Cryptographic key management to prevent data exfiltration
AssigneeAmazon Technologies, Inc.
InventorsAlexis Lynn Carlough, William Frederick Hingle Kruse
Life of this patent
Estimating the term…
Abstract
A cryptographic key management service receives a request, associated with a principal, to use a cryptographic key to perform a cryptographic operation. In response to the request, the service determines whether a rate limit specific to the principal is associated with the cryptographic key. If the rate limit is associated with the cryptographic key, the service generates a response to the request that conforms to the rate limit. The service provides the response in response to the request.
Claims20
A computer-implemented method, comprising:
- obtaining, from a client device associated with a principal of a customer of a computing resource service provider, a request to utilize a cryptographic key to perform a cryptographic operation;
- providing a challenge to the client device;
- obtaining, as a result of an input from the principal being obtained by the client device, a challenge response to the challenge;
- determining whether the challenge response is valid;
- as a result of a determination that the challenge response is valid and that the request complies with a usage rate limitation associated with the cryptographic key, performing the cryptographic operation;
- and
- providing a response to the request.
A system, comprising:
- one or more processors;
- and
- memory including instructions that, as a result of being executed by the one or more processors, cause the system to:
- obtain a first request to use a cryptographic key to perform a first cryptographic operation, the first request from a client device that is associated with a principal of a customer of a computing resource service provider;
- provide a first challenge to the client device;
- obtaining, as a result of an input from the principal being obtained by the client device, a first challenge response;
- determine whether the first challenge response is valid;
- as a result of a determination that the first challenge response is valid and that the request complies with a usage rate limitation associated with the cryptographic key, performing the first cryptographic operation;
- and
- provide a response to the first request.
A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
- obtain a request to use a cryptographic key to perform a cryptographic operation, the request from a client device that is associated with a principal of a customer of a computing resource service provider;
- provide a challenge to the client device;
- obtain, as a result of an input from the principal being obtained by the client device, a challenge response;
- determine whether the challenge response is valid;
- as a result of a determination that the challenge response is valid, performing the cryptographic operation and that the request complies with a usage rate limitation associated with the cryptographic key;
- and
- provide a response to the request.
Dependencies are inferred from the claim text.