# US 10,482,413 B2 · Data transfer tool for secure client-side data transfer to a shippable storage device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,413 B2 - Document ID: US10482413B2 - Status: Granted - Kind: B2 - Application number: 14/975,371 - Filed: 2015-12-18 - Published: 2017-06-22 - Granted: 2019-11-19 - Earliest claimed: 2015-12-18 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Frank Paterra; Firat Basarir - Web page: https://patentgrep.com/patent/US10482413B2 ## CPC - G06Q 10/0832: Special goods or special handling procedures, e.g. handling of hazardous or fragile goods - G06F 21/44: Program or device authentication - G06F 21/606: {by securing the transmission between two devices or processes} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - G06F 2221/2129: Authenticate client device independently of the user - G06Q 2220/10: Usage protection of distributed data files - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A client-side data transfer tool may be used to encrypt customer data and store the encrypted data onto a shippable data storage device. The shippable storage device is provided to the client by a remote storage service provider for importing the customer data into the service provider. The data transfer tool receives client-keys from the service provider, separate from the shippable storage device. The data transfer tool generates keys to encrypt the customer data. The data transfer tool then uses the client-keys received from the service provider to encrypt the tool-generated keys. The encrypted data and the encrypted tool-generated keys are transferred onto the shippable storage device. Data transfer techniques may take into account characteristics of the data source and the data destination. For multiple shippable storage devices, data transfer may occur in parallel. The shippable storage device is then shipped back to the service provider, which imports the data. ## Claims ### Claim 1 A system, comprising: one or more computing devices connected to a network of a client site; one or more storage devices attached to the network of the client site; at least one shippable storage device provided by a remote storage provider, wherein the at least one shippable storage device is attached to the network of the client site; and a data transfer tool implemented on at least one of the one or more computing devices, wherein the data transfer tool is configured to: obtain, from a remote storage service provider, at least one encryption key; identify data stored on the one or more storage devices to be imported to a storage service of the remote storage service provider; obtain the identified data from the one or more storage devices; generate one or more encryption keys for encrypting the identified data; encrypt the identified data using the one or more generated encryption keys to generate encrypted data; encrypt the one or more generated encryption keys using the at least one encryption key provided by the remote storage service provider to generate an encrypted one or more generated encryption keys for sending to the remote storage service provider; transfer the encrypted data to the at least one shippable storage device; and in response to completion of the transferring of the encrypted data to the at least one shippable storage device, indicate that the at least one shippable storage device is ready for shipment to the remote storage service provider. ### Claim 2 (depends on 1) The system as recited in claim 1, wherein the data transfer tool is further configured to: store the encrypted data and the encrypted one or more generated encryption keys onto the at least one shippable storage device and indicate that the at least one shippable storage device is ready for shipment to the remote storage service provider without the identified data and the one or more generated encryption keys being stored on the shippable storage device in an unencrypted form. ### Claim 3 (depends on 1) The system as recited in claim 1, wherein: to obtain the identified data, the data transfer tool is further configured to: obtain one or more files; and create a plurality of chunks of data from each of the one or more files; to generate the one or more encryption keys, the data transfer tool is further configured to generate a separate encryption key for each of the plurality of chunks of data; and to encrypt the identified data, the data transfer tool is further configured to encrypt each of the plurality of chunks of data using a respective encryption key of the one or more generated encryption keys. ### Claim 4 (depends on 1) The system as recited in claim 1, wherein to send the encrypted one or more encryption keys to the remote storage service provider, the data transfer tool is further configured to: transfer the encrypted one or more generated encryption keys to the at least one shippable storage device or transmit the encrypted one or more generated encryption keys to the storage service provider via a communication network, separate from the shippable storage device. ### Claim 5 A method, comprising: performing, by a data transfer tool implemented on one or more computing devices of a network of a client site: obtaining, from a remote storage service provider, at least one encryption key; identifying data stored on one or more storage devices of the network to be imported to a storage service of the remote storage service provider; obtaining the identified data from the one or more storage devices; generating one or more encryption keys for encrypting the identified data; encrypting the identified data using the one or more generated encryption keys to generate encrypted data; encrypting the one or more generated encryption keys using the at least one encryption key provided by the remote storage service provider to generate an encrypted one or more generated encryption keys to be communicated to the remote storage service provider; transfer the encrypted data to the at least one shippable storage device provided by the remote storage provider and attached to the network; and in response to completion of the transferring of the encrypted data to the at least one shippable storage device, indicating that the at least one shippable storage device is ready for shipment to the remote storage service provider. ### Claim 6 (depends on 5) The method as recited in claim 5, further comprising storing the encrypted data and the encrypted one or more generated encryption keys onto the at least one shippable storage device and indicating that the at least one shippable storage device is ready for shipment to the remote storage service provider without the identified data and the one or more generated encryption keys being stored on the shippable storage device in an unencrypted form. ### Claim 7 (depends on 5) The method as recited in claim 5, wherein: the obtaining of the identified data from the one or more storage devices of the network comprises: obtaining one or more files; and creating a plurality of chunks of data from each of the one or more files; the generating of the one or more encryption keys comprises generating a separate encryption key for each of the plurality of chunks of data; and the encrypting of the identified data comprises encrypting each of the plurality of chunks of data using a respective encryption key of the one or more generated encryption keys. ### Claim 8 (depends on 5) The method as recited in claim 5, further comprising: obtaining, from the remote storage service provider, security information; and authenticating, based on the security information, the at least one shippable storage device. ### Claim 9 (depends on 5) The method as recited in claim 5, wherein the obtaining, from the remote storage service provider, the at least one encryption key comprises downloading the at least one encryption key from the remote storage service provider via a communication network separate from the at least one shippable storage device. ### Claim 10 (depends on 5) The method as recited in claim 5, wherein the communicating of the encrypted one or more generated encryption keys to the remote storage service provider comprises transferring the encrypted one or more generated encryption keys to the at least one shippable storage device. ### Claim 11 (depends on 5) The method as recited in claim 5, wherein the communicating of the encrypted one or more generated encryption keys to the remote storage service provider comprises transmitting the encrypted one or more encryption keys to the remote storage service provider via a communication network, separate from the at least one shippable storage device. ### Claim 12 (depends on 5) The method as recited in claim 5, further comprising: discovering a plurality of the shippable storage devices attached to the network; and determining a data transfer plan for transferring the encrypted data to the plurality of the shippable storage devices, wherein the transferring of the encrypted data comprises transferring a different portion of the encrypted data to each of the plurality of the shippable storage devices in parallel. ### Claim 13 (depends on 12) The method as recited in claim 12, wherein the determining of the data transfer plan is based on at least one of: a characteristic of a data source of the identified data; or a characteristic of a storage destination of the identified data at the storage service provider. ### Claim 14 A non-transitory computer-readable storage medium storing program instructions that, when executed by one or more computing devices of a network of a client site, cause the one or more computing devices to implement: identifying data stored on one or more storage devices of the network to be imported to a storage service of a remote storage service provider; obtaining the identified data from the one or more storage devices; generating one or more encryption keys for encrypting the identified data; encrypting the identified data using the one or more generated encryption keys to generate encrypted data; encrypting the one or more generated encryption keys using at least one encryption key stored by the remote storage service provider to generate an encrypted one or more generated encryption keys to be communicated to the remote storage service provider; transferring the encrypted data to at least one shippable storage device provided by the remote storage provider and attached to the network; and in response to completion of the transferring of the encrypted data to the shippable storage device, indicating that the shippable storage device is ready for shipment to the remote storage service provider. ### Claim 15 (depends on 14) The non-transitory, computer-readable storage medium of claim 14, wherein the program instructions cause the one or more computing devices to further implement: storing the encrypted data and the encrypted one or more generated encryption keys onto the at least one shippable storage device and indicating that the at least one shippable storage device is ready for shipment to the remote storage service provider without the identified data and the one or more generated encryption keys being stored on the shippable storage device in an unencrypted form. ### Claim 16 (depends on 14) The non-transitory, computer-readable storage medium of claim 14, wherein the at least one encryption key is provided by the remote storage service provider to the client separate from the shippable storage device or is provided by the client to the remote storage service provider separate from the shippable storage device. ### Claim 17 (depends on 14) The non-transitory, computer-readable storage medium of claim 14, wherein the program instructions cause the one or more computing devices to further implement: obtaining, from the remote storage service provider, security information; and authenticating, based on the security information, the at least one shippable storage device. ### Claim 18 (depends on 14) The non-transitory, computer-readable storage medium of claim 14, wherein the program instructions cause the one or more computing devices to further implement: discovering a plurality of the shippable storage devices attached to the network; generating a plurality of shards based at least on the identified data and a redundancy encoding technique, wherein the encrypting of the identified data comprises encrypting each of the plurality of shards using the one or more generated encryption keys to generate a plurality of encrypted shards; and identifying a subset of the plurality of encrypted shards, wherein the transferring of the encrypted data comprises transferring each shard of the subset of the plurality of shards to a respective one of the shippable storage devices. ### Claim 19 (depends on 18) The non-transitory, computer-readable storage medium of claim 18, wherein the transferring of each of the subset of the plurality of shards to a respective one of the shippable storage devices is performed in parallel. ### Claim 20 (depends on 18) The non-transitory, computer-readable storage medium of claim 18, wherein when the plurality of the shippable storage devices are shipped to the remote storage service provider, at least one of the generated plurality of shards is retained at the client site.