Back to results
US 9,544,140 B1Granted
Multi-level key hierarchy for securing cloud-based data sets
AssigneeAmazon Technologies, Inc.
InventorsManish Ramesh Bhatia, Praveen Reddy, Phanikumar Bhamidipati
Life of this patent
Estimating the term…
Abstract
A hierarchy is defined that includes encryption keys associated with different first and second levels of the hierarchy, where the second level includes fewer of the encryption keys than the first level. The encryption keys of the first level secure a plurality of data objects. The encryption keys of the first level are grouped into key groups that respectively include one or more of the encryption keys of the first level. The one or more of the encryption keys of the first level included in each of the key groups are secured with a respective one of the encryption keys of the second level.
Claims25
A computer implemented method for securing data objects in a cloud, the method comprising:
- defining a hierarchy comprising encryption key objects associated with first and second levels of the hierarchy, wherein the second level comprises fewer of the encryption key objects than the first level;
- dividing a plurality of data objects into data groups respectively including ones of the plurality of data objects;
- assigning respective ones of the encryption key objects of the first level to the data groups;
- encrypting the ones of data objects included in the data groups using the respective ones of the encryption key objects of the first level assigned thereto;
- storing the plurality of data objects in a networked computer data storage responsive to the encrypting thereof;
- dividing the encryption key objects of the first level into key groups respectively including one or more of the encryption key objects of the first level;
- assigning respective ones of the encryption key objects of the second level to the key groups, wherein the one or more of the encryption key objects of the first level included in the key groups is configured to be decrypted using the respective one of the encryption key objects of the second level assigned thereto;
- and
- rotating the encryption key objects of the second level in accordance with a requirement of a service level agreement without retrieving the plurality of data objects from the networked computer data storage.
6 more elements
A computer implemented method for securing data objects, the method comprising:
- defining, via at least one of one or more computing devices, a hierarchy comprising encryption keys associated with different first and second levels of the hierarchy, wherein:
- the first and second levels comprise ones of a number of levels of the hierarchy,
- defining the hierarchy comprises dynamically altering a quantity of the encryption keys associated with the levels of the hierarchy to provide a desired key-to-data ratio,
- the encryption keys of the first level secure a plurality of data objects, the plurality of data objects being stored in a networked computer data storage, and
- the second level comprises fewer of the encryption keys than the first level;
- grouping, via at least one of the one or more computing devices, the encryption keys of the first level into key groups respectively comprising one or more of the encryption keys of the first level;
- securing, via at least one of the one or more computing devices, the one or more of the encryption keys of the first level included in the key groups with a respective one of the encryption keys of the second level;
- and
- rotating, via at least one of the one or more computing device, the encryption keys of the second level without retrieving the plurality of data objects from the networked computer data storage.
6 more elements
A system for securing data objects, the system comprising:
- at least one computing device configured to implement one or more services, wherein the one or more services are configured to:
- define a hierarchy comprising encryption keys associated with different first and second levels of the hierarchy, wherein:
- the first and second levels comprise ones of a number of levels of the hierarchy,
- the one or more services are further configured to dynamically adjust at least one of the number of levels of the hierarchy or a quantity of the encryption keys associated with the levels of the hierarchy to provide a desired key-to-data ratio,
- the second level comprises fewer of the encryption keys than the first level, and
- the encryption keys of the first level secure a plurality of data objects stored in a networked computer data storage;
- group the encryption keys of the first level into key groups respectively comprising one or more of the encryption keys of the first level, and secure the one or more of the encryption keys of the first level included in the key groups with a respective one of the encryption keys of the second level;
- and
- rotate the encryption keys of the second level without retrieving the plurality of data objects from the networked computer data storage.
6 more elements
Dependencies are inferred from the claim text.