Key rotation with external workflows

• US 8,908,868 B1
• Filed: 05/17/2012
• Issued: 12/09/2014
• Est. Priority Date: 05/17/2012
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Baer, Graeme D., Seidenberg, Benjamin E., Hulme, David M.
• Primary Examiner(s): Nalven, Andrew
• Assistant Examiner(s): Fields, Courtney
• Application Number:
  US13/474,525
• Time in Patent Office: 936 Days
• Field of Search: 380/278, 380/277, 380/279, 713/168, 726/1, 726/4
• US Class Current: 380/278
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/64 Self-signed certificates
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A material set, such as an asymmetric keypair, is processed using an associated workflow to prepare the material set for activation and/or use. In one embodiment, a material set is generated and information about the material set is communicated to a workflow manager. Based at least on the information, the workflow manager generates a workflow that when accomplished will allow the material set to be activated and/or used. In another embodiment, a service provider provides a key manager, workflow manager and destination for the key, such as a load balancer that terminates SSL connections. A key can be generated by the key manager, sent through the workflow manager for processing (potentially communicated to third parties such as a certificate authority, if needed) and installed at a destination.

Claims

1. A computer-implemented method for key management, comprising:

providing a set of workflow templates associated with a set of classes of keys to a client;

receiving a request from the client to generate a key based at least in part on a workflow template of the set of workflow templates;

after receiving the request from the client, generating an asymmetric keypair by a key management system, the generated keypair unavailable for use by the client until processed through a workflow;

associating the keypair with a class of keys of the set of classes by the key management system, the class of keys corresponding to a workflow template associated with a workflow management system for preparing the keypair to become active;

communicating, by the key management system, the generation of the keypair to the workflow management system configured to generate and process the workflow for the keypair based at least in part on the workflow template;

activating, by the key management system, the keypair for use after the workflow has completed, the activating comprising distributing the keypair to computing resources over an internal network and sending a notification to the client that the keypair is available for use without sending the keypair to the client;

generating a new keypair based at least in part on the class of keys associated with the keypair, the new keypair unavailable for use by the client until processed through a replacement workflow associated with the class of keys; and

deactivating the keypair based at least in part on activating the new keypair.

2. The computer-implemented method of claim 1, wherein the workflow management system is further configured to generate and process the workflow for the keypair by at least:

generating a certificate signing request that includes a public key portion of the keypair;

sending the certificate signing request to a Certificate Authority;

receiving a signed certificate; and

importing the signed certificate to be used with the keypair.

3. The computer-implemented method of claim 2, wherein the method further comprises sending a private key of the keypair and a certificate to a load balancer management system to enable a load balancer to terminate secure communications.

4. The computer-implemented method of claim 1, wherein the workflow management system is further configured to generate and process the workflow by at least:

performing a webservice call using credentials, the webservice call including a public key portion of the keypair; and

receiving an acknowledgement of receipt of the public key portion of the keypair.

5. The computer-implemented method of claim 1, wherein activating the keypair for use further comprises transmitting one or more electronic communications to one or more third party systems that the keypair is activated.

6. The computer-implemented method of claim 1, further comprising selecting the workflow from a set of workflows, the workflow selected based at least in part on the class associated with the keypair.

7. A computer-implemented method for key management, comprising:

providing a set of workflow templates associated with a set of classes of secrets to a client;

receiving a request from the client to generate a secret based at least in part on a workflow template of the set of workflow templates;

after receiving the request from the client, generating the secret associated with a class of secrets of the set of classes of secrets by a key management system, the generated secret being inactive for use by at least the client;

sending, by the key management system, information about the secret to a workflow management system configured to process a workflow according to the workflow template based at least in part on the information;

activating, by the key management system, the secret for use after determining that the workflow is complete, the activating comprising distributing the secret to a computing resource over an internal network and notifying the client that the secret is available for use without sending the secret to the client;

generating a new secret based at least in part on the class of secrets associated with the secret, the new secret inactive for use by at least the client until processed through a replacement workflow associated with the class of secrets; and

deactivating the secret based at least in part on activating the new secret.

8. The computer-implemented method of claim 7, wherein the method further comprises:

creating the workflow template as a basis for constructing the workflow, the workflow template comprising operations to setup a secure environment that uses the secret; and

associating the workflow template with the class of secrets.

9. The computer-implemented method of claim 7, wherein the method further comprises receiving the request through an application programming interface of a program execution service.

20. The method of claim 7, wherein the class of secrets is associated with a data structure comprising a characteristic of the secret, information about an end use of the secret, and information about the workflow.

21. The method of claim 7, wherein the workflow is based at least in part on the class of secrets.

22. The method of claim 7, wherein the secret is inactive to the client prior to completion of the workflow, and wherein the secret is active and inaccessible to the client upon completion of the workflow.

10. A system comprising:

one or more computing resources comprising one or more processors and memory including executable instructions that, when executed by the one or more processors, cause the one or more processors to collectively implement at least;

a key manager configured to;

provide a set of workflow templates associated with a set of classes of secrets to a client;

receive a request from the client to generate at least one secret based at least in part on a workflow template of the set of workflow templates;

generate the at least one secret in response to the request from the client;

associate the at least one secret with at least one workflow based at least in part on the workflow template;

maintain the at least one secret as inactive until receipt of information that the at least one workflow is complete;

notify the client when the at least one secret becomes active without sending the at least one secret to the client; and

associated with the at least one secret, the at least one new secret inactive until processed through a replacement workflow associated with the class of secrets;

a workflow management system configured to;

receive information about the at least one secret; and

in response to receiving the information about the at least one secret, generate the at least one workflow, process the at least one workflow, and report completion of the at least one workflow to the key manager; and

a key distribution manager configured to;

distribute the at least one secret to at least one computing resource over an internal network to enable the at least one computing resource to perform cryptographic operations; and

deactivate the at least one secret based at least in part on activating the at least one new secret.

11. The system of claim 10, wherein the system further comprises an administrative system that includes an interface to manage the at least one workflow and the association between the at least one workflow and the at least one secret.

12. The system of claim 10, wherein the key manager and the workflow management system are components of a program execution service that provides computing services for executing the at least one workflow.

13. The system of claim 12, wherein the program execution service further comprises a load balancer that receives the secret from the key distribution manager after the at least one workflow is completed.

14. The system of claim 10, wherein the system further comprises a network, the network providing a communications path between the key manager and the workflow management system.

15. The system of claim 14, wherein the workflow management system further comprises an application programming interface, the application programming interface receiving information from the key manager through the network.

16. One or more non-transitory computer-readable storage media having collectively stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:

provide a set of workflow templates associated with a set of classes of secrets to a client;

receive a request from the client to generate a key based at least in part on a workflow template of the set of workflow templates;

generate the key after receiving the request from the client, the key associated with a class of secrets of the set of classes and being inactive;

invoke a workflow according to the workflow template based at least in part on the class of secrets associated with the key;

activate the key for use after the workflow has been processed, the activate comprising distributing the key to a computing resource over an internal network and notifying the client that the key is active without transmitting the key to the client;

generate a new key based at least in part on the class of secrets associated with the key, the new key inactive until processed through a replacement workflow associated with the class of secrets; and

deactivate the key based at least in part on activating the new key.

17. The non-transitory computer-readable storage media of claim 16, wherein the instructions further comprise instructions that, when executed, cause the computer system to at least cause a cost to accrue to an account of the client based at least in part on activating the key.

18. The non-transitory computer-readable storage media of claim 16, wherein the instructions further comprise instructions that, when executed, cause the computer system to at least store, as accessible to a key distribution manager, the association of the class of secrets with the key.

19. The non-transitory computer-readable storage media of claim 16, wherein the request comprises a request to create a new key compatible with the class of secrets, the request triggering the generating of the new key.