Back to results
US 9,806,887 B1Granted
Authenticating nonces prior to encrypting and decrypting cryptographic keys
AssigneeAmazon Technologies, Inc.
InventorMatthew John Campagna
Life of this patent
Estimating the term…
Abstract
Data security is enhanced by computing an authentication tag based at least in part on encrypted data and additional authenticated data that includes at least a nonce. The computed authentication tag is compared against a provided authentication tag. The encrypted data is decrypted and made available for use.
Claims21
A computer-implemented method, comprising:
- receiving a web service request through a request application programming interface wherein the web service request identifies an encrypted data key, additional authenticated data, and a first authentication tag, where the first authentication tag is cryptographically derived from the encrypted data key and the additional authenticated data, and where the additional authenticated data includes at least a nonce;
- obtaining a data key by decrypting the encrypted data key using a master key and the nonce;
- authenticating the nonce by at least:
- computing a second authentication tag, where the computing of the second authentication tag is based at least in part on the encrypted data key and the nonce;
- comparing the first authentication tag and the second authentication tag;
- detecting the first authentication tag and second authentication tag match;
- and
- making the obtained data key and the authenticated nonce available for use.
5 more elements
A system, comprising:
- at least one computing device including a processor and a memory that implements one or more services, wherein the one or more services:
- receive a web service request through a request application programming interface, where the web service request identifies an encrypted data key, an authentication tag, and additional authenticated data that includes at least a nonce, where the authentication tag is cryptographically derived from the encrypted data key and the additional authenticated data;
- decrypt the encrypted data key by at least using a cryptographic key and the nonce, thereby obtaining a plaintext data key;
- determine that the nonce is authentic by comparing the authentication tag to a second authentication tag computed based at least in part on the encrypted data key and the nonce;
- and
- provide the plaintext data key and the nonce for input into a decryption algorithm to decrypt data.
3 more elements
A non-transitory computer-readable storage medium having stored thereon executable instructions that, if executed by one or more processors of a computer system, cause the computer system to at least:
- obtain a plaintext data key, an encrypted data key, additional authenticated data that includes at least a nonce, and the nonce, wherein both the additional authenticated data and the encrypted data key are based at least in part on the nonce and the encrypted data key is generated using the plaintext data key and the nonce;
- input data, the plaintext data key, and the nonce into a web service request through a request application programming interface to generate:
- a ciphertext;
- and
- an authentication tag that is cryptographically derived from the encrypted data key and the additional authenticated data;
- and
- cause the generated the ciphertext, the nonce, the authentication tag, and the encrypted data key to be stored in association with one another.
4 more elements
Dependencies are inferred from the claim text.