Layered encryption of short-lived data
AssigneeAmazon Technologies, Inc.
InventorsColin Laird Lazier, Bryan James Donlan
Life of this patent
Estimating the term…
Abstract
Techniques for encrypting short-term data using layered encryption based on difficult to obtain secrets are described herein. Data that will be encrypted is designated as the source data for a first iteration of a layered encryption. An index indicates a data block within a large set of random data. The data block is encrypted and the encrypted data block is combined with the source data for the iteration to produce set of cryptographic data for the current iteration. The set of cryptographic data is used to generate cryptographic key data that is used to encrypt the index and the encrypted index is stored. The set of cryptographic data is then used as the source data for the next iteration.
Claims20
A computer-implemented method, comprising:
- designating, for a first iteration of a number of iterations, a set of data to encrypt as a source set of data, the number of iterations based at least in part on a property of the set of data to encrypt;
- for an individual iteration of the number of iterations:
- generating a random value to use as an index, the random value to use as an index indicating a data block within a data object;
- encrypting the data block to produce an encrypted data block using a seed based at least in part on an identifier associated with the set of data to encrypt;
- combining, using an invertible bitwise operation, the source set of data with the encrypted data block to produce a set of ciphertext data;
- encrypting, using an index key, the index to produce an encrypted index, the index key derived from the set of ciphertext data;
- storing the encrypted index in data storage in association with the set of ciphertext data;
- designating, for a next iteration, the set of ciphertext data as the source set of data;
- and
- providing the source set of data.
A system, comprising at least one computing device configured with processors and memory, the memory including instructions that, upon execution, cause the system to:
- designate a first set of data as a data source;
- and
- for an iteration of an iterative encryption process:
- generate a value to use as an index that indicates a data block within a data object;
- encrypt the data block to produce an encrypted data block;
- combine the data source with the encrypted data block using an invertible operation to produce a second set of data;
- store an encrypted index in data storage in association with the second set of data, the encrypted index generated by encrypting the value to use as an index using cryptographic data based at least in part on the second set of data;
- and
- designate the second set of data as the data source for a later iteration of the iterative encryption process.
A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
- obtain a set of data that is the result of a previous iteration of an iterative encryption process;
- generate an encrypted data block by selecting, based at least in part on an index, a data block from a data object and encrypting the data block using a seed;
- combine the set of data to encrypt with the encrypted data block using an invertible operation to produce a set of ciphertext data;
- encrypt the index based at least in part on the set of ciphertext data to produce an encrypted index corresponding to the set of ciphertext data;
- and
- provide the set of ciphertext data to a later iteration of the iterative encryption process.
Dependencies are inferred from the claim text.