Encrypted purging of data from content node storage
AssigneeFastly, Inc.
InventorsTyler B. McMullen, Artur Bergman
Life of this patent
Estimating the term…
Abstract
Described herein are methods, systems, and software for encrypting and erasing data objects in a content node. In one example, a method of operating a content node that caches content divided into one or more data objects includes encrypting the one or more data objects using separate encryption keys for each of the one or more data objects, the separate encryption keys comprising a common portion shared by the one or more data objects and an individualized portion unique to each data object. The method further provides receiving a purge request to erase at least one data object and, responsive to the purge request, erasing at least one of the common portion or the individualized portion for the at least one data object based on the purge request.
Claims18
A method of operating a content node that caches data objects between origin servers and end user devices, the method comprising:
- encrypting the data objects using encryption keys, wherein each of the encryption keys is unique to each of the data objects, and wherein each of the encryption keys comprises a first portion shared by the encryption keys and a second portion unique to each encryption key;
- receiving a purge request to erase at least one data object;
- in response to the purge request, identifying whether the purge request indicates a request to purge a subset of the data objects that is less than all of the data objects or a request to erase all of the data objects;
- if the purge request indicates a request to purge a subset of the plurality of data objects, erasing the second portion of at least one encryption key in the encryption keys associated with the at least one data object;
- and
- if the purge request indicates a request to erase all of the data objects, erasing the first portion of the encryption keys.
A content node that purges content based on purge requests, the content node comprising:
- a storage system configured to store data objects encrypted using encryption keys, wherein each of the encryption keys is unique to each of the data objects, and wherein each of the encryption keys comprises a first portion shared by the encryption keys and a second portion shared by the encryption keys and a second portion unique to each encryption key;
- a processing system configured to:
- receive a purge request to erase at least one data object;
- in response to the purge request, identify whether the purge request indicates a request to purge a subset of the data objects that is less than all of the data objects or a request to erase all of the data objects;
- if the purge request indicates a request to purge a subset of the plurality of data objects, erase the second portion of at least one encryption key in the encryption keys associated with the at least one data object;
- and
- if the purge request indicates a request to erase all of the data objects, erase the first portion of the encryption keys.
An apparatus to purge cache and purge data objects in a content node, the apparatus comprising:
- at least one computer readable media;
- and
- processing instructions stored on the at least one computer readable media that, when executed by a processing system, direct the processing system to:
- encrypt the data objects using encryption keys, wherein each of the encryption keys is unique to each of the data objects, and wherein each of the encryption keys comprises a first portion shared by the encryption keys and a second portion unique to each encryption key;
- in response to the purge request, identify whether the purge request indicates a request to purge a subset of the data objects that is less than all of the data objects or a request to erase all of the data objects;
- if the purge request indicates a request to purge a subset of the plurality of data objects, erase the second portion of at least one encryption key in the encryption keys associated with the at least one data object;
- if the purge request indicates a request to erase all of the data objects, erase the first portion of the encryption keys.
Dependencies are inferred from the claim text.