Enclave-based cryptography services in edge computing environments
AssigneeAmazon Technologies, Inc.
InventorPeter Buonora
Life of this patent
Estimating the term…
Abstract
Systems and methods for providing cryptographic services. A cryptography service obtains a request to provision a computing device to perform cryptographic operations. The cryptography service generates executable code for a protected execution environment. The computing device obtains and executes the executable code. The computing device fulfills requests for cryptographic operations in the protected execution environment.
Claims20
A computer-implemented method, comprising:
- obtaining, at a cryptography service, a first request to provision a computing device to perform one or more cryptographic operations, the first request including an indication of a set of cryptographic keys to be supported, wherein access to a cryptographic key of the set of cryptographic keys is restricted to a protected execution environment of the computing device;
- generating executable code based at least in part on the set of cryptographic keys;
- providing the executable code to the computing device;
- executing, at the computing device, the executable code to obtain a second request by a client;
- based on the second request, performing at least one cryptographic operation of the one or more cryptographic operations using the cryptographic key within the protected execution environment;
- and
- providing a result of the cryptographic operation to the client.
A system, comprising:
- one or more processors;
- and
- memory that stores computer-executable instructions that are executable by the one or more processors to cause the system to:
- obtain a request to provision a protected execution environment of a device, the request indicating a cryptographic key to be supported by the device;
- generate a service executable code based at least in part on the cryptographic key, wherein the service executable code, as a result of being executed by the device, is to cause the device to provision the protected execution environment for processing cryptographic requests using the cryptographic key;
- provide the service executable code to the device;
- execute the service executable code to obtain a cryptographic request associated with at least one computing device;
- based on the cryptographic request, perform one cryptographic operation using the cryptographic key within the protected execution environment;
- and
- provide a result of the cryptographic operation, the result obtainable by the at least one computing device.
A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to:
- obtain a request to provision a protected execution environment of a device, the request indicating a cryptographic key to be supported by the device;
- generate a service executable code based at least in part on the cryptographic key, wherein the service executable code, as a result of being executed by the device, is to cause the device to provision the protected execution environment for processing cryptographic requests using the cryptographic key;
- provide the service executable code to the device;
- execute the service executable code to obtain a cryptographic request associated with at least one computing device;
- based on the cryptographic request, perform one cryptographic operation using the cryptographic key;
- and
- provide a result of the cryptographic operation, the result obtainable by the at least one computing device.
Dependencies are inferred from the claim text.