# US 10,503,917 B2 · Performing operations on intelligent storage with hardened interfaces > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,503,917 B2 - Document ID: US10503917B2 - Status: Granted - Kind: B2 - Application number: 16/186,893 - Filed: 2018-11-12 - Published: 2019-03-14 - Granted: 2019-12-10 - Earliest claimed: 2015-03-30 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Gregory B. Roth; Eric Jason Brandwine - Web page: https://patentgrep.com/patent/US10503917B2 ## CPC - G06F 21/602: {Providing cryptographic facilities or services} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A storage device can include processing and cryptographic capability enabling the device to function as a hardware security module (HSM). This includes the ability to encrypt and decrypt data using a cryptographic key, as well as to perform processing using such a key, independent of whether that processing involves data stored on the device. An internal key can be provided to the drive, whether provided before customer software access or received wrapped in another key, etc. That key enables the device to perform secure processing on behalf of a user or entity, where that key is not exposed to other components in the network or environment. A key may have specified tasks that can be performed using that key, and can be discarded after use. In some embodiments, firmware is provided that can cause a storage device to function as an HSM and/or processing device with cryptographic capability. ## Claims ### Claim 1 A storage device, comprising: at least one non-transitory computer-readable storage medium for storing data; at least one processor configured to perform cryptographic processing; and memory including instructions that, when executed by the at least one processor, cause the storage device to: operate in a key provisioning mode, during which access to at least a designated portion of the storage device is prevented while generating an internal key; receive, at the storage device, data encrypted under the internal key; determine, using the at least one processor, the internal key from a plurality of internal keys stored by the storage device; and decrypt, in the storage device, at least a portion of the data using the internal key. ### Claim 2 (depends on 1) The storage device of claim 1, wherein the instructions when executed further cause the storage device to: prevent access to at least one of data or other keys stored on the storage device while the storage device is operating in the key provisioning mode. ### Claim 3 (depends on 1) The storage device of claim 1, wherein the instructions when executed further cause the storage device to: delete any previously-stored internal keys upon operating in the key provisioning mode. ### Claim 4 (depends on 1) The storage device of claim 1, wherein the instructions when executed further cause the storage device to: prevent access to the internal key by a provider of the storage device. ### Claim 5 (depends on 1) The storage device of claim 1, wherein the instructions when executed further cause the storage device to: receive a request to provision a new internal key; and cause the storage device to operate in the key provisioning mode before at least one of receiving, reading, or decrypting the new internal key. ### Claim 6 (depends on 1) The storage device of claim 1, wherein the instructions when executed further cause the storage device to: perform at least one operation on the portion of the data; and determine that each operation of the at least one operation corresponds to a respective allowable task, associated with the internal key, before performing the at least one operation. ### Claim 7 A computer-implemented method, comprising: causing a storage device of a resource environment to operate in a key provisioning mode wherein access to at least a designated portion of the storage device is prevented; receiving, at the storage device of a resource environment, an internal key during the key provisioning mode, the storage device including at least one processor configured to perform cryptographic processing; decrypting the internal key; and causing the internal key to be securely stored in the storage device. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, further comprising: preventing a provider of the storage device from having access to the internal key stored by the storage device. ### Claim 9 (depends on 7) The computer-implemented method of claim 7, further comprising: receiving a request associated with data encrypted under the internal key; determining, in the storage device, the internal key from a plurality of internal keys stored by the storage device; decrypting the data using the internal key; performing at least one operation, associated with the request, on the data using at least one processor of the storage device; and causing a result of the at least one operation to be transmitted to a destination associated with the request. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, further comprising: transferring, as part of the at least one operation, at least a portion of the data between the storage device and at least one additional storage device in the resource environment. ### Claim 11 (depends on 9) The computer-implemented method of claim 9, further comprising: decrypting the data included with the request; and returning the data, after the decrypting, without storing the data or causing the data to be available outside cryptographic hardware of the storage device. ### Claim 12 (depends on 7) The computer-implemented method of claim 7, further comprising: enabling at least one operation to be performed on the storage device; determining the at least one operation is based at least in part upon the internal key, the at least one operation including at least one of a de-duplication operation, a replication operation, or a compression operation. ### Claim 13 (depends on 7) The computer-implemented method of claim 7, wherein: decrypting the internal key comprises decrypting the internal key using an external key, the internal key is exportable when encrypted, and once decrypted, unexportable from the storage device. ### Claim 14 (depends on 7) The computer-implemented method of claim 7, further comprising: causing the storage device to operate in the key provisioning mode for decrypting and storing the internal key; and causing the storage device to operate in an operational mode for performing operations on behalf of the customer. ### Claim 15 A computer-implemented method, comprising: causing a storage device of a resource environment to operate in a key provisioning mode wherein access to at least a designated portion of the storage device is prevented; receiving, at the storage device of a resource environment, data encrypted under an internal key during the key provisioning mode, the storage device including at least one processor configured to perform cryptographic processing; and decrypting, in the storage device, the data using the internal key. ### Claim 16 (depends on 15) The computer-implemented method of claim 15, further comprising: causing the storage device to operate in an operational mode wherein the storage device is unable to receive new internal keys. ### Claim 17 (depends on 15) The computer-implemented method of claim 15, wherein the internal key is exportable when encrypted, and once decrypted, unexportable from the storage device. ### Claim 18 (depends on 15) The computer-implemented method of claim 15, further comprising: performing, using the data, at least one operation, the at least one operation includes aggregating the data, after the decrypting, into a result without storing the data on the storage device or making the data accessible outside the storage device. ### Claim 19 (depends on 15) The computer-implemented method of claim 15, wherein a provider of the storage device is prevented from having access to the internal key or the data after decrypting, in the storage device. ### Claim 20 (depends on 18) The computer-implemented method of claim 18, further comprising: encrypting the result, using at least one of the internal key or a second key, before the result is exported.