US 11,689,364 B2 · Mitigating service disruptions in key maintenance

Abstract

Embodiments of the present invention provide systems and techniques for changing cryptographic keys in high-frequency transaction environments to mitigate service disruptions or loss of transactions associated with key maintenance. In various embodiments, a server device can employ a working key encrypted with a first master key to decrypt messages being communicated from a client device, whereby each message is encrypted with a first cryptogram that was generated based on the working key encrypted with the first master key. While the working key encrypted with the first master key is being employed, the server device can generate a notification including a second cryptogram generated based on the working key encrypted with a second master key for transmission to the client device. The transmitted notification can cause the client device to encrypt the messages being communicated with the second cryptogram. The server device can concurrently employ the working key encrypted with one of the first and second master keys to decrypt messages received from the client device, whether encrypted with the first cryptogram or the second cryptogram.

Claims20

Dependent claims

A system for encrypting messages, the system comprising:

at least one processor;
and
computer readable media storing computer-readable instructions that when executed by the at least one processor, cause the at least one processor to:
encrypt messages using a first working cryptogram generated based on a first master key of hardware security modules (HSMs), wherein the HSMs are initially configured to decrypt the encrypted messages using the first working cryptogram;
communicate the encrypted messages to the HSMs via a URI (uniform resource indicator) mapped to a first resource identifier;
receive a second working cryptogram being generated based on a second master key replacing the first master key on a subset of the HSMs and a second resource identifier;
map the URI to the second resource identifier;
encrypt subsequent messages using the second working cryptogram;
and
communicate the subsequent encrypted messages to the HSMs via the URI mapped to the second resource identifier, wherein a subset of the HSMs is reconfigured to decrypt the subsequent messages encrypted by the second working cryptogram while a remaining subset of the HSMs continues to decrypt the encrypted messages encrypted using the first working cryptogram, wherein the subset of the HSMs comprises at least one HSM of the HSMs and the remaining subset of the HSMs comprises at least one different HSM of the HSMs, the subset of the HSMs and the remaining subset of the HSMs being concurrently employed.

7 more elements

One or more computer storage media storing computer-useable instructions that, when used by one or more computing devices, cause the one or more computing devices to perform operations for encrypting messages, the operations comprising:

encrypting messages using a first working cryptogram generated based on a first master key of hardware security modules (HSMs), wherein the HSMs are initially configured to decrypt the encrypted messages using the first working cryptogram;
communicating the encrypted messages to the HSMs via a URI (uniform resource indicator) mapped to a first resource identifier;
receiving a second working cryptogram being generated based on a second master key replacing the first master key on a subset of the HSMs and a second resource identifier;
map the URI to the second resource identifier;
encrypting subsequent messages using the second working cryptogram;
and
communicating the subsequent encrypted messages to the HSMs via the URI mapped to the second resource identifier, wherein a subset of the HSMs is reconfigured to decrypt the subsequent messages encrypted by the second working cryptogram while a remaining subset of the HSMs continues to decrypt the encrypted messages encrypted using the first working cryptogram, wherein the subset of the HSMs comprises at least one HSM of the HSMs and the remaining subset of the HSMs comprises at least one different HSM of the HSMs, the subset of the HSMs and the remaining subset of the HSMs being concurrently employed.

4 more elements

A computer-implemented method performed by one or more computer processors, the method comprising:

encrypting messages using a first working cryptogram generated based on a first master key of hardware security modules (HSMs), wherein the HSMs are initially configured to decrypt the encrypted messages using the first working cryptogram;
communicating the encrypted messages to the HSMs via a URI (uniform resource indicator) mapped to a first resource identifier;
receiving a second working cryptogram being generated based on a second master key replacing the first master key on a subset of the HSMs and a second resource identifier;
map the URI to the second resource identifier;
encrypting subsequent messages using the second working cryptogram;
and
communicating the subsequent encrypted messages to the HSMs via the URI mapped to the second resource identifier, wherein a subset of the HSMs is reconfigured to decrypt the subsequent messages encrypted by the second working cryptogram while a remaining subset of the HSMs continues to decrypt the encrypted messages encrypted using the first working cryptogram, wherein the subset of the HSMs comprises at least one HSM of the HSMs and the remaining subset of the HSMs comprises at least one different HSM of the HSMs, the subset of the HSMs and the remaining subset of the HSMs being concurrently employed.

4 more elements

Dependencies are inferred from the claim text.

Mitigating service disruptions in key maintenance

Life of this patent

Mitigating service disruptions in key maintenance

Life of this patent

Abstract

Claims20