US 12,003,655 B1Granted

Cryptographic assertions for certificate issuance

AssigneeAmazon Technologies, Inc.

InventorsMichael S. Slaughter, Trevoli Ponds-White, James Darrin Flanagan, Georgy Sebastian

Life of this patent

Estimating the term…

Loading patent…

Abstract

Components of a public certificate authority (CA) generate respective cryptographic assertions during performance of respective tasks of a certificate issuance workflow and a workflow approval component approves/rejects certificate issuance, based upon verification of the cryptographic assertions. For example, a workflow manager may assign tasks of a certificate workflow process to a number of components that process the tasks. The components generate responses and sign the respective responses with keys particular to each component. The workflow manager gathers the cryptographic assertions and sends them to a workflow approval component that validates the assertions, verifies the assertions indicate successful completion of the workflow and approves or rejects certificate issuance.

Claims20

Dependent claims

A system, comprising:

a plurality of computers comprising respective processors and memory and configured to implement a certificate authority comprising:
a plurality of components configured to perform a plurality of tasks of a certificate issuance workflow;
a workflow manager configured to coordinate performance of the plurality of tasks among the plurality of components to perform the certificate issuance workflow;
and
a certificate issuance workflow approval component configured to verify successful completion of the certificate issuance workflow;
wherein individual components of the plurality of components are configured to:
perform one or more tasks of the plurality of tasks;
generate a cryptographic assertion for a result of performing the one or more tasks;
and
return the cryptographic assertion to the workflow manager;
wherein the workflow manager is configured to:
collect the cryptographic assertions from the plurality of components;
and
send a request to a workflow approval component to approve completion of the certificate issuance workflow, wherein the request includes a collection of the cryptographic assertions from the plurality of components for the certificate issuance workflow;
and
wherein the workflow approval component is configured to:
validate the cryptographic assertions from the plurality of components using different cryptographic keys for respective components of the plurality of components;
and
verify that the validated cryptographic assertions indicate successful completion of the certificate issuance workflow;
and
wherein the certificate authority is configured to issue a certificate based on verification by the workflow approval component that the certificate issuance workflow was successfully completed.

18 more elements

One or more non-transitory computer-readable media storing program instructions that when executed on or across one or more processors cause the one or more processors to perform:

receiving by a workflow approval component, a request to approve completion of a certificate issuance workflow, wherein the request comprises a set of cryptographic assertions obtained from a plurality of components configured to perform a plurality of tasks of the certificate issuance workflow, the;
determining by the workflow approval component and based on the set of cryptographic assertions, whether the certificate issuance workflow was correctly completed, wherein said determining comprises:
validating individual ones of the set of cryptographic assertions from the plurality of components using different cryptographic keys for respective components of the plurality of components;
and
verifying that the validated cryptographic assertions indicate successful completion of the certificate issuance workflow;
and
sending, for a determination of a correctly-performed certificate issuance workflow, an indication that issuance of the certificate is approved.

4 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/544,767Filed 7 Dec 2021
Granted: 4 Jun 2024
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 9/321
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…:…
H04L 9/3268
Involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements: using…
H04L 9/14
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: using a plurality of keys…
H04L 9/3247
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…:…

Family

No related US applications are recorded in the indexed filing history.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key