Signing key log management

• US 10,015,018 B2
• Filed: 07/21/2017
• Issued: 07/03/2018
• Est. Priority Date: 09/14/2015
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Rubin, Gregory Alan, Roth, Gregory Branchek
• Primary Examiner(s): Wang, Harris C
• Application Number:
  US15/656,805
• Publication Number:
  US 20170346638A1
• Time in Patent Office: 347 Days
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/72 Signcrypting, i.e. digital signing and encrypting simultaneously
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Cryptographic keys can include logging properties that enable those keys to be used only if the properties can be enforced by the cryptographic system requested to perform one or more actions using the keys. The logging property can specify how to log use of a respective key. A key can also include a mutability property for specifying whether the logging property can be changed, and if so under what circumstances or in which way(s). The ability to specify and automatically enforce logging can be important for environments where audit logs are essential. These can include, for example, public certificate authorities that must provide accurate and complete audit trails. In cases where the data is not to be provided outside a determined secure environment, the key can be generated with a property indicating not to log any of the usage.

Claims

1. A system, comprising:

at least one processor; and

memory including instructions that, when executed by the at least one processor, cause the system to;

receive a first request to generate a cryptographic key;

generate the cryptographic key, the cryptographic key including private parameters for a cryptographic signing function and metadata specifying a logging value and a mutability value, the logging value specifying a type of logging to be performed for signing actions of the cryptographic key, the mutability value specifying how the logging value is changeable over a lifecycle of the cryptographic key;

determine the logging value of the cryptographic key;

determine that the type of logging specified by the logging value, as changeable per the mutability value, is able to be enforced by the system;

sign the data using the cryptographic key; and

perform the type of logging specified by the logging value for signing the data.

2. The system of claim 1, wherein the instructions when executed further cause the system to perform the type of logging by:

writing, to an audit log and in response to the logging value indicating to always log use data, the information about the signing, including at least one of the data or a transformation of the data; and

writing, to the audit log, at most information about the signing without any of the data of the message in response to the logging value indicating to never log data signed with the cryptographic key.

3. The system of claim 1, wherein the instructions when executed further cause the system to:

authenticate an identity of a user associated with the first request;

receive a request to modify the logging value of the cryptographic key;

modify the logging value in response to the mutability value enabling the logging value to be modified and an identity of a user associated with the request is authenticated; and

deny the request in response to the mutability value indicating that the logging value is unable to be modified.

4. The system of claim 3, wherein the instructions when executed further cause the system to:

generate a set of public verification parameters for a second cryptographic key; and

provide the user with access to the set of public verification parameters.

5. A computer-implemented method, comprising:

receiving a request to perform a signing action utilizing a cryptographic key;

determining a logging value of the cryptographic key, the logging value specifying a type of logging to be performed for signing actions of the cryptographic key;

determining a mutability value of the cryptographic key, the mutability value specifying how the logging value is changeable over a lifecycle of the cryptographic key;

determining that the type of logging specified by the logging value is able to be enforced by the system;

performing the signing action using the cryptographic key; and

performing the type of logging specified by the logging value for the signing action.

6. The computer-implemented method of claim 5, further comprising:

receiving a second request to perform a second signing action utilizing the cryptographic key;

determining the logging value of the cryptographic key;

determining that the type of logging specified by the logging value is unable to be enforced by the system; and

denying the second request.

7. The computer-implemented method of claim 5, wherein performing the signing action includes signing one of (i) data for the request, (ii) a message including the data, (iii) a function of the data, (iv) a hash of the data, or (v) a digest of the data.

8. The computer-implemented method of claim 5, wherein performing the type of logging includes logging usage of the key and one of the request, a transformation of the request, or no portion of the request.

9. The computer-implemented method of claim 5, further comprising:

authenticating an identity associated with the request; and

verifying the identity is authorized to cause the signing action to be performed before performing the signing action.

10. The computer-implemented method of claim 5, further comprising:

receiving a request to modify the logging value of the cryptographic key; and

modifying the logging value if the mutability value enables the logging value to be modified, the logging value modifiable only in a way specified by the mutability value.

11. The computer-implemented method of claim 5, further comprising:

determining conditions for modifying the logging value of the cryptographic key;

receiving a request to modify the logging value of the cryptographic key;

determining that the request to modify the logging value of the cryptographic key does not satisfy the conditions; and

denying the request to modify the logging value of the cryptographic key.

12. The computer-implemented method of claim 5, wherein the signing action includes providing a message signature, the method further comprising:

generating a hash of at least a portion of the message received with the request; and

signing the hash using the cryptographic key.

13. The computer-implemented method of claim 5, wherein the signing action includes providing a message signature, the method further comprising:

receiving, with the request, a hash of at least a portion of a message; and

signing the hash using the cryptographic key.

14. The computer-implemented method of claim 5, further comprising:

specifying a direction in which modifications to the logging value are permitted, the direction indicating more logging or less logging;

receiving a request to modify the logging value;

determining that the request to modify the logging value comprises a request to modify the logging value in the direction in which modifications to the logging value are permitted; and

modifying the logging value according to the request to modify the logging value.

15. A computer-implemented method, comprising:

receiving a request to generate a cryptographic key, the request associated with a user and indicating a type of logging to be performed for use of the cryptographic key;

authenticating an identity of the user;

generating the cryptographic key, the cryptographic key including metadata specifying a logging value and a mutability value, the logging value specifying the type of logging to be performed for signing actions of the cryptographic key, the mutability value specifying how the logging value is changeable over a lifecycle of the cryptographic key;

determining whether the type of logging specified by the logging value is able to be enforced by the system; and

providing the user with access to the cryptographic key.

16. The computer-implemented method of claim 15, further comprising:

receiving a signing request to perform a signing action utilizing the cryptographic key;

determining the logging value of the cryptographic key;

determining that the type of logging specified by the logging value is able to be enforced by a cryptographic system receiving the request;

performing the type of logging specified by the logging value for the signing action;

performing the signing action using the cryptographic key; and

returning signed data for the signing action.

17. The computer-implemented method of claim 15, wherein the signing request is a certificate signing request.

18. The computer-implemented method of claim 15, further comprising:

receiving a second request to perform a second signing action utilizing the cryptographic key;

determining the logging value of the cryptographic key;

determining that the type of logging specified by the logging value is unable to be enforced by the system; and

denying the second request.

19. The computer-implemented method of claim 15, further comprising:

receiving a second request to modify the logging value of the cryptographic key;

determining a mutability value of the cryptographic key; and

modifying the logging value if the mutability value enables the logging value to be modified.

20. The computer-implemented method of claim 19, further comprising:

enabling the logging value to be modified only in a way specified by the mutability value.