Parameter based key derivation

A computer-implemented method for providing access to one or more computing resources of a computing resource provider, the one or more computing resources of the computing resource provider being part of a logical grouping of computing resources in a key zone of a plurality of key zones, the method comprising:

• under the control of one or more computer systems configured with executable instructions,
• obtaining electronic information encoding (i) a message, (ii) a first signature for the message, and (iii) a set of one or more parameters, the first signature having been generated based at least in part on (i) the message, (ii) a secret credential, and (iii) the set of one or more parameters, the first signature further being undeterminable having only the message and the secret credential but without the set of one or more parameters;
• deriving a second credential based at least in part on the secret credential and at least a subset of the set of one or more parameters, the second credential being obtained from a central key authority and being associated with the key zone;
• generating, based at least in part on the derived second credential, a second signature;
• determining whether the first signature matches the second signature;
• and
• providing access to the one or more computing resources when the generated second signature matches the first signature.

A non-transitory computer-readable storage medium having stored thereon instructions that, when executed by a computer system, cause the computer system to at least:

• obtain an intermediate key that is derived from at least a secret credential and one or more parameters for use of the intermediate key, the secret credential being obtained from a central key authority and corresponding to a grouping of computing resources in a key zone of a plurality of key zones;
• apply, based at least in part on the obtained intermediate key, at least a portion of a signature generation process that results in a signature for a message, the signature generation process configured such that the signature is undeterminable, by the signature generation process, to a computing device having the message, the secret credential, and the signature but lacking the one or more restrictions;
• and
• provide the message, the signature, and the one or more parameters to another computer system for access to at least a portion of the computing resources, the providing enabling analysis, based at least in part on the one or more parameters and the message, of the signature to determine whether the signature is valid.

A computer system, comprising:

• one or more processors;
• and
• memory including instructions that, when executed by the one or more processors of the computer system, cause the computer system to at least:
• receive one or more electronic communications that collectively encode a message, a signature for the message, and one or more parameters, the signature being generated based at least in part on a secret credential and the one or more parameters;
• analyze, based at least in part on the one or more parameters, an intermediate credential derived from at least a portion of the one or more parameters and the secret credential, the message and signature to determine whether the signature is valid, the secret credential being obtained from a central key authority and corresponding to one or more computing resources of a key zone of a plurality of key zones;
• and
• take one or more actions contingent on determining that the signature is valid.