Virtual cryptographic module with load balancer and cryptographic module fleet
AssigneeAmazon Technologies, Inc.
InventorSteven Preston Lightner Norum
Life of this patent
Estimating the term…
Abstract
A virtual cryptographic module is used to perform cryptographic operations. The virtual cryptographic module may include a fleet of cryptographic modules and a load balancer that determines when a cryptographic module should be added to or removed from the fleet. The fleet size may be adjusted based on detecting a set of conditions that includes the utilization level of the fleet. One or more cryptographic modules of the fleet may be used to fulfill requests to perform cryptographic operations. A cryptographic module may be a hardware security module (“HSM”).
Claims20
A computer-implemented method, comprising:
- determining, in response to a request from a client computing device to establish a communications session with a virtual cryptographic device backed by a plurality of physical cryptographic devices, a first physical cryptographic device from the plurality of physical cryptographic devices to communicate over the communications session;
- establishing the communications session by performing handshake operations, thereby allowing the first physical cryptographic device to provide information associated with the communications session to a second physical cryptographic device of the plurality of physical cryptographic devices, the information including a session key;
- receiving, by the virtual cryptographic device, one or more messages over the communications session;
- and
- routing the one or more messages to the first physical cryptographic device and the second physical cryptographic device over the communications session.
A system, comprising:
- one or more processors;
- and
- memory storing executable instructions that, as a result of being executed, cause the system to:
- receive a request to establish a communications session between a client and a virtual cryptographic device, the virtual cryptographic device supported by a set of cryptographic devices and a load balancer;
- cause a first cryptographic device of the set of cryptographic devices to provide a session key associated with the communications session to a second cryptographic device of the set of cryptographic devices, the first cryptographic device and the second cryptographic device determined by the load balancer;
- and
- as a result of the first cryptographic device and the second cryptographic device obtaining the session key, route one or more messages received by the virtual cryptographic device to the first cryptographic device and the second cryptographic device.
A non-transitory computer-readable storage medium storing executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to at least:
- establish a communication session between a client and a virtual cryptographic device backed by a set of physical security devices, the communications session provided by at least:
- determining a subset of the set of physical security devices;
- in response to determining the subset of the set of physical security devices, routing session information obtained from the client to a physical security device of the subset of the set of physical security devices to establish the communications session;
- and
- providing, by the physical security device, the session information to the subset of the set of physical security devices;
- receive a plurality of messages by the virtual cryptographic device;
- and
- distribute the plurality of messages over the communications session among the subset of the set of physical security devices that share the session information.
Dependencies are inferred from the claim text.