AUTOMATED SECRET RENEGOTIATION

• US 20140282950A1
• Filed: 05/30/2014
• Published: 09/18/2014
• Est. Priority Date: 06/25/2012
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory Branchek, Ilac, Cristian M.
• Granted Patent: US 9,674,170 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 9/0872 using geo-location information, e.g. location data, time, relative position or proximity to other entities
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/61 Time-dependent

Abstract

Secret information, such as seeds, codes, and keys, can be automatically renegotiated between at least one sender and at least one recipient. Various mechanisms, such as counters, events, or challenges, can be used to trigger automatic renegotiations through various requests or communications. These changes can cause the current secret information to diverge from older copies of the secret information that might have been obtained by unintended third parties. In some embodiments, a secret can be configured to “decay” over time, or have small changes periodically introduced that can be determined to be valid by an authorized party, but can reduce the effectiveness of prior versions of the secret information.

Claims

1. A computer-implemented method for proactively renegotiating a shared secret, comprising:

receiving a request from a client device, the request including a shared secret generated using a seed and a client time value determined using a clock of the client device;

analyzing the shared secret to determine whether the seed used to generate the shared secret matches an expected seed value for the request;

comparing the client time value, used to generate the shared secret, against a current time of a local clock and a client time value offset;

when the seed is determined to match the expected seed value within an acceptable amount of variation and the client time value falls inside a window of time with respect to the current time as modified by the client time value offset;

authenticating an identity of the client device and processing the request; and

automatically updating at least one of (a) the expected seed value to match the seed used to generate the shared secret or (b) the client time value offset to account for the client time value.