Authenticated storage operations
AssigneeAmazon Technologies, Inc.
InventorsGregory Branchek Roth, Eric Jason Brandwine
Life of this patent
Estimating the term…
Abstract
Data storage operation commands are digitally signed to enhance data security in a distributed system. A data storage client and a data storage node may share access to a cryptographic key. The data storage client uses the cryptographic key to digitally sign commands transmitted to the data storage node. The data storage node uses its copy of the cryptographic key to verify a digital signature of a command before fulfilling the command. The command may include a log of database transactions to process.
Claims26
A computer-implemented method, comprising:
- receiving, from a key management system comprising one or more computing devices, a cryptographic key;
- receiving, at a first server, a request to perform a database query, the request being in accordance with an application level protocol;
- as a result of receipt of the request, generating, by a client application of a virtual machine instance running on the first server, an input/output command indicating a block address of a block to be operated upon to fulfill the input/output command;
- generating, based at least in part on the cryptographic key and the input/output command, a digital signature of the input/output command;
- and
- transmitting the generated input/output command and the generated digital signature to a second server operable to use the cryptographic key to verify the digital signature and, as a result of the digital signature being verified, fulfill the generated input/output command by performing the input/output command on a storage volume stored on the second server.
A system of a computing resource service provider, comprising:
- a first computing device operable to:
- receive, from a computing device associated with a customer of the computing resource service provider, a request to perform a data storage operation;
- as a result of receipt of the request, use a cryptographic key to generate a digital signature for a block-level data storage operation command indicating a set of blocks to be operated on to fulfill the data storage operation command, the cryptographic key obtained by the first computing device as a result of an association of the cryptographic key with the customer;
- and
- transmit the digital signature and the data storage operation command to a second computing device;
- the second computing device operable to:
- receive the transmitted digital signature and the data storage operation command;
- verify the digital signature, using the cryptographic key, for the data storage operation command;
- and
- as a result of verifying the digital signature, fulfill the data storage operation command by operating on the set of blocks indicated in the block-level data storage command, the set of blocks associated with at least one storage of the second computing device.
One or more non-transitory computer-readable storage media having collectively stored thereon executable instructions that, upon execution by one or more processors of a data storage node, cause the data storage node to at least:
- receive a block-level input/output command and a digital signature of the block level input/output command, the block-level input/output command including information identifying a set of block addresses to which the data storage node is to perform a storage operation and the digital signature generated by a cryptographic key;
- obtain the cryptographic key;
- verify the digital signature of the block-level input/output command using the cryptographic key;
- and
- as a result of the digital signature of the block-level input/output command being verified using the cryptographic key, fulfill the block-level input/output command by performing the block-level input/output command on at least one storage of the data storage node.
Dependencies are inferred from the claim text.