Supporting a fixed transaction rate with a variably-backed logical cryptographic key

• US 10,587,405 B2
• Filed: 04/06/2018
• Issued: 03/10/2020
• Est. Priority Date: 06/27/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory Branchek, Campagna, Matthew John, Seidenberg, Benjamin Elias
• Primary Examiner(s): Bayou, Yonas A
• Application Number:
  US15/947,690
• Publication Number:
  US 20180227124A1
• Time in Patent Office: 704 Days
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

A request a request to perform a cryptographic operation is received, the request including a first identifier assigned to a key group, the key group comprising a plurality of second identifiers, with the plurality of second identifiers corresponding to a plurality of cryptographic keys. A second identifier is determined, according to a distribution scheme, from the plurality of second identifiers, and the cryptographic operation is performed using a cryptographic key of the plurality of cryptographic keys that corresponds to the second identifier that was determined.

Claims

1. A computer-implemented method, performed by a computer including memory and a processor, comprising:

receiving a request to perform a cryptographic operation, the request indicating an identifier of a logical key that is shared with a plurality of keys that are capable of being used to perform the cryptographic operation;

selecting, based at least in part on a selection algorithm, from the plurality of keys, a first key to be used in performing the cryptographic operation; and

performing the cryptographic operation using one or more computing resources associated with the first key.

2. The computer-implemented method of claim 1, wherein the selection algorithm further comprises a distribution scheme that assigns a weight to a cryptographic key based at least in part on proximity to an exhaustion threshold of a current usage of the cryptographic key.

3. The computer-implemented method of claim 1, wherein selecting, based at least in part on the selection algorithm, the first key is further selected based at least in part on a type of the cryptographic operation being requested.

4. The computer-implemented method of claim 1, wherein:

the logical key has an aggregate usage rate requirement;

individual cryptographic keys of the plurality of keys have separate key usr e rate limits; and

a quantity of keys in the plurality of keys is dependent at least in part on an aggregation of the separate key usage rate exceeding the aggregate usage rate requirement.

5. The computer-implemented method of claim 4, further comprising:

receiving a second request, the second request being a request to change the aggregate usage rate requirement; and

as a result of receiving the second request, making a change to the plurality of keys.

6. The computer-implemented method of claim 5, wherein making the change includes adding one or more cryptographic keys to the plurality of keys.

7. The computer-implemented method of claim 5, wherein making the change includes changing a key usage rate limit of at least one cryptographic key in the plurality of keys.

8. A system, comprising:

one or more processors; and

memory storing instructions that, as a result of execution by the one or more processors, cause the system to;

associate a plurality of keys with a logical key, each key in the plurality of keys being capable of being used to perform a first cryptographic operation and a second cryptographic operation;

receive a first request to perform the first cryptographic operation, the first request identifying the logical key;

select a first key from the plurality of keys;

perform the first cryptographic operation using the first key; and

provide a response to the first request with a result of the first cryptographic operation and information indicating which of the plurality of keys associated with the logical key was used to perform the cryptographic operation.

9. The system of claim 8, wherein the instructions further include instructions that cause the system to:

receive a second request to perform the second cryptographic operation, the second request identifying the logical key;

select based at least in part on the selection algorithm, a second key from the plurality of keys, the second key different from the first key; and

perform the second cryptographic operation using the second key.

10. The system of claim 9, wherein the plurality of keys are distributed over multiple security modules.

11. The system of claim 10, wherein the multiple security modules are distributed to mitigate correlated failures, the multiple security modules being separated by:

geographic region, or

host server.

12. The system of claim 10, wherein:

the first key is distributed to a first security module of the multiple security modules; and

the second key is distributed to a second security module, different from the first security module, of the multiple security modules.

13. The system of claim 12, wherein the second key is selected as a result of an occurrence of a failure at the first security module.

14. The system of claim 8, wherein the instructions further include instructions that cause the system to:

determine that usage of the first key exceeds a maximum usage threshold corresponding to the first key;

prevent the first key from being used to perform cryptographic operations; and

provision a second key into the plurality of keys.

15. A non-transitory computer-readable storage medium storing executable instructions stored thereon that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:

receive a request to perform a cryptographic operation, the request indicating a first identifier of a logical key that is associated with a plurality of keys that are capable of being used to perform the cryptographic operation;

select a first key, based at least in part on a second identifier specific to the first key, from the plurality of keys, the first key to be used in performing the cryptographic operation; and

perform the cryptographic operation using one or more computing resources associated with the first key.

16. The non-transitory computer-readable storage medium of claim 15, wherein the first key is a public-private key pair.

17. The non-transitory computer-readable storage medium of claim 15, wherein the executable instructions further include executable instructions that cause the computer system to:

determine an aggregate key usage rate requirement to associate with the logical key; and

increase a quantity of cryptographic keys in the plurality of keys based at least in part on an aggregation of respective maximum usage rate thresholds of the plurality of keys exceeding the aggregate key usage rate requirement.

18. The non-transitory computer-readable storage medium of claim 17, wherein the aggregate key usage rate requirement is determined based at least in part on a historic rate of performing cryptographic operations using the logical key.

19. The non-transitory computer-readable storage medium of claim 15, wherein:

each cryptographic key generated has a corresponding exhaustion threshold;

on a condition that the cryptographic operation is of a first type of cryptographic operation, performing the cryptographic operation is applied toward the exhaustion threshold of the key; and

on a condition that the cryptographic operation is of a second type of cryptographic operation, performing the cryptographic operation is not applied toward the exhaustion threshold of the key.

20. The non-transitory computer-readable storage medium of claim 19, wherein:

the first type of cryptographic operation is an encryption operation; and

the second type of cryptographic operation is a decryption operation.