Mutual authentication with symmetric secrets and signatures
AssigneeAmazon Technologies, Inc.
InventorsGregory Branchek Roth, Gregory Alan Rubin
Life of this patent
Estimating the term…
Abstract
A client and server negotiate a secure communication channel using a pre-shared key where the server, at the time the negotiation initiates, lacks access to the pre-shared key. The server obtains the pre-shared key from another server that shares a secret with the client. A digital signature or other authentication information generated by the client may be used to enable the other server to determine whether to provide the pre-shared key.
Claims20
A computer-implemented method, comprising:
- receiving, from a client computer system and in accordance with a communication protocol for establishing a secure communication channel, a message and a digital signature, the message specifying a set of key derivation parameters, the communication protocol comprising a handshake protocol;
- transmitting the message and the digital signature to an authentication server configured to verify authenticity of the message based at least in part on the digital signature and contingent on successful verification of the authenticity of the message, derive a pre-shared cryptographic key that is available to the client computer system and to provide the pre-shared cryptographic key;
- if the pre-shared cryptographic key is received from the authentication server, using
- the pre-shared cryptographic key to establish, as part of the handshake protocol, the secure communication channel with the client computer system to result in an established secure communication channel;
- and
- if the authentication server fails to provide the pre-shared cryptographic key from the authentication server, operate in accordance with the digital signature being unverified.
A system, comprising a set of computing devices configured to implement at least:
- a first server that negotiates, in accordance with a handshake protocol, a secure communication channel with a client computer system by executing executable code that causes the first server to:
- provide a message and a digital signature received from a client computer system to a second server;
- if the digital signature matches the message:
- receive, from the second server, a pre-shared key accessible to the client computer system;
- and
- use the pre-shared key to transmit encrypted messages to the client computer system to communicate over the secure communication channel;
- and
- if the digital signature fails to match the message, operate in accordance with the digital signature being unverified.
A non-transitory computer-readable storage medium having stored thereon instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to implement a first server that:
- negotiates, in accordance with a handshake protocol, a secure communication channel with a client computer system by at least:
- providing a message and a digital signature received from a client computer system to a second server;
- if the digital signature matches the message:
- receiving, from the second server, a pre-shared key accessible to the client computer system;
- and
- using the pre-shared key to transmit encrypted messages to the client computer system to communicate over the secure communication channel;
- and
- if the digital signature fails to match the message, operating in accordance with the digital signature being unverified.
Dependencies are inferred from the claim text.