the first computer device and the second computer device;
deriving, by the second computer device, the second cryptographic key for at least the first computer device based at least in part on the root key and at least one of an identifier or an attribute of the first computing device;
transmitting, by the second computer device, the second cryptographic key to the first computer device over a network; and
receiving, by the first computer device, the second cryptographic key from the second computer device prior to the first time.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
deriving, by the first computer device, a fourth cryptographic key for a second capturing component provided within the facility, wherein the fourth cryptographic key is derived for the second capturing component based at least in part on the second cryptographic key and at least one of an attribute or an identifier of the second capturing component;
transmitting, by the first computer device, the fourth cryptographic key to the second capturing component;
capturing second data by the second capturing component;
encrypting, by the second capturing component, the second data using the fourth cryptographic key;
transmitting, by the second capturing component, the encrypted second data to the first computer device;
receiving, by the first computer device, the encrypted second data from the second capturing component; and
in response to receiving the encrypted second data,
determining, by the first computer device, the at least one of the attribute or the identifier of the second capturing component;
deriving, by the first computer device, a fifth cryptographic key for the second capturing component at a fourth time, wherein the fifth cryptographic key is derived based at least in part on the second cryptographic key and at least one of the attribute or the identifier of the second capturing component, and wherein the third time follows the first time; and
decrypting, by the first computer device, the encrypted second data using the fifth cryptographic key,
wherein the fourth cryptographic key is not the first cryptographic key, and
wherein the fifth cryptographic key is not the third cryptographic key.

### Claim 8 (depends on 6)

The method of claim 6, wherein the root key comprises a thirty-two raw byte string of characters randomly generated by the second computing device at a first interval.

### Claim 9 (depends on 6)

The method of claim 6, wherein the second cryptographic key is derived for at least the first computer device based at least in part on the root key and the at least one of the attribute or the identifier of the first computer device according to a hash-based message activation code function.

### Claim 10 (depends on 6)

The method of claim 6, wherein the first cryptographic key is derived for the first capturing component based at least in part on the second cryptographic key and the at least one of the attribute or the identifier of the first capturing component according to a hash-based message activation code function.

### Claim 11 (depends on 6)

The method of claim 6, wherein the at least one of the attribute or the identifier of the first computer device comprises one or more of:
a date or a time that the second cryptographic key is valid;
a duration for which the second cryptographic key is valid;
an identifier of the facility;
an identifier of a region in which the facility is located; or
an identifier of a domain of at least the first computer device and the first capturing component.

### Claim 12 (depends on 11)

The method of claim 11, wherein the second cryptographic key is derived based at least in part on an initialization vector for one of the first computer device or the first capturing component.

### Claim 13 (depends on 6)

The method of claim 6, wherein the root key is generated for the system in accordance with a first interval,
wherein the first cryptographic key is derived for the first capturing component in accordance with a second interval, and
wherein the second interval is shorter than the first interval.

### Claim 14 (depends on 6)

The method of claim 6, further comprising:
receiving, by the first computer device, a call to a first application programming interface from the first capturing component, wherein the call to the first application programming interface comprises the at least one of the attribute or the identifier of the first capturing component, and
wherein the first cryptographic key is derived in response to receiving the call to the first application programming interface.

### Claim 15 (depends on 14)

The method of claim 14, further comprising:
receiving, by the second computer device, a call to a second application programming interface from the first computer device, wherein the call to the second application programming interface comprises the at least one of the attribute or the identifier of the first computer device, and
wherein the second cryptographic key is derived in response to receiving the call to the second application programming interface.

### Claim 16 (depends on 5)

The method of claim 5, wherein the facility is a materials handling facility.

### Claim 17 (depends on 5)

The method of claim 5, further comprising:
processing the first data by the first computer device,
wherein the first data is processed after the encrypted first data is decrypted by the first computer device using the third cryptographic key.

### Claim 18 (depends on 17)

The method of claim 17, wherein the first capturing component is a visual camera,
wherein the first data comprises a first image, and
wherein processing the first data comprises:
providing, by the first computer device, at least the first image to at least one detection algorithm as an input;
receiving, by the first computer device, an output from the at least one detection algorithm; and
identifying, by the first computer device, at least one object depicted within the first image based at least in part on the output.

### Claim 19

A system comprising:
a first computer device;
a second computer device provided in association with a materials handling facility; and
a plurality of camera devices provided within the materials handling facility, wherein each of the plurality of camera devices is in communication with the second computer device, and wherein each of the plurality of camera devices is configured to capture imaging data, and
wherein the first computer device is programmed with one or more sets of instructions that, when executed by the first computer device, cause the first computer device to at least:
generate a root key for at least one computer device or at least one camera device of the system;
receive, from the second computer device, a request for a first cryptographic key, wherein the request comprises at least one of an attribute or an identifier of the second computer device;
derive, according to a hash-based message authentication code function, the first cryptographic key for at least the second computer device based at least in part on the root key and the at least one of the attribute or the identifier of the second computer device;
transmit the first cryptographic key to the second computer device;
receive, from a first camera device, encrypted imaging data and metadata, wherein the first camera device is one of the plurality of camera devices, wherein the metadata identifies the first camera device and an association between then first camera device and the second computer device, and wherein the encrypted imaging data was encrypted by the first camera device using a second cryptographic key derived by the second computer device according to a hash-based message authentication code function based at least in part on the first cryptographic key and an identifier of the first camera device;
determine the identifier of the first camera device based at least in part on the metadata;
derive, according to a hash-based message authentication code function, a third cryptographic key for the first camera device based at least in part on the first cryptographic key and the identifier of the first camera device; and
decrypt the encrypted imaging data using the third cryptographic key.

### Claim 20 (depends on 19)

The system of claim 19, wherein the request for the first cryptographic key is received via a first call by the second computer device to a first application programming interface of the first computer device, and
wherein the second cryptographic key is derived in response to a second call by the first camera device to a second application programming interface of the first computer device.