# US 11,310,059 B2 · Ephemeral cryptography keys for authenticating computing services

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,310,059 B2
- Document ID: US11310059B2
- Status: Granted
- Kind: B2
- Application number: 16/890,654
- Filed: 2020-06-02
- Published: 2021-12-02
- Granted: 2022-04-19
- Earliest claimed: 2020-06-02
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Microsoft Technology Licensing, LLC
- Inventors: Matthias Adam Leibmann; Victor Boctor; Grigory V. Kaplin; Liang Zou; Paranthaman Saravanan
- Web page: https://patentgrep.com/patent/US11310059B2

## CPC

- H04L 9/3247: {involving digital signatures}
- H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA]
- H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 2209/24: Key scheduling, i.e. generating round keys or sub-keys for block encryption
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Techniques of data authentication in a distributed computing system are disclosed herein. One example technique includes receiving a request for performing an operation along with a data package that includes a security token, a first digital signature of the security token generated using an ephemeral private key, and an ephemeral public key with a second digital signature generated using a master private key stored at a secure location. The example technique can also include initially validating the second digital signature using a public key corresponding to the master private key, and upon validating the second digital signature, validating the first digital signature of the security token using the ephemeral public key included in the data package. Upon validating that the first digital signature of the security token, the request can be authenticated, and the requested operation can be performed.

## Claims

### Claim 1

A method of data authentication in a distributed computing system having a security server storing a static private key and multiple additional servers hosting multiple computing services and an authentication service, the method comprising:
upon receiving, at the authentication service, a request from a first computing service for a security token that is configured to authenticate the first computing service to a second computing service, transmitting, to the first computing service, a data package including:
the security token requested by the first computing service;
a first digital signature of the security token generated using an ephemeral private key of the authentication service; and
an ephemeral public key corresponding to the ephemeral private key of the authentication service with a second digital signature of the ephemeral public key generated using the private key stored at the security server of the distributed computing system; and
upon receiving, from the first computing service, a request for performing an operation along with a copy of the data package, at the second computing service,
validating the second digital signature using a public key corresponding to the private key stored at the security server;
upon validating the second digital signature, validating, using the ephemeral public key included in the copy of the data package, the first digital signature of the security token; and
upon validating that the first digital signature of the security token, authenticating the request for performing the operation and performing the operation requested by the first computing service.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
periodically generating, at a server hosting the authentication service, the ephemeral private key and the ephemeral public key in memory of the server hosting the authentication service, the generated ephemeral private key and the ephemeral public key having a finite lifespan; and
generating the first digital signature of the security token using the generated ephemeral private key of the authentication service currently present in the memory of the server.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
generating, at a server hosting the authentication service, the ephemeral private key and the ephemeral public key in memory of a server hosting the authentication service, the generated ephemeral private key and the ephemeral public key having a finite lifespan;
determining, at the server hosting the authentication service, whether the finite lifespan has expired; and
in response to determining that the finite lifespan has expired,
discarding the ephemeral private key and the ephemeral public key from the memory of the server; and
regenerating another ephemeral private key and another ephemeral public key in the memory of the server.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
generating the second digital signature by:
transmitting, to the security server a request for the second digital signature of the ephemeral public key; and
receiving, from the security server, a copy of the generated ephemeral public key with the digital signature generated using the private key stored at the security server.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
generating, at a server hosting the authentication service, the ephemeral private key and the ephemeral public key in memory of a server hosting the authentication service;
transmitting, from the server to the security server a request for the second digital signature of the ephemeral public key; and
receiving, from the security server, a copy of the generated ephemeral public key with the second digital signature generated using the private key stored at the security server.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
upon receiving, from the first computing service, a copy of the data package at the second computing service,
retrieving, from the authentication service, the public key corresponding to the private key stored at the security server; and
validating the second digital signature using the public key retrieved from the authentication service.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
generating, at a server hosting the authentication service, the ephemeral private key and the ephemeral public key in memory of a server hosting the authentication service, the generated ephemeral private key and the ephemeral public key having a finite lifespan;
determining, at the server hosting the authentication service, whether the finite lifespan has expired; and
in response to determining that the finite lifespan has expired,
regenerating another ephemeral private key and another ephemeral public key in the memory of the server;
transmitting, from the server to the security server a request for a third digital signature of the regenerated ephemeral public key; and
receiving, from the security server, a copy of the regenerated ephemeral public key with the third digital signature generated using the private key stored at the security server.

### Claim 8

A method of data authentication in a distributed computing system having a security server storing a static private key and multiple additional servers hosting multiple computing services and an authentication service, the method comprising:
receiving, at the authentication service, data representing a request from a computing service for a security token that is configured to authenticate the computing service to another computing service in the distributed computing system; and
in response to receiving the request for the security token, at the authentication service,
generating the requested security token;
creating a digital signature of the generated security token using an ephemeral private key of the authentication service; and
transmitting, to the computing service, a data package as a response to the received request, the data package including:
the generated security token;
the digital signature of the generated security token created using the ephemeral private key of the authentication service; and
an ephemeral public key corresponding to the ephemeral private key of the authentication service, the ephemeral public key including a digital signature of the ephemeral public key generated using the private key stored at the security server.

### Claim 9 (depends on 8)

The method of claim 8, further comprising generating, at a server hosting the authentication service, the ephemeral private key and the ephemeral public key in memory of the server hosting the authentication service, the generated ephemeral private key and the ephemeral public key having a finite lifespan.

### Claim 10 (depends on 8)

The method of claim 8 wherein the authentication service is deployed on the server without a static private key or a static public key, and wherein the method further comprises generating, at a server hosting the authentication service, the ephemeral private key and the ephemeral public key in memory of the server hosting the authentication service, the generated ephemeral private key and the ephemeral public key having a finite lifespan.

### Claim 11 (depends on 8)

The method of claim 8, further comprising:
generating, at a server hosting the authentication service, the ephemeral private key and the ephemeral public key in memory of the server hosting the authentication service, the generated ephemeral private key and the ephemeral public key having a finite lifespan;
determining, at the server hosting the authentication service, whether the finite lifespan has expired; and
in response to determining that the finite lifespan has expired, discarding the ephemeral private key and the ephemeral public key from the memory of the server; and
regenerating another ephemeral private key and another ephemeral public key in the memory of the server.

### Claim 12 (depends on 8)

The method of claim 8, further comprising:
generating, at a server hosting the authentication service, the ephemeral private key and the ephemeral public key in memory of the server hosting the authentication service;
transmitting, from the server to the security server a request for the digital signature of the ephemeral public key; and
receiving, from the security server, a copy of the generated ephemeral public key with the digital signature generated using the private key stored at the security server.

### Claim 13 (depends on 8)

The method of claim 8, further comprising:
generating, at a server hosting the authentication service, the ephemeral private key and the ephemeral public key in memory of the server hosting the authentication service, the generated ephemeral private key and the ephemeral public key having a finite lifespan;
determining, at the server hosting the authentication service, whether the finite lifespan has expired; and
in response to determining that the finite lifespan has expired,
regenerating another ephemeral private key and another ephemeral public key in the memory of the server;
transmitting, from the server to the security server a request for a digital signature of the regenerated ephemeral public key; and
receiving, from the security server, a copy of the regenerated ephemeral public key with the digital signature generated using the private key stored at the security server.

### Claim 14 (depends on 8)

The method of claim 8 wherein:
the digital signature of the generated security token includes a copy of the security token signed using the ephemeral private key, the signed copy of the security token can be validated using the ephemeral public key; and
the digital signature of the ephemeral public key includes a copy of the ephemeral public key signed using the private key stored at the security server, the signed ephemeral public key is can be validated using a public key corresponding to the private key stored at the security server.

### Claim 15 (depends on 8)

The method of claim 8, further comprising:
upon receiving, from the computing service, a copy of the data package at the another computing service,
authenticating the copy of the ephemeral public key by validating the digital signature of the ephemeral public key generated using the private key stored at the security server; and
upon authenticating the copy of the ephemeral public key, authenticating the security token by validating, using the authenticated ephemeral public key, the digital signature of the security token created using the ephemeral private key of the authentication service.

### Claim 16 (depends on 8)

The method of claim 8, further comprising:
upon receiving, from the computing service, a copy of the data package at the another computing service,
retrieving, from the authentication service, a public key corresponding to the private key stored at the security server;
authenticating the copy of the ephemeral public key by validating, using the retrieved public key, the digital signature of the ephemeral public key generated using the private key stored at the security server; and
upon authenticating the copy of the ephemeral public key, authenticating the security token by validating, using the authenticated ephemeral public key, the digital signature of the security token created using the ephemeral private key of the authentication service.

### Claim 17

A computing device in a distributed computing system having a security server storing a static private key and multiple additional servers hosting multiple computing services and an authentication service, comprising:
a processor; and
a memory operatively coupled to the processor, the memory containing instructions executable by the processor to cause the computing device to provide a computing service, wherein the memory also contains additional instructions executable by the processor to cause the computing device to:
receive, from another computing service, a request for performing an operation along with a data package having:
a security token of the another computing service;
a first digital signature of the security token generated using an ephemeral private key of the authentication service; and
an ephemeral public key corresponding to the ephemeral private key of the authentication service with a second digital signature of the ephemeral public key generated using the private key stored at the security server of the distributed computing system; and
in response to receiving the request, at the computing device,
validate the second digital signature using a public key corresponding to the private key stored at the security server;
upon validating the second digital signature, validate, using the ephemeral public key included in the data package, the first digital signature; and
upon validating that the first digital signature, perform the operation requested by the another computing service.

### Claim 18 (depends on 17)

The computing device of claim 17 wherein the memory includes further instructions executable by the processor to cause the computing device to:
retrieve, from the authentication service, a public key corresponding to the private key stored at the security server; and
wherein to validate the second digital signature includes to validate the second digital signature using the retrieved public key from the authentication service.

### Claim 19 (depends on 17)

The computing device of claim 17 wherein the memory includes further instructions executable by the processor to cause the computing device to:
receive, from the another computing service, another request for performing another operation along with another data package having:
the security token of the another computing service;
a third digital signature of the security token generated using a new ephemeral private key of the authentication service; and
a new ephemeral public key corresponding to the new ephemeral private key of the authentication service with a fourth digital signature of the new ephemeral public key generated using the same private key stored at the security server of the distributed computing system;
in response to receiving the another request, at the computing device,
validate the fourth digital signature using the public key corresponding to the private key stored at the security server;
upon validating the fourth digital signature, validating, using the new ephemeral public key included in the another data package, the third digital signature; and
upon validating that the third digital signature, performing the another operation requested by the another computing service.

### Claim 20 (depends on 17)

The computing device of claim 17 wherein the memory includes further instructions executable by the processor to cause the computing device to:
upon validating the second digital signature, indicate the ephemeral public key as being genuine; and
upon validating that the first digital signature, indicate the security token as being genuine.