Inaccessibility of data to server involved in secure communication
AssigneeAmazon Technologies, Inc.
InventorsJesper Mikael Johansson, Darren Ernest Canavor, Jon Arron McClintock, Gregory Branchek Roth, Gregory Alan Rubin, Nima Sharifi Mehr
Life of this patent
Estimating the term…
Abstract
A client negotiates multiple cryptographic keys with a server. One of the cryptographic keys is used to encrypt communications that the server can decrypt. Another of the cryptographic keys is used to encrypt communications that, while sent to the server, are not decryptable to the server. The server is configured to forward communications that it is unable to decrypt to another computer system having an ability to decrypt the communications.
Claims21
A computer-implemented method, comprising:
- performing, at a frontend server computer system, a handshake process to establish a secure communications channel with a client computer system, the handshake process including:
- providing, to the client computer system:
- a first digital certificate specifying a first public cryptographic key that corresponds to a first private cryptographic key accessible to a frontend server computer system;
- and
- a second digital certificate specifying a second public cryptographic key that corresponds to a second private cryptographic key that is accessible to a backend server computer system but inaccessible to the frontend server computer system;
- receiving, from the client computer system, an encrypted first secret;
- decrypting, using the first private cryptographic key, the encrypted first secret;
- receiving, from the client computer system, an encrypted second secret;
- and
- forwarding the encrypted second secret to the backend server computer system without decrypting the encrypted second secret using the first private cryptographic key;
- as a result of determining that a first set of records received from the client computer system is encrypted using the first secret, using the first secret to decrypt the first set of records;
- and
- as a result of determining that a second set of records received from the client computer system is encrypted using the second secret, forwarding records of the second set of records to the backend server computer system.
A system, comprising at least one computing device that implements one or more services to at least:
- determine a first secret usable to decrypt communications from a first computer system;
- provide, to the first computer system, a public cryptographic key corresponding to a private cryptographic key that is inaccessible to the one or more services;
- receive an encrypted communication from the first computer system;
- determine whether the encrypted communication is encrypted using the first secret or a second secret that is inaccessible to the one or more services as a result of corresponding to the private cryptographic key;
- based at least in part on an outcome of determining whether the encrypted communication is encrypted using the first secret or the second secret, select an operation from a set of operations that includes at least using the first secret to decrypt the communication;
- and
- providing the received encrypted communication to a second system having access to the second secret;
- and
- perform the selected operation.
A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:
- establish a connection with a first computer system;
- determine a set of encryption keys that includes a first encryption key and a second encryption key, the first encryption key corresponding to a first private key accessible to the first computer system, the second encryption key corresponding to a second private key accessible to a second computer system but inaccessible to the first computer system;
- determine whether communications for transmission over the established connection correspond to the first computer system or the second computer system;
- based at least in part on determining whether the communications correspond to the first computer system or the second computer system, selectively encrypt communications for transmission over the established connection such that:
- communications corresponding to the first computer system are encrypted with the first encryption key, without being encrypted by the second encryption key, to enable the first computer system to decrypt the communications for the first computer system and operate in accordance with the decrypted communications without participation by the second computer system;
- and
- communications corresponding to the second computer system are encrypted with the second encryption key to render the communications undecryptable by the first computer system and enable the second computer system to decrypt the communications;
- and
- transmit the selectively encrypted communications over the established connection.
Dependencies are inferred from the claim text.