Data security using request-supplied keys

• US 9,311,500 B2
• Filed: 09/25/2013
• Issued: 04/12/2016
• Est. Priority Date: 09/25/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory Branchek, Brandwine, Eric Jason
• Primary Examiner(s): Dinh, Minh
• Application Number:
  US14/037,292
• Publication Number:
  US 20150089244A1
• Time in Patent Office: 930 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Requests are submitted to a request processing entity where the requests include a cryptographic key to be used in fulfilling the request. The request processing entity, upon receipt of the request, extracts the key from the request and uses the key to perform one or more cryptographic operations to fulfill the request. The one or more cryptographic operations may include encryption/decryption of data that to be/is stored, in encrypted form, by a subsystem of the request processing entity. Upon fulfillment of the request, the request processing entity may perform one or more operations to lose access to the key in the request, thereby losing the ability to use the key.

Claims

1. A computer-implemented method, comprising:

under the control of one or more computer systems of a service provider, the one or more computer systems configured with executable instructions,

receiving, from a requestor corresponding to a customer of the service provider, a request whose fulfillment involves performance of one or more cryptographic operations on data provided with the request and use of a cryptographic key that is encrypted by another key and supplied in the request, the service provider lacking access to the cryptographic key for an amount of time until receipt of the request, wherein the cryptographic key is a public key of a public-private key pair for which the service provider lacks access;

causing the request to be fulfilled by using the supplied cryptographic key as part of performing the one or more cryptographic operations on the specified data, wherein;

performing the one or more cryptographic operations includes causing the cryptographic key supplied in the request to be decrypted, thereby resulting in a decrypted supplied cryptographic key, and the one or more cryptographic operations include performance of an asymmetric algorithm using the public key; and

using the decrypted supplied cryptographic key to perform the one or more cryptographic operations;

providing a result of performing the one or more cryptographic operations to a data storage system; and

at a time after performing the one or more cryptographic operations, performing one or more operations that cause the service provider to lose access to the cryptographic key.

2. A computer-implemented method, comprising:

under the control of one or more computer systems of a service provider, the one or more computer systems configured with executable instructions,

receiving, from a requestor corresponding to a customer of the service provider, a request whose fulfillment involves performance of one or more cryptographic operations on data provided with the request and use of a cryptographic key that is encrypted by another key and supplied in the request, the service provider lacking access to the cryptographic key for an amount of time until receipt of the request;

causing the request to be fulfilled by using the supplied cryptographic key as part of performing the one or more cryptographic operations on the specified data, wherein;

performing the one or more cryptographic operations includes causing the cryptographic key supplied in the request to be decrypted, thereby resulting in a decrypted supplied cryptographic key, wherein causing the cryptographic key supplied in the request to be decrypted includes transmitting the cryptographic key to another entity for decryption; and

using the decrypted supplied cryptographic key to perform the one or more cryptographic operations;

providing a result of performing the one or more cryptographic operations to a data storage system; and

at a time after performing the one or more cryptographic operations, performing one or more operations that cause the service provider to lose access to the cryptographic key.

3. A system, comprising:

one or more processors; and

memory including instructions that, when executed by the one or more processors, cause the system to;

receive, from a requestor over a network, a request whose fulfillment involves performance of one or more cryptographic operations on data specified in the request using information that comprises a cryptographic key supplied in the request, wherein the information is usable to authenticate the request, wherein the cryptographic key supplied in the request is a public key, in encrypted form, of a public-private key pair;

as a result of receipt and authenticity of the request, perform the one or more cryptographic operations on the specified data, wherein;

performing the one or more cryptographic operations on the specified data includes decrypting the encrypted public key and encrypting the specified data with a symmetric key; and

using the public key to encrypt the symmetric key; and

provide a result of performing the one or more cryptographic operations.

4. The system of claim 3, wherein:

the request is a request to read encrypted data out of a data storage system; and

the information is usable to authenticate the request using the cryptographic key supplied in the request.

5. The system of claim 3, wherein the information is usable to authenticate the request by including an electronic signature generated based at least in part on a second cryptographic key different from the cryptographic key supplied in the request.

6. The system of claim 3, wherein:

the one or more cryptographic operations include encryption of the specified data; and

providing the result of performing the one or more cryptographic operations includes transmitting the specified data in encrypted form to a data storage system for persistent storage.

7. The system of claim 3, wherein the instructions further cause the system to perform one or more operations to lose access to the cryptographic key supplied in the request at a time after performing the one or more cryptographic operations.

8. The system of claim 3, wherein the system lacks access to the cryptographic key for an amount of time until the request is received.

9. The system of claim 3, wherein:

the cryptographic key supplied in the request is supplied in the request in encrypted form;

the system further comprises a subsystem configured to securely and store, inaccessibly from outside of the subsystem, a plurality of cryptographic keys that include a particular cryptographic key usable to decrypt the cryptographic key supplied in encrypted form; and

the instructions further cause the system to cause the subsystem to decrypt the cryptographic key supplied in encrypted form to be used in performing the one or more cryptographic operations.

10. The system of claim 3, wherein the information is usable to authenticate the request by using the cryptographic key to authenticate the request.