Supporting a fixed transaction rate with a variably-backed logical cryptographic key

Patent metadata

Field	Value
Publication number	US-10587405-B2
Application number	US-201815947690-A
Country	US
Kind code	B2
Filing date	Apr 6, 2018
Priority date	Jun 27, 2014
Publication date	Mar 10, 2020
Grant date	Mar 10, 2020

Abstract

A request a request to perform a cryptographic operation is received, the request including a first identifier assigned to a key group, the key group comprising a plurality of second identifiers, with the plurality of second identifiers corresponding to a plurality of cryptographic keys. A second identifier is determined, according to a distribution scheme, from the plurality of second identifiers, and the cryptographic operation is performed using a cryptographic key of the plurality of cryptographic keys that corresponds to the second identifier that was determined.

First claim

What is claimed is:

1. A computer-implemented method, performed by a computer including memory and a processor, comprising:
receiving a request to perform a cryptographic operation, the request indicating an identifier of a logical key that is shared with a plurality of keys that are capable of being used to perform the cryptographic operation;
selecting, based at least in part on a selection algorithm, from the plurality of keys, a first key to be used in performing the cryptographic operation; and
performing the cryptographic operation using one or more computing resources associated with the first key.

2. The computer-implemented method of claim 1 , wherein the selection algorithm further comprises a distribution scheme that assigns a weight to a cryptographic key based at least in part on proximity to an exhaustion threshold of a current usage of the cryptographic key.

3. The computer-implemented method of claim 1 , wherein selecting, based at least in part on the selection algorithm, the first key is further selected based at least in part on a type of the cryptographic operation being requested.

4. The computer-implemented method of claim 1 , wherein:
the logical key has an aggregate usage rate requirement;
individual cryptographic keys of the plurality of keys have separate key usr e rate limits; and
a quantity of keys in the plurality of keys is dependent at least in part on an aggregation of the separate key usage rate exceeding the aggregate usage rate requirement.

5. The computer-implemented method of claim 4 , further comprising:
receiving a second request, the second request being a request to change the aggregate usage rate requirement; and
as a result of receiving the second request, making a change to the plurality of keys.

6. The computer-implemented method of claim 5 , wherein making the change includes adding one or more cryptographic keys to the plurality of keys.

7. The computer-implemented method of claim 5 , wherein making the change includes changing a key usage rate limit of at least one cryptographic key in the plurality of keys.

8. A system, comprising:
one or more processors; and
memory storing instructions that, as a result of execution by the one or more processors, cause the system to:
associate a plurality of keys with a logical key, each key in the plurality of keys being capable of being used to perform a first cryptographic operation and a second cryptographic operation;
receive a first request to perform the first cryptographic operation, the first request identifying the logical key;
select a first key from the plurality of keys;
perform the first cryptographic operation using the first key; and
provide a response to the first request with a result of the first cryptographic operation and information indicating which of the plurality of keys associated with the logical key was used to perform the cryptographic operation.

9. The system of claim 8 , wherein the instructions further include instructions that cause the system to:
receive a second request to perform the second cryptographic operation, the second request identifying the logical key;
select based at least in part on the selection algorithm, a second key from the plurality of keys, the second key different from the first key; and
perform the second cryptographic operation using the second key.

10. The system of claim 9 , wherein the plurality of keys are distributed over multiple security modules.

11. The system of claim 10 , wherein the multiple security modules are distributed to mitigate correlated failures, the multiple security modules being separated by:
geographic region, or
host server.

12. The system of claim 10 , wherein:
the first key is distributed to a first security module of the multiple security modules; and
the second key is distributed to a second security module, different from the first security module, of the multiple security modules.

13. The system of claim 12 , wherein the second key is selected as a result of an occurrence of a failure at the first security module.

14. The system of claim 8 , wherein the instructions further include instructions that cause the system to:
determine that usage of the first key exceeds a maximum usage threshold corresponding to the first key;
prevent the first key from being used to perform cryptographic operations; and
provision a second key into the plurality of keys.

15. A non-transitory computer-readable storage medium storing executable instructions stored thereon that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
receive a request to perform a cryptographic operation, the request indicating a first identifier of a logical key that is associated with a plurality of keys that are capable of being used to perform the cryptographic operation;
select a first key, based at least in part on a second identifier specific to the first key, from the plurality of keys, the first key to be used in performing the cryptographic operation; and
perform the cryptographic operation using one or more computing resources associated with the first key.

16. The non-transitory computer-readable storage medium of claim 15 , wherein the first key is a public-private key pair.

17. The non-transitory computer-readable storage medium of claim 15 , wherein the executable instructions further include executable instructions that cause the computer system to:
determine an aggregate key usage rate requirement to associate with the logical key; and
increase a quantity of cryptographic keys in the plurality of keys based at least in part on an aggregation of respective maximum usage rate thresholds of the plurality of keys exceeding the aggregate key usage rate requirement.

18. The non-transitory computer-readable storage medium of claim 17 , wherein the aggregate key usage rate requirement is determined based at least in part on a historic rate of performing cryptographic operations using the logical key.

19. The non-transitory computer-readable storage medium of claim 15 , wherein:
each cryptographic key generated has a corresponding exhaustion threshold;
on a condition that the cryptographic operation is of a first type of cryptographic operation, performing the cryptographic operation is applied toward the exhaustion threshold of the key; and
on a condition that the cryptographic operation is of a second type of cryptographic operation, performing the cryptographic operation is not applied toward the exhaustion threshold of the key.

20. The non-transitory computer-readable storage medium of claim 19 , wherein:
the first type of cryptographic operation is an encryption operation; and
the second type of cryptographic operation is a decryption operation.

Assignees

• Amazon Tech Inc

Inventors

• Roth Gregory Branchek
• Campagna Matthew John
• Seidenberg Benjamin Elias

Classifications

• H04L9/0891 Primary

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• H04L63/065

  for group communications (cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833) · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L9/088

  Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068) · CPC title