ESTABLISHING ENTROPY ON A SYSTEM

• US 20170373833A1
• Filed: 08/24/2017
• Published: 12/28/2017
• Est. Priority Date: 06/03/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Doane, Andrew Jeffrey, Cignetti, Todd Lawrence
• Granted Patent: US 10,419,205 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 7/582 Pseudo-random number generators
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/002 Countermeasures against attacks on cryptographic mechanisms network architectures or network communication protocols for protection against malicious traffic H04L63/1441
• CPC Class Codes: H04L 9/0662 with particular pseudorandom sequence generator
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]

Abstract

Servers in datacenters, mobile devices and virtualized servers without human interaction may experience difficulties in establishing entropy in a virtualized computing environment. Entropy is an important foundation for cryptography and a lack of entropy has led to weaknesses that can be used to break cryptographic systems in the past.

Claims

1. A computer-implemented method, comprising:

generating, using a pseudorandom number generator, a first value; and

generating, using a random number generator and based at least in part on the first value, a second value.

2. The computer-implemented method of claim 1, further comprising establishing a network connection based at least in part on the second value.

3. The computer-implemented method of claim 2, wherein the network connection is a Secure Sockets Layer (SSL) protocol connection or a Transport Layer Security (TLS) protocol connection.

4. The computer-implemented method of claim 1, wherein the random number generator is an entropy service.

5. The computer-implemented method of claim 1, wherein the random number generator is a cryptographically-secure pseudorandom number generator.

6. The computer-implemented method of claim 1, wherein the random number generator operates with higher entropy than the pseudorandom number generator.

7. A system, comprising:

one or more processors; and

memory to store instructions that, if executed by the one or more processors, cause the system to;

generate, using a pseudorandom number generator, a first value; and

generate, using the random number generator and based at least in part on the first value, a second value.

8. The system of claim 7, where in the second value is utilized to encrypt communications over a network connection.

9. The system of claim 7, wherein the random number generator is a hardware random number generator.

10. The system of claim 7, wherein the random number generator is an entropy service provided by a different system.

11. The system of claim 7, wherein the random number generator is a cryptographically-secure pseudorandom number generator.

12. The system of claim 7, wherein the second value is cryptographically stronger than the first value.

13. A non-transitory computer-readable storage medium having stored thereon executable instructions that, if executed by one or more processors of a computer system, cause the computer system to at least:

generate, using a pseudorandom number generator, a first value; and

generate, using a random number generator and based at least in part on the first value, a second value.

14. The non-transitory computer-readable storage medium of claim 13, wherein the instructions further comprise instructions that, if executed by the one or more processors, establish a network connection based at least in part on the second value.

15. The non-transitory computer-readable storage medium of claim 13, wherein the random number generator is an entropy service provided by a different system.

16. The non-transitory computer-readable storage medium of claim 13, wherein the random number generator is a cryptographically-secure pseudorandom number generator.

17. The non-transitory computer-readable storage medium of claim 13, wherein the random number generator operates with higher entropy than the pseudorandom number generator.

18. The non-transitory computer-readable storage medium of claim 13, wherein the first value is generated in response to a request from a client via a network connection;

and the second value is provided to the client via the network connection.

19. The non-transitory computer-readable storage medium of claim 18, wherein the network connection is a secure communications connection established by the client, the secure communications connection terminating when the second value is provided to the client.

20. The non-transitory computer-readable storage medium of claim 18, wherein the request is received by a web service interface associated with the computer system.