Updating encrypted cryptographic key pair

• US 9,674,162 B1
• Filed: 03/13/2015
• Issued: 06/06/2017
• Est. Priority Date: 03/13/2015
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Miller, Derek Del, Potlapally, Nachiketh Rao
• Primary Examiner(s): ZHAO, DON GORDON
• Application Number:
  US14/658,137
• Time in Patent Office: 816 Days
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

A computing device has a processor and a first memory, e.g., a fuse-based memory, storing a first cryptographic key. The processor is configured to receive information related to a second cryptographic key from a cryptographic key provisioning system. The processor derives the second cryptographic key from the information related to a second cryptographic key. The first cryptographic key has fewer bits than the second cryptographic key. The processor is also configured to encrypt the second cryptographic key using the first cryptographic key, and store the encrypted second cryptographic key in a second memory, e.g., a flash memory.

Claims

1. A computing device, comprising:

a processor;

a persistent memory storing a first cryptographic key; and

an electrically erasable programmable non-volatile memory;

wherein the processor is configured to;

receive information for a second cryptographic key from a cryptographic key provisioning system;

derive the second cryptographic key from the information for the second cryptographic key;

retrieve the first cryptographic key from the persistent memory, the first cryptographic key comprising fewer bits than the second cryptographic key;

encrypt the second cryptographic key using the first cryptographic key; and

store the encrypted second cryptographic key in the electrically erasable programmable non-volatile memory.

2. The device of claim 1, wherein the persistent memory is a fuse-based memory, and the electrically erasable programmable non-volatile memory is a flash memory.

3. The device of claim 1, wherein the information for the second cryptographic key comprises the encrypted second cryptographic key.

4. The device of claim 1, wherein the information for the second cryptographic key comprises one or more prime numbers that are used to generate the second cryptographic key.

5. The device of claim 1, wherein the information for the second cryptographic key comprises the second cryptographic key encrypted using the first cryptographic key.

6. The device of claim 1, wherein communication between the computing device and the cryptographic key provisioning system is carried out through a secure channel implemented using SSL (Secure Sockets Layer), TLS (Transport Layer Security), or IPsec (Internet Protocol Security).

7. The device of claim 1, wherein the processor is configured to receive information from the cryptographic key provisioning system through an application programming interface (API) or an interface based on an IPMI (Intelligent Platform Management Interface) specification.

8. The device of claim 1, wherein the first cryptographic key is associated with a symmetric cryptographic algorithm and the second cryptographic key is associated with an asymmetric cryptographic algorithm.

9. The device of claim 1, wherein the first cryptographic key is associated with a first symmetric cryptographic algorithm and the second cryptographic key is associated with a second symmetric cryptographic algorithm.

10. The device of claim 1, wherein the first cryptographic key is an advanced encryption standard (AES) key, and the second cryptographic key is an RSA (Rivest-Shamir-Adleman) private key.