Data security service
AssigneeAmazon Technologies, Inc.
InventorsGregory Branchek Roth, Matthew James Wren, Eric Jason Brandwine, Brian Irl Pratt
Life of this patent
Estimating the term…
Abstract
A distributed computing environment utilizes a cryptography service. The cryptography service manages keys securely on behalf of one or more entities. The cryptography service is configured to receive and respond to requests to perform cryptographic operations, such as encryption and decryption. The requests may originate from entities using the distributed computing environment and/or subsystems of the distributed computing environment.
Claims29
A computer-implemented method for providing data storage services, comprising:
- under the control of one or more computer systems of a computing resource service provider, the one or more computer systems configured with executable instructions,
- receiving, from a customer of the computing resource service provider, a request to utilize a data storage service of the computing resource service provider;
- as a result of having received the request to utilize the data storage service, causing a cryptography service of the computing resource service provider to provide information encrypted by the cryptography service using a key that is inaccessible to the data storage service, the information usable to obtain the data object in unencrypted form and the key from a plurality of keys managed by the cryptography service on behalf of a plurality of customers of the computing resource service provider;
- and
- using the data storage service to store the encrypted information.
The computer-implemented method of 4, wherein using the information to provide the data object in response to the received request to retrieve the data object includes using the key to decrypt the encrypted data object.
A computer-implemented method for providing cryptographic services, comprising:
- under the control of one or more computer systems configured with executable instructions,
- as a result of a service receiving a first request to utilize the service, receiving a second request to perform one or more cryptographic operations that are necessary for fulfilling the first request;
- performing the requested one or more cryptographic operations;
- and
- providing one or more results of performing the requested one or more cryptographic operations to the service, the one or more results necessary for at least one manner of fulfilling the received request to utilize the service.
A computer system, comprising:
- one or more processors;
- and
- memory storing instructions executable by the one or more processors to cause the computer system to implement at least:
- a cryptography service configured to at least:
- store a plurality of keys such that the plurality of keys are inaccessible to a service different from the cryptography service;
- and
- upon detecting a request pending at the service, selecting a key from the plurality of keys and using the selected key to perform one or more cryptographic operations needed to fulfill the pending request.
A computer-readable storage medium having stored thereon instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:
- receive a request to utilize a service;
- as a result of having received the request to utilize the service:
- provide to a cryptography service proof, based at least in part on the request, that the request was received, thereby causing the cryptography service to use a key to perform one or more cryptographic operations on information that, after the one or more cryptographic operations have been performed, is usable to fulfill the request to utilize the service;
- and
- fulfill the request to utilize the service using the information on which the one or more cryptographic operations were performed.
Dependencies are inferred from the claim text.