Data security service
AssigneeAmazon Technologies, Inc.
InventorsGregory Branchek Roth, Matthew James Wren, Eric Jason Brandwine, Brian Irl Pratt
Life of this patent
Estimating the term…
Abstract
A distributed computing environment utilizes a cryptography service. The cryptography service manages keys securely on behalf of one or more entities. The cryptography service is configured to receive and respond to requests to perform cryptographic operations, such as encryption and decryption. The requests may originate from entities using the distributed computing environment and/or subsystems of the distributed computing environment.
Claims25
A computer-implemented method for providing services, comprising:
- under the control of one or more computer systems configured with executable instructions,
- receiving, from a requestor, a request to retrieve a data object from a data storage system;
- in response to the request to retrieve the data object, providing an encrypted data object and an encrypted first key that, when decrypted, is usable to decrypt the encrypted data object;
- receiving, from the requestor, the encrypted first key;
- decrypting, by a cryptography service, the encrypted first key using a second key that is accessible to the cryptography service but inaccessible to the data storage system;
- and
- providing the first key to the requestor to enable the requestor to use the first key to decrypt the encrypted data object.
A computer-implemented method for providing services, comprising:
- under the control of one or more computer systems configured with executable instructions,
- in response to a request to store a data object in a data storage system:
- causing the data object to be encrypted;
- and
- storing the data object in encrypted form in the data storage system such that a key inaccessible to the data storage system is required for decrypting the data object from encrypted form;
- using the key at the cryptography system to provide, to an authorized entity, information that enables the authorized entity to access the data object in decrypted form from encrypted form.
A system, comprising:
- a service configured to:
- receive a data object;
- and
- encrypt the data object;
- and
- store the encrypted data object in a manner rendering the service unable to decrypt the encrypted data object;
- and
- a cryptography subsystem configured to:
- encrypt information necessary to decrypt the encrypted data object using a key that is inaccessible to the service;
- and
- decrypt the encrypted information on request of an entity, that is different from the service and that is authorized to make requests.
A computer-readable storage medium having instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:
- obtain, from a remotely hosted data storage service, an encrypted data object and encrypted information that, when decrypted, is usable to decrypt the encrypted data object;
- cause a remotely hosted cryptography service to decrypt the encrypted information necessary for decrypting the encrypted data object;
- and
- use the decrypted information to decrypt the encrypted data object.
Dependencies are inferred from the claim text.