Key generation and broadcasting

Patent metadata

Field	Value
Publication number	US-10178074-B2
Application number	US-201715476931-A
Country	US
Kind code	B2
Filing date	Mar 31, 2017
Priority date	Aug 16, 2013
Publication date	Jan 8, 2019
Grant date	Jan 8, 2019

Abstract

Embodiments provide techniques generating and managing encryption keys within a computing infrastructure. Embodiments provide a key publisher that generates and maintains key pairs in a list at a configurable interval. In addition, the key publisher publishes the list to other components within the computing infrastructure. Embodiments also provide a key consumer that downloads the list of encrypted key pairs and maintains an active window of keys to can be accepted from client devices that communicate sensitive data to the computing infrastructure. If the key consumer receives a key from a client device that is outside of the active window yet that corresponds to a future key pair in the list, the key consumer advances the active window towards the future key pair.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving, from a client device and via a computer network, an encrypted message having associated metadata;
identifying a first key pair included in a list of key pairs based on the metadata;
determining that the first key pair is not included in an active window associated with the list of key pairs; and
decrypting the encrypted message based on a decryption key associated with the first key pair.

2. The method of claim 1 , further comprising advancing the active window to include the first key pair.

3. The method of claim 1 , wherein the active window indicates a certain number of key pairs that are currently valid for transactions.

4. The method of claim 1 , further comprising publishing a public key corresponding to the first key pair to a key distributor.

5. The method of claim 4 , wherein the key distributor issues the public key to one or more client computers.

6. The method of claim 5 , wherein the encrypted message is received from a first client computer that is configured to encrypt a message with the public key to generate the encrypted message.

7. The method of claim 1 , further comprising downloading the list of key pairs from a key escrow.

8. The method of claim 1 , further comprising defining the active window to include a maximum number of previous key pairs preceding the currently active key pair.

9. The method of claim 1 , further comprising generating the list of key pairs, and publishing the list of key pairs to a key escrow.

10. The method of claim 1 , wherein the first key pair is subsequent to a currently active key pair included in the list of key pairs.

11. A computer system, comprising:
at least one memory that includes a key publisher and a key consumer; and
at least one processor,
wherein, when executing the key publisher, the at least one processor is configured to:
designate a key pair included in a list of encrypted key pairs as a currently active key pair, and
publishing the list of encrypted key pairs to a key escrow; and

wherein, when executing the key consumer, the at least one processor is configured to:
receive the list of encrypted key pairs from the key escrow,
receive, via a computer network, an encrypted message from a client computer having associated metadata,
identify a first key pair included in the list of encrypted key pairs based on the metadata;
determine that the first key pair is not included in an active window associated with the list of encrypted key pairs, but is subsequent to a currently active key pair included in the list of encrypted key pairs; and
decrypt the encrypted message based on a decryption key associated with the first key pair.

12. The computer system of claim 11 , wherein the at least one processor is further configured to advance the active window to include the first key pair.

13. The computer system of claim 11 , wherein the active window indicates a certain number of key pairs that are currently valid for transactions.

14. The computer system of claim 11 , wherein the at least one processor is further configured to publish a public key corresponding to the first key pair to a key distributor.

15. The computer system of claim 11 , wherein the key distributor issues the public key to one or more client computers.

16. The computer system of claim 15 , wherein a client computer is configured to encrypt a message with the public key to generate the encrypted message.

17. A non-transitory computer-readable medium including instructions that, when executed by a processor, cause the processor to perform the steps of:
receiving, from a client device and via a computer network, an encrypted message having associated metadata;
identifying a first key pair included in a list of key pairs based on the metadata, the list of key pairs having an associated active window that indicates a certain number of key pairs that are currently valid for transactions;
decrypting the encrypted message based on a decryption key associated with the first key pair.

18. The non-transitory computer-readable medium of claim 17 , further comprising advancing the active window to include the first key pair.

19. The non-transitory computer-readable medium of claim 17 , further comprising publishing a public key corresponding to the first key pair to a key distributor.

20. The non-transitory computer-readable medium of claim 17 , further comprising downloading the list of key pairs from a key escrow.

21. The non-transitory computer-readable medium of claim 17 , further comprising defining the active window to include a maximum number of previous key pairs preceding the currently active key pair.

22. The non-transitory computer-readable medium of claim 17 , further comprising generating the list of key pairs, and publishing the list of key pairs to a key escrow.

Assignees

• Netflix Inc

Inventors

• Udupi Poornaprajna
• Chan Jason
• Zarfoss Jay

Classifications

• H04L9/088

  Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068) · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• H04L9/0822

  using key encryption key · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/0435 Primary

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title