公开(公告)号：US10229270B2

公开(公告)日：2019-03-12

申请号：US15389771

申请日：2016-12-23

Applicant: Amazon Technologies, Inc.

Inventor： Matthew John Campagna ,  Gregory Alan Rubin ,  Eric Jason Brandwine

IPC: G06F21/57 ,  H04L29/06 ,  H04L9/32 ,  H04L9/14 ,  H04L9/08

Abstract: A service provider provides virtual computing services using a fleet of one or more host computer systems. Each of the host computer systems may be equipped with a trusted platform module (“TPM”). The service provider, the host computer systems, and the virtual computing environments generate attestations that prove the integrity of the system. The attestations are signed with a one-time-use cryptographic key that is verifiable against the public keys of the service provider, a host computer system, and a virtual computing environment. The public key of the host computer system is integrated into a hash tree that links the public key of the host computer system to the public key of the service provider. The public key of the virtual computing environment is signed using a one-time-use graphic key issued to the host computer system that hosts the virtual computing environment.

公开(公告)号：US10122533B1

公开(公告)日：2018-11-06

申请号：US14969876

申请日：2015-12-15

Applicant: Amazon Technologies, Inc.

Inventor： Justin Lee Werner ,  Gregory Alan Rubin ,  Matthew John Campagna ,  Michael Bentkofsky

IPC: H04L29/06 ,  H04L9/32 ,  H04L12/24 ,  G06F9/4401

Abstract: A host machine operated for a specific purpose can have restricted access to other components in a multi-tenant environment in order to provide for the security of the host machine. The access restriction can prevent the host machine from obtaining updates to critical system-level configurations, but such information can be obtained through a signed command received to an API for the host machine. The command can be signed by a quorum of operators, and the host machine can be configured to verify the signatures and the quorum before processing the command. The host machine can store the updates to ephemeral storage as well as persistent storage, such that upon a reboot or power cycle the host machine can operate with current configuration data.

公开(公告)号：US20180176014A1

公开(公告)日：2018-06-21

申请号：US15898505

申请日：2018-02-17

Applicant: Amazon Technologies, Inc.

Inventor： Matthew John Campagna

IPC: H04L9/16 ,  H04L9/06 ,  H04L29/06 ,  H04L9/32 ,  G06F21/60 ,  H04L9/14 ,  H04L9/08 ,  H04L9/30

CPC classification number: H04L9/16 ,  G06F21/602 ,  H04L9/0618 ,  H04L9/0637 ,  H04L9/0643 ,  H04L9/0816 ,  H04L9/14 ,  H04L9/30 ,  H04L9/3239 ,  H04L9/3242 ,  H04L63/0428 ,  H04L63/06 ,  H04L63/123

Abstract: A plaintext and cryptographic key are used to generate an initialization vector to be used in a cryptographic algorithm, such as an encryption algorithm. In some examples, the plaintext and cryptographic key are input into an effectively one-way function, such as a cryptographic hash function, the output of which is usable as an initialization vector. Cryptographic keys may be rotated probabilistically based at least in part on probabilities of output collisions of the effectively one-way function to ensure a low probability of two different plaintexts resulting in calculation of the same initialization vector for use with the same cryptographic key.

公开(公告)号：US20180096163A1

公开(公告)日：2018-04-05

申请号：US15283017

申请日：2016-09-30

Applicant: Amazon Technologies, Inc.

Inventor： Christopher Richard Jacques de Kadt ,  Timothy William Bray ,  Trevor Simon Roger Dyck ,  Matthew John Campagna ,  Allan Henry Vermeulen

IPC: G06F21/62 ,  G06F21/60 ,  G06Q10/08 ,  G06F17/30

CPC classification number: G06F21/6227 ,  G06F16/23 ,  G06F21/602 ,  G06F2221/2107 ,  G06Q10/087 ,  G06Q20/203 ,  G06Q40/02 ,  G06Q2220/00

Abstract: A database table, such as may be implemented by a non-relational database, is provided to present information and states associated with that information as memorialized in a cryptographically secured ledger. The semantics of the database table elements, as well as the relationships between various objects therein, may be defined and/or enforced by a schema, a database engine, and/or an application layer. For example, the disclosed methods and systems may be used to implement an asset tracking tool that does not require trust of the implementing system for verification of the system's contents.

公开(公告)号：US09900153B2

公开(公告)日：2018-02-20

申请号：US15225725

申请日：2016-08-01

Applicant: Amazon Technologies, Inc.

Inventor： Matthew John Campagna

IPC: H04L29/06 ,  H04L9/16 ,  H04L9/14 ,  H04L9/06 ,  H04L9/08 ,  G06F21/60 ,  H04L9/32 ,  H04L9/30

CPC classification number: H04L9/16 ,  G06F21/602 ,  H04L9/0618 ,  H04L9/0637 ,  H04L9/0643 ,  H04L9/0816 ,  H04L9/14 ,  H04L9/30 ,  H04L9/3239 ,  H04L9/3242 ,  H04L63/0428 ,  H04L63/06 ,  H04L63/123

Abstract: A plaintext and cryptographic key are used to generate an initialization vector to be used in a cryptographic algorithm, such as an encryption algorithm. In some examples, the plaintext and cryptographic key are input into an effectively one-way function, such as a cryptographic hash function, the output of which is usable as an initialization vector. Cryptographic keys may be rotated probabilistically based at least in part on probabilities of output collisions of the effectively one-way function to ensure a low probability of two different plaintexts resulting in calculation of the same initialization vector for use with the same cryptographic key.

公开(公告)号：US09866392B1

公开(公告)日：2018-01-09

申请号：US14486741

申请日：2014-09-15

Applicant: Amazon Technologies, Inc.

Inventor： Matthew John Campagna ,  Gregory Branchek Roth

IPC: H04L9/32 ,  H04L9/14

CPC classification number: H04L9/3247 ,  H04L9/0822 ,  H04L9/0825 ,  H04L9/0891 ,  H04L9/14 ,  H04L9/3234 ,  H04L9/3265 ,  H04L2209/38

Abstract: A web of trust in a distributed system is established. A root of trust for at least two components in the distributed system validates information for the distributed system. The validated information is then used to create additional information for the distributed system. Versions of the information are usable to validate subsequent versions of the information such that validation of a version of the information can be performed by using one or more previous versions to verify that the version is a valid successor of a previously validated previous version.

公开(公告)号：US20170006018A1

公开(公告)日：2017-01-05

申请号：US14675614

申请日：2015-03-31

Applicant: Amazon Technologies, Inc.

Inventor： Matthew John Campagna ,  Gregory Branchek Roth

IPC: H04L29/06

Abstract: A computer system performs cryptographic operations as a service. The computer system is configured to allow users of the service to maintain control of their respective cryptographic material. The computer system uses inaccessible cryptographic material to encrypt a user's cryptographic material in a token that is then provided to the user. The user is unable to access a plaintext copy of the cryptographic material in the token, but can provide the token back to the service to cause the service to decrypt and use the cryptographic material.

Abstract translation: 计算机系统作为服务执行加密操作。 计算机系统被配置为允许服务的用户保持对它们各自的密码材料的控制。 计算机系统使用不可访问的加密材料来加密随后提供给用户的令牌中的用户的加密材料。 用户无法访问令牌中的加密材料的明文副本，但可以将令牌提供给服务以使服务解密并使用加密材料。

公开(公告)号：US09397835B1

公开(公告)日：2016-07-19

申请号：US14284278

申请日：2014-05-21

Applicant: Amazon Technologies, Inc.

Inventor： Matthew John Campagna ,  Gregory Branchek Roth

IPC: H04L29/00 ,  H04L9/32

CPC classification number: H04L9/3247 ,  G06F12/1408 ,  G06F2212/1016 ,  H04L9/0822 ,  H04L9/0825 ,  H04L9/0891 ,  H04L9/0897 ,  H04L9/3234 ,  H04L63/06 ,  H04L63/12 ,  H04L63/20 ,  H04L2209/38

Abstract: A web of trust is used to validate states of a distributed system. The distributed system operates based at least in part on a domain trust. A root of trust issues the domain trust issues a domain trust. Domain trusts are updatable in accordance with rules of previous domain trusts so that a version of a domain trust is verifiable by verifying a chain of previous domain trust versions.

Abstract translation: 信任网络用于验证分布式系统的状态。 分布式系统至少部分地基于域信任来运行。 信任根源发布域信任发出域信任。 域信任可以根据以前的域信任的规则进行更新，以便通过验证以前的域信任版本的一系列来验证域信任的版本。

公开(公告)号：US11570158B2

公开(公告)日：2023-01-31

申请号：US16430003

申请日：2019-06-03

Applicant: Amazon Technologies, Inc.

Inventor： Matthew John Campagna

IPC: H04L29/06 ,  H04L9/40 ,  H04L9/08 ,  H04L9/06

Abstract: Performing cryptographic operations such as encryption and decryption may be computationally expensive. In some contexts, initialization vectors and keystreams operable to perform encryption operations are generated and stored in a repository, and later retrieved for use in performing encryption operations. Multiple devices in a distributed system can each generate and store a subset of a larger set of keystreams.

公开(公告)号：US11374916B2

公开(公告)日：2022-06-28

申请号：US16673703

申请日：2019-11-04

Applicant: Amazon Technologies, Inc.

Inventor： Matthew John Campagna ,  Gregory Branchek Roth

IPC: H04L9/40 ,  G06F21/62 ,  H04L9/08

Abstract: A computer system performs cryptographic operations as a service. The computer system is configured to allow users of the service to maintain control of their respective cryptographic material. The computer system uses inaccessible cryptographic material to encrypt a user's cryptographic material in a token that is then provided to the user. The user is unable to access a plaintext copy of the cryptographic material in the token, but can provide the token back to the service to cause the service to decrypt and use the cryptographic material.