Automatic credential rotation

Patent metadata

Field	Value
Publication number	US-10924464-B2
Application number	US-201916551400-A
Country	US
Kind code	B2
Filing date	Aug 26, 2019
Priority date	Jul 17, 2017
Publication date	Feb 16, 2021
Grant date	Feb 16, 2021

Abstract

Credentials and other sensitive strings can undergo automatic rotation before each transmission or storage of those credentials. String modification, which can utilize a key stretching algorithm, can be used to modify the credential before transmission. This can be for an initial sign up, a subsequent login, or another such action. A random number can be generated to determine the number of iterations for the key stretching algorithm to be applied. For subsequent actions, a new random number can be added to the prior iteration number in order to create a new string that can be generated using the previously utilized iteration number and the new random number, with only the new random number being transmitted with the modified credential string. This increases security, as the transmission itself cannot be used to recover the original plaintext credential if recovered.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving a first request for access to at least one resource, the first request including a first credential string corresponding to an output of a key stretching algorithm operated on an access credential for a first number of iterations;
receiving a second credential string, the second credential string corresponding to the output of the key stretching algorithm operated on the access credential for a second number of iterations;
generating a local copy of the second credential string, using the first credential string processed by the key stretching algorithm for the second number of iterations;
determining that the second credential string matches the local copy of the second credential string; and
granting, in response to a second request, access to the at least one resource.

2. The computer-implemented method of claim 1 , wherein the first iteration number corresponds to a first random number and the second iteration number corresponds to a sum of the first iteration number and a second random number, and wherein the first request further includes the first iteration number.

3. The computer-implemented method of claim 1 , further comprising:
causing a new credential string to be received for each subsequent request for access to the at least one resource, independent of whether the access credential changes with the each subsequent request for access.

4. The computer-implemented method of claim 1 , wherein the access credential is an alphanumeric password, and wherein the key stretching algorithm is one of a B-crypt, an S-crypt, an Argon2, or a password-based key derivation function (PBKDF2) algorithm.

5. The computer-implemented method of claim 1 , further comprising:
providing an interface for generating the first request for access, the interface including code for generating the first credential string, and the interface indicating a string modification process to be used to generate the first credential string.

6. The computer-implemented method of claim 5 , wherein the string modification process includes iterative application of a key stretching algorithm to a plaintext data security credential.

7. The computer-implemented method of claim 1 , further comprising:
providing at least one cryptographic salt for use with the key stretching algorithm.

8. A system, comprising:
at least one processor; and
memory including instructions that, when executed by the at least one processor, cause the system to:
receive a first request for access to at least one resource, the first request including a first credential string corresponding to an output of a key stretching algorithm operated on an access credential for a first number of iterations;
receive a second credential string, the second credential string corresponding to the output of the key stretching algorithm operated on the access credential for a second number of iterations;
generate a local copy of the second credential string, using the first credential string processed by the key stretching algorithm for the second number of iterations;
determine that the second credential string matches the local copy of the second credential string; and
grant, in response to a second request, access to the at least one resource.

9. The system of claim 8 , wherein the first iteration number corresponds to a first random number and the second iteration number corresponds to a sum of the first iteration number and a second random number, and wherein the first request further includes the first iteration number.

10. The system of claim 8 , wherein the instructions, when executed, further cause the system to:
cause a new credential string to be received for each subsequent request for access to the at least one resource, independent of whether the access credential changes with the each subsequent request for access.

11. The system of claim 8 , wherein the access credential is an alphanumeric password, and wherein the key stretching algorithm is one of a B-crypt, an S-crypt, an Argon2, or a password-based key derivation function (PBKDF2) algorithm.

12. The system of claim 8 , wherein the instructions, when executed, further cause the system to:
provide an interface for generating the first request for access, the interface including code for generating the first credential string, and the interface indicating a string modification process to be used to generate the first credential string.

13. The system of claim 12 , wherein the string modification process includes iterative application of a key stretching algorithm to a plaintext data security credential.

14. The system of claim 8 , wherein the instructions, when executed, further cause the system to:
provide at least one cryptographic salt for use with the key stretching algorithm.

15. A non-transitory computer readable storage medium storing one or more sequences of instructions, executable by one or more processors, to perform a set of operations comprising:
receiving a first request for access to at least one resource, the first request including a first credential string corresponding to an output of a key stretching algorithm operated on an access credential for a first number of iterations;
receiving a second credential string, the second credential string corresponding to the output of the key stretching algorithm operated on the access credential for a second number of iterations;
generating a local copy of the second credential string, using the first credential string processed by the key stretching algorithm for the second number of iterations;
determining that the second credential string matches the local copy of the second credential string; and
granting, in response to a second request, access to the at least one resource.

16. The non-transitory computer readable storage medium of claim 15 , wherein the first iteration number corresponds to a first random number and the second iteration number corresponds to a sum of the first iteration number and a second random number, and wherein the first request further includes the first iteration number.

17. The non-transitory computer readable storage medium of claim 15 , further comprising instructions executed by the one or more processors to perform the set of operations of:
causing a new credential string to be received for each subsequent request for access to the at least one resource, independent of whether the access credential changes with the each subsequent request for access.

18. The non-transitory computer readable storage medium of claim 15 , wherein the access credential is an alphanumeric password, and wherein the key stretching algorithm is one of a B-crypt, an S-crypt, an Argon2, or a password-based key derivation function (PBKDF2) algorithm.

19. The non-transitory computer readable storage medium of claim 15 , further comprising:
providing an interface for generating the first request for access, the interface including code for generating the first credential string, and the interface indicating a string modification process to be used to generate the first credential string.

20. The non-transitory computer readable storage medium of claim 19 , wherein the string modification process includes iterative application of a key stretching algorithm to a plaintext data security credential.

Assignees

• Amazon Tech Inc

Inventors

• Huynh Toan

Classifications

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/068 Primary

  using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088) · CPC title

• H04L9/0863

  involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067) · CPC title

• H04L63/0838 Primary

  using one-time-passwords · CPC title

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title