Forced data transformation policy
AssigneeAmazon Technologies, Inc.
InventorsGregory Branchek Roth, Eric Jason Brandwine
Life of this patent
Estimating the term…
Abstract
Logical data containers of a data storage system are associated with policies that require data transformation of data to be stored in the logical data containers. When a data object is received to be stored in a logical data container, the data object is transformed in accordance with a policy on the logical data container. Transformation of the data object may include encryption. The logical data container may also be associated with a cryptographic key used to perform a required transformation.
Claims20
A computer-implemented method, comprising:
- obtaining a first request from a client device, the first request including a data object and indicating a logical data container as a storage location for the data object;
- and
- processing the first request by at least:
- causing a first portion of the data object to be encrypted using a cryptographic key to produce an encrypted data object based at least in part on a policy associated with the logical data container indicating that data objects stored in the logical data container are to be encrypted with the cryptographic key specified for the logical data container, the policy being specified for a customer account of a data storage service that provides the logical data container;
- and
- storing the encrypted data object in the logical data container.
A system, comprising:
- one or more processors;
- and
- memory that stores executable instructions that, as a result of being executed by the one or more processors, cause the system to:
- receive a first request to store a data object in a logical data container;
- and
- process the first request by at least:
- generating a second request to encrypt the data object using a cryptographic key based at least in part on a policy associated with the logical data container indicating that data objects stored in the logical data container are to be encrypted with the cryptographic key specified for the logical data container, the policy being specified for an account of a data storage service that provides the logical data container;
- causing the data object to be encrypted using the cryptographic key thereby generating an encrypted data object as a result of a cryptography service processing the first request;
- and
- causing the encrypted data object to be stored within the logical data container.
A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to:
- obtain a first request to associate a policy with a logical data container, the first request generated based at least in part on an interaction between a client device and a console interface of a data storage service providing the logical data container, the policy including at least a requirement that data objects stored in the logical data container are encrypted with a key specified for the logical data container and a customer account of the data storage service;
- and
- as a result of obtaining the first request, associate the key with the logical data container such that the data storage service performs various operations including at least:
- receiving a second request, through the console interface, to store a first data object in the logical data container;
- and
- storing an encrypted data object in the logical data container, the encrypted data object generated based at least in part on an encryption operation performed, by a second computer system distinct from the computer system, using at least the first data object and the key.
Dependencies are inferred from the claim text.