Data access control utilizing key restriction

• US 10,356,062 B2
• Filed: 11/11/2015
• Issued: 07/16/2019
• Est. Priority Date: 03/27/2012
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory B., Barbour, Marc R., Behm, Bradley Jeffrey, Ilac, Cristian M., Brandwine, Eric Jason
• Primary Examiner(s): Wright, Bryan F
• Application Number:
  US14/938,403
• Publication Number:
  US 20160065549A1
• Time in Patent Office: 1,343 Days
• Field of Search: 713170
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/0836 using tree structure or hierarchical structure
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A plurality of keys is obtained, with each obtained key of the plurality of keys being based at least in part on an information set for the plurality of keys and at least one other key distinct from the plurality of keys. A signing key is calculated by inputting a combination of the plurality of keys into a function with the information set for the plurality of keys, and the signing key is used to evaluate whether access to one or more computing resources is to be granted, with the information set preventing access from being granted when a request for the access is submitted out of compliance with the information set for the plurality of keys.

Claims

1. A computer-implemented method, comprising:

obtaining a set of key-use restriction information that includes first key-use restriction information and second key-use restriction information, the second key-use restriction information being different from the first key-use restriction information, each of the set of key-use restriction information being associated with a restriction on use of one or more computing resources;

the first key-use restriction information and a first key into a function to produce a second key;

inputting the second key-use restriction information and the second key into the function to produce a signing key; and

using the signing key to evaluate whether access to the one or more computing resources is to be granted, the set of key-use restriction information for each key of a plurality of keys preventing the access from being granted as a result of a request for the access being submitted out of compliance with the set of key-use restriction information for the signing key.

2. The computer-implemented method of claim 1, wherein the function is a cryptographic function.

3. The computer-implemented method of claim 1, wherein using the signing key further includes generating, based at least in part on the signing key, a reference signature for a message submitted in connection with a message signature.

4. The computer-implemented method of claim 3, wherein the set of key-use restriction information for each of the plurality of keys corresponds to at least one of date, region, zone, service, protocol, device, device model, or device manufacturer.

5. The computer-implemented method of claim 3, wherein the combination of the plurality of keys comprises an output of a commutative function with an operand corresponding to each of the plurality of keys.

6. The computer-implemented method of claim 3, wherein:

the set of key-use restriction information for each key of the plurality of keys includes an encoding of at least one restriction on the key; and

generating the reference signature is performed in a manner that ensures that the reference signature will match the message signature as a result of the message and signature being in compliance with the at least one restriction of the set of key-use restriction information for each of the plurality of keys.

7. The computer-implemented method of claim 3, wherein the reference signature matches the message signature as a result of the plurality of keys and a set of one or more keys used to generate the message signature being derived using a cryptographic hash function of a same set of one or more keys.

8. A system, comprising:

one or more processors; and

memory including instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to at least, for an electronic signature submitted for verification in connection with a message;

obtain a plurality of keys, each obtained key of the plurality of keys being based at least in part on;

a set of key-use restriction information for the plurality of keys that includes a first key-use restriction information and a second key-use restriction information, individual key-use restriction information of the set of key-use restriction information being nested to form a layered key-tree based on recursive derivation by a function, the set of key-use restriction information corresponding to at least one of time, date, region, zone, service, protocol, device, device model, or device manufacturer; and

at least one other key distinct from the plurality of keys;

compute, based at least in part on information derived based at least in part on the plurality of keys by the function by inputting the first key-use restriction information and the second key-use restriction information, whether the electronic signature is valid; and

cause one or more actions to be taken based at least in part on whether the electronic signature is valid, the one or more actions including evaluating whether access to one or more computing resources is permitted, with the set of key-use restriction information for each key of the plurality of keys preventing use of a key of the plurality of keys that is noncompliant with the set of key-use restriction information for the key.

9. The system of claim 8, wherein:

each key of the plurality of keys is derived based at least in part on a corresponding set of one or more specialization parameters; and

the instructions that cause the computer system to compute whether the electronic signature is valid include instructions that cause the computer system to;

calculate, based at least in part on the plurality of keys and the corresponding sets of one or more specialization parameters, a reference signature; and

determine whether the reference signature matches the electronic signature.

10. The system of claim 9, wherein:

the instructions that cause the computer system to compute whether the electronic signature is valid include instructions that cause the computer system to determine whether the message complies with the corresponding sets of one or more specialization parameters; and

the one or more actions are caused to be taken based at least in part on whether the message complies with the corresponding sets of one or more specialization parameters.

11. The system of claim 9, wherein the instructions that cause the computer system to calculate the reference signature includes instructions that cause the computer system to input a combination of the plurality of keys and an encoding of the corresponding sets of specialization parameters into a function based at least in part on a cryptographic hash function.

12. The system of claim 11, wherein the instructions further cause the computer system to calculate the combination of the plurality of keys in a manner in which ordering the keys within the plurality of keys is unnecessary.

13. The system of claim 8, wherein the one or more actions include causing fulfilment of a request encoded by the message by providing access to at least one of the one or more computing resources.

14. The system of claim 8, wherein the instructions that cause the computer system to obtain the plurality of keys include instructions that cause the computer system to obtain at least one of the plurality of keys from a computer system that lacks access to at least one other of the plurality of keys.

15. A non-transitory computer-readable storage medium that stores instructions that, as a result of being executed by a computer system, cause the computer system to at least:

obtain a plurality of keys, each obtained key of the plurality of keys being based at least in part on;

a set of key-use restriction information for the plurality of keys that includes a first key-use restriction information and a second key-use restriction information, individual key-use restriction information of the set of key-use restriction information being recursively derived by a function to form a layered key-tree, the set of key-use restriction information corresponding to at least one of time, date, region, zone, service, protocol, device, device model, or device manufacturer; and

at least one other key distinct from the plurality of keys;

calculate, based at least in part on the plurality of keys, a signing key by recursively inputting the first key-use restriction information and the second key-use restriction information into the function;

generate, based at least in part on the signing key and a message, a signature for the message; and

cause the message and the signature to be transmitted to another computer system for use in evaluating whether access to one or more computing resources is permitted, the set of key-use restriction information for each key of the plurality of keys preventing use of the signing key that is noncompliant with set of key-use restriction information for the key.

16. The non-transitory computer-readable storage medium of claim 15, wherein:

the other computer system verifies validity of the signature; and

the instructions that cause the computer system to obtain the plurality of keys include instructions that cause the computer system to derive, based at least in part on a key shared with the other computer system, at least one of the plurality of keys.

17. The non-transitory computer-readable storage medium of claim 16, wherein the instructions that cause the computer system to derive the at least one of the plurality of keys include instructions that cause the computer system to compute a value for a function based at least in part on the key shared with the other computer system.

18. The non-transitory computer-readable storage medium of claim 15, wherein the instructions that cause the computer system to obtain the plurality of keys include instructions that cause the computer system to obtain at least one of the plurality of keys from a computer system that lacks access to another of the plurality of keys.

19. The non-transitory computer-readable storage medium of claim 15, wherein the instructions that cause the computer system to calculate the signing key include instructions that cause the computer system to input a combination of the plurality of keys into a function with the set of key-use restriction information for each of the plurality of keys for the plurality of keys, the combination being based at least in part on a commutative operation on the plurality of keys.