Unified management of cryptographic keys using virtual keys and referrals

• US 10,250,382 B2
• Filed: 02/05/2018
• Issued: 04/02/2019
• Est. Priority Date: 09/26/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory Branchek
• Primary Examiner(s): Getachew, Abiy
• Application Number:
  US15/888,765
• Publication Number:
  US 20180159684A1
• Time in Patent Office: 421 Days
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

A cryptography service allows for management of cryptographic keys in multiple environments. The service allows for specification of policies applicable to cryptographic keys, such as what cryptographic algorithms should be used in which contexts. The cryptography service, upon receiving a request for a key, may provide a referral to another system to obtain the key.

Claims

1. A system comprising memory to store executable instructions that, as a result of execution by one or more processors, cause the system to:

receive, from a client, a request to perform an operation using a cryptographic key, the request specifying a key identifier;

select, based at least in part on the key identifier, a key from a set of keys managed for an entity associated with the client, the set of keys including a subset of virtual keys, the subset of virtual keys being associated with a set of cryptographic keys that is stored in another computing device; and

provide, based at least in part on the key being a member of the subset of virtual keys, a cryptographic configuration and a reference to the computing device, the reference including information usable to cause the other computing device to perform the operation using the cryptographic key.

2. The system of claim 1, wherein the executable instructions, as a result of execution by the one or more processors, further cause the system to:

receive an application programming interface request to add a second key to the subset of virtual keys; and

fulfill the application programming interface request by at least associating an identifier for the second key with a second reference to the computing device.

3. The system of claim 1, wherein:

the request for the cryptographic key indicates one or more capabilities of the client; and

the executable instructions, as a result of execution by the one or more processors, further cause the system to select the cryptographic configuration to match the one or more capabilities of the client.

4. The system of claim 1, wherein the reference comprises information usable by the client to determine credentials usable to cause the computing device to provide the cryptographic key.

5. The system of claim 1, wherein the request is to obtain the cryptographic key and the operation using the cryptographic key is to obtain the cryptographic key.

6. A computer-implemented method, comprising:

receiving, at a computer system, a request to perform an operation, the request indicating a key identifier;

determining the key identifier is associated with a key of a set of cryptographic keys that is stored in another computer system; and

providing a response to the request that enables submission of a second request to perform the operation using the key.

7. The computer-implemented method of claim 6, wherein the request comprises:

a network location of the other computing system; and

configuration information indicating a format for the submission of the second request.

8. The computer-implemented method of claim 6, wherein a first subset of the set of cryptographic keys is accessible to the computing system and a second subset of the set of cryptographic keys is inaccessible to the computing system and managed by the other computing system, the second subset comprising the key.

9. The computer-implemented method of claim 6, wherein:

the request for the key comprises an encryption context; and

the method further comprises;

determining, based at least in part on the encryption context, a plugin usable to submit the second request; and

providing the plugin as part of the response.

10. The computer-implemented method of claim 9, wherein:

the encryption context indicates a set of supported encryption algorithms; and

determining the plugin comprises;

determining the set of supported encryption algorithms is inoperable to communicate with the other computing system; and

determining the plugin supports an encryption algorithm usable to submit the second request.

11. The computer-implemented method of claim 6, wherein the other computing system is a security module.

12. The computer-implemented method of claim 6, wherein:

the request is received from a requestor and indicates one or more capabilities of the requestor; and

the response comprises a cryptographic algorithm selected based at least in part on the one or more capabilities.

13. The computer-implemented method of claim 12, wherein the cryptographic algorithm is selected based at least in part on a ranking of cryptographic algorithms that is associated with the key identifier.

14. A non-transitory computer-readable storage medium to store executable instructions that, if executed by one or more processors of a computer system, cause the computer system to at least:

receive, from a first computing device, a response to a first request, the first request indicating a key identifier;

determine that the response indicates a referral to a second computing device; and

transmit a second request to the second computing device to perform an operation using a cryptographic key associated with the key identifier.

15. The non-transitory computer-readable storage medium of claim 14, wherein the executable instructions further include instructions that, if executed, cause the computer system to:

receive, from the first computing device, another response to a third request specifying another key identifier;

determine that the other response includes another key; and

use the other key to encrypt data.

16. The non-transitory computer-readable storage medium of claim 14, wherein the executable instructions further include instructions that, if executed, cause the computer system to:

receive, from the first computing device, another response to a third request indicating another key identifier;

determine that the other response includes another key and an encrypted data key encrypted under a cryptographic key identified by the other key identifier;

encrypt data to produce encrypted data; and

associate the encrypted data with the encrypted data key.

17. The non-transitory computer-readable storage medium of claim 14, wherein the second computing device is accessible over a private network that includes the computer system.

18. The non-transitory computer-readable storage medium of claim 14, wherein the second computing device is a hardware security module.

19. The non-transitory computer-readable storage medium of claim 14, wherein:

the response indicates a cryptographic algorithm; and

as a result of the response indicating the cryptographic algorithm, the executable instructions further include executable instructions that, if executed, cause the computer system to encrypt data using the key and the cryptographic algorithm.

20. The non-transitory computer-readable storage medium of claim 14, wherein:

the response further includes information sufficient to determine credentials for obtaining the key from the second computing device; and

the executable instructions further include executable instructions that, if executed, cause the computer system to;

determine the credentials based at least in part on the information; and

obtain, based at least in part on the credentials, the key from the second computing device.