# US 2019/0319785 A1 · Encryption by default in an elastic computing system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0319785 A1
- Document ID: US20190319785A1
- Status: Published application
- Kind: A1
- Application number: 15/952,743
- Filed: 2018-04-13
- Published: 2019-10-17
- Earliest claimed: 2018-04-13
- Assignees: Amazon Technologies, Inc.
- Applicants: Amazon Technologies, Inc.
- Inventors: Sandeep Kumar; Danny Wei; Lalit Jain; Varun Verma; Oscar Allen Grim Courchaine; Kristina Kraemer Brenneman; Sriram Venugopal; Arvind Chandrasekar
- Web page: https://patentgrep.com/patent/US20190319785A1

## CPC

- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 63/0471: {applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding}
- H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation}
- H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 2463/062: applying encryption of the keys
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Generally described, one or more aspects of the present application correspond to techniques for creating encrypted block store volumes of data from unencrypted object storage snapshots of the volumes. These encryption techniques use a special pool of servers for performing the encryption. These encryption servers are not accessible to users, and they perform encryption and pass encrypted volumes to other block store servers for user access. The encryption context for the volumes can be persisted on the encryption severs for as long as needed for encryption and not shared with the user-facing servers in order to prevent user access to encryption context.

## Claims

### Claim 1

An elastic computing system, comprising:
a first set of servers having stored thereon an unencrypted object storage representation of data of a volume;
a second set of servers configured to store an encrypted block representation of the volume, wherein the second set of servers is configured with computer-executable instructions to handle user reads from and writes to the volume via the encrypted block representation of the volume; and
a third set of servers in data communication with the first set of servers and the second set of servers, the third set of servers configured with computer-executable instructions to:
receive the unencrypted object storage representation of the data of volume from the first set of servers,
receive an encryption context identifying an encrypted key to use for encrypting the volume,
store the encryption context in persistent memory on the third set of servers,
access a decrypted key representing decrypted contents of the encrypted key,
store the decrypted key on the third set of servers for use in encrypting the volume,
encrypt the volume using the decrypted key to generate the encrypted block representation of the volume, and
send the encrypted block representation of the volume to the second set of servers.

### Claim 2 (depends on 1)

The elastic computing system of claim 1, further comprising a key manager server, wherein the third set of servers is further configured with computer-executable instructions to:
request decryption of the encrypted key from the key manager server; and
receive the decrypted key from the key manager server, wherein the decrypted key corresponds to the decryption of the encrypted key by the key manager server.

### Claim 3 (depends on 1)

The elastic computing system of claim 1, wherein the third set of servers is configured with an identity that is authorized by the key manager server to access the decrypted key.

### Claim 4 (depends on 1)

The elastic computing system of claim 1, wherein the third set of servers is further configured with computer-executable instructions to:
store a block representation of the data of the volume based on the unencrypted object storage representation of the data of volume; and
for each block of the block representation of the data of the volume:
encrypt the block to generate an encrypted version of the block, and
send the encrypted version of the block to a server of the second set of servers.

### Claim 5 (depends on 4)

The elastic computing system of claim 4, wherein the block representation of the data of the volume stored on the third set of servers is not accessible for the user reads from or writes to the volume.

### Claim 6 (depends on 4)

The elastic computing system of claim 4, further comprising a network accessible to a user device requesting the user reads from or writes to the volume, wherein the second set of servers is accessible to the user device via the network, and wherein the third set of servers is not accessible to the user device.

### Claim 7 (depends on 1)

The elastic computing system of claim 1, wherein the third set of servers is further configured with computer-executable instructions to:
delete the block representation of the data of the volume after sending of the encrypted block representation of the volume to the second set of servers; and
after deleting the block representation of the data of the volume, delete the encryption context from the persistent memory.

### Claim 8 (depends on 1)

The elastic computing system of claim 1, wherein the second set of servers is further configured with computer-executable instructions to, in response to a request to decrypt the volume, identify the encryption context from a control plane of the elastic computing system.

### Claim 9

A computer-implemented method, comprising:
receiving a request to create an encrypted block representation of a volume from an unencrypted object representation of the volume;
accessing a first set of servers having stored thereon the unencrypted object representation of the volume;
creating, on a second set of servers, an unencrypted block representation of the volume;
providing an encryption context to the second set of servers, the encryption context identifying an encrypted key to use for encrypting the volume;
assigning the second set of servers an identity authorized to access a decrypted key representing decrypted contents of the encrypted key;
providing the decrypted key to the second set of servers for use in encrypting the volume;
encrypting the unencrypted block representation of the volume on the second set of servers using the decrypted key to generate the encrypted block representation of the volume; and
sending the encrypted block representation of the volume to a third set of servers configured to store the encrypted block representation of the volume, wherein the third set of servers is configured with computer-executable instructions to handle user reads from and writes to the volume via the encrypted block representation of the volume.

### Claim 10 (depends on 9)

The computer-implemented method of claim 9, further comprising requesting, by the second set of servers, decryption of the encrypted key from a key manager server.

### Claim 11 (depends on 10)

The computer-implemented method of claim 10, further comprising receiving, at the second set of servers, the decrypted key from the key manager server, wherein the decrypted key corresponds to the decryption of the encrypted encryption key by the key manager server.

### Claim 12 (depends on 11)

The computer-implemented method of claim 11, further comprising storing the encryption context in a persistent memory of the second set of servers.

### Claim 13 (depends on 12)

The computer-implemented method of claim 12, further comprising, after sending the encrypted block representation of the volume to a third set of servers, deleting the encryption context from the persistent memory.

### Claim 14 (depends on 9)

The computer-implemented method of claim 9, further comprising, for each block of the unencrypted block representation of the data of the volume:
encrypting the block on a server of the second set of servers to generate an encrypted version of the block, and
sending the encrypted version of the block to a server of the third set of servers.

### Claim 15 (depends on 8)

The computer-implemented method of claim 8, further comprising deleting the unencrypted block representation of the volume after sending the encrypted block representation of the volume to the third set of servers.

### Claim 16

Non-transitory computer-readable media comprising computer-executable instructions that, when executed on a computing system, cause the computing system to perform operations comprising:
receiving a request to create an encrypted representation of a volume from an unencrypted representation of the volume;
accessing data of the unencrypted representation of the volume a first set of servers having stored thereon the unencrypted representation of the volume;
creating, on a second set of servers, an additional unencrypted representation of the volume using the data of the unencrypted representation of the volume;
providing a decrypted key for encrypting the volume to the second set of servers;
encrypting the additional unencrypted representation of the volume on the second set of servers using the decrypted key to generate the encrypted representation of the volume;
sending the encrypted representation of the volume to a third set of servers configured to store the encrypted representation of the volume,
wherein the third set of servers is configured with computer-executable instructions to handle user reads from and writes to the volume via the encrypted block representation of the volume, and wherein additional unencrypted representation of the volume stored on the second set of servers is not accessible for the user reads from and writes to the volume.

### Claim 17 (depends on 16)

The non-transitory computer-readable media of claim 16, the operations further comprising:
providing the second set of servers with an encryption context identifying an encrypted key to use for encrypting the volume;
assigning the second set of servers an identity authorized to access a decrypted key representing decrypted contents of the encrypted key
requesting decryption of the encrypted encryption key from a key manager server.

### Claim 18 (depends on 17)

The non-transitory computer-readable media of claim 17, the operations further comprising receiving, at the second set of servers, the decrypted key from the key manager server, wherein the decrypted key corresponds to the decryption of the encrypted encryption key by the key manager server.

### Claim 19 (depends on 18)

The non-transitory computer-readable media of claim 18, the operations further comprising storing the encryption context in a persistent memory on the second set of servers.

### Claim 20 (depends on 19)

The non-transitory computer-readable media of claim 19, the operations further comprising, in response to a request to decrypt the volume:
deleting the decrypted key from the second set of servers;
identifying the encryption context from the persistent memory; and
requesting another decryption of the encrypted encryption key from the key manager server.