US 2014/0229737 A1Published application

Federated key management

AssigneeAmazon Technologies, Inc.

InventorsGregory Branchek Roth, Matthew James Wren, Eric Jason Brandwine, Brian Irl Pratt

Life of this patent

Estimating the term…

Loading patent…

Abstract

A system uses information submitted in connection with a request to determine if and how to process the request. The information may be electronically signed by a requestor using a key such that the system processing the request can verify that the requestor has the key and that the information is authentic. The information may include information that identifies a holder of a key needed for processing the request, where the holder of the key can be the system or another, possibly third party, system. Requests to decrypt data may be processed to ensure that a certain amount of time passes before access to the decrypted data is provided, thereby providing an opportunity to cancel such requests and/or otherwise mitigate potential security breaches.

Claims25

Dependent claims

A computer-implemented method, comprising:

under the control of one or more computer systems configured with executable instructions,
receiving, from a requestor, a request to perform a cryptographic operation, the request including information and an electronic signature generated based at least in part on a portion of the information, the electronic signature verifiable with a first key of a set of one or more keys corresponding to a second key;
detecting whether the request specifies a key holder of a plurality of key holders;
as a result of detecting that the request specifies a particular key holder of the plurality of key holders, causing the particular key holder to at least:
determine, based at least in part on the information and the first key, whether the electronic signature is valid;
determine, based at least in part on the information, whether the information satisfies one or more conditions for fulfilling the request;
as a result of the particular key holder determining that the electronic signature is valid and that the information satisfies the one or more conditions, obtaining, from the particular key holder, response information necessary for fulfilling the request, the response information having been generated based at least in part on one or more cryptographic operations performed using the second key;
and
using the obtained response information to provide, to the requestor, a response to the request.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 13/765,209Filed 12 Feb 2013
Published: 14 Aug 2014
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 9/088
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: usage controlling of secret information,…
H04L 9/0891
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: revocation or update of secret…
H04L 9/14
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: using a plurality of keys…
H04L 9/321
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…:…