Preventing persistent storage of cryptographic information using signaling

Patent metadata

Field	Value
Publication number	US-2016127336-A1
Application number	US-201614992980-A
Country	US
Kind code	A1
Filing date	Jan 11, 2016
Priority date	Nov 12, 2013
Publication date	May 5, 2016
Grant date	—

Abstract

Organizations maintain and generate large amounts of sensitive information using computer hardware resources and services of a service provider. Furthermore, there is a need to be able to delete large amounts of data securely and quickly by encrypting the data with a key and destroying the key. To ensure that information stored remotely is secured and capable of secure deletion, cryptographic keys used by the organization should be prevented from being persistently stored during serialization operations. Signaling methods are used to notify virtual machine instances of serialization events in order to prevent keying material from being stored persistently.

First claim

What is claimed is:

1 . A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
execute a hypervisor that controls interaction between a computer system instances and physical hardware of the system; expose two functions to the computer system instances, the two functions including at least:
a first function that causes one or more cryptographic keys maintained by the computer system instances to be unavailable for inclusion in serialization data; and
a second function that restores the one or more cryptographic keys to the computer system instances;
determine that a serialization event is to occur; cause the hypervisor to signal the computer system instance that the serialization event is scheduled to occur by at least calling the first function, prior to the serialization event such that one or more cryptographic keys contained in the computer system instance is made unavailable for inclusion in serialization data; and generate serialization data lacking the one or more cryptographic keys as a result of the first function having been called.

2 . The non-transitory computer-readable storage medium of claim 1 , wherein the instructions that cause the system to generate serialization data further comprise instructions that, when executed by the one or more processors, cause the computer system to generate the serialization data as a result of receiving an indication from the computer system instance that the first function executed successfully.

3 . The non-transitory computer-readable storage medium of claim 1 , wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to restore the one or more cryptographic keys to the computer system instances by at least calling the second function after generating serialization data.

4 . The non-transitory computer-readable storage medium of claim 1 , wherein the first function causes the one or more cryptographic keys to be unavailable for inclusion in serialization data by determining an area of memory of the computer system instance containing the one or more cryptographic keys and excluding data stored in the area of memory from serialization data.

5 . A system, comprising:
one or more processors; memory that includes instructions that, when executed by the one or more processors, cause the system to:
execute a hypervisor and a guest computer system;
expose at least two functions to the guest computer system, the at least two functions comprising at least:
a first function of the at least two functions configured to cause a cryptographic key contained by the guest computer system to be unavailable during serialization events; and
a second function of the at least two functions configured to restore the cryptographic key to the guest computer system;

signal to the guest computer system that serialization will occur by at least causing the guest computer system to execute the first function; and
provide the cryptographic key to the guest computer system by at least calling the second function.

6 . The system of claim 5 , wherein the hypervisor, after the serialization event, provides the cryptographic key to the guest computer system by at least requesting, from a security module, the cryptographic key to be provided to the guest computer system.

7 . The system of claim 5 , wherein the memory further includes instructions that, when executed by the one or more processors, cause the system to perform serialization as a result of receiving an indication from the guest computer system that the cryptographic key has been destroyed.

8 . The system of claim 5 , wherein signaling to the guest computer system that the serialization event will occur further comprises writing information corresponding to the serialization event to a network location accessible by the guest computer system.

9 . The system of claim 5 , wherein the memory further includes instructions that, when executed by the one or more processors, cause the system to generate an audit log including information corresponding to the cryptographic key.

10 . The system of claim 5 , wherein the memory further includes instructions that, when executed by the one or more processors, cause the system to perform serialization as a result of receiving an indication from the guest computer system that the cryptographic key has been obfuscated as a result of the guest computer system executing the first function.

11 . The system of claim 5 , wherein signaling to the guest computer system that serialization will occur further comprises sending an interrupt through a device driver attached to the guest computer system.

12 . The system of claim 5 , wherein the memory further includes instructions that, when executed by the one or more processors, cause the system to request the cryptographic key be restored by a cryptographic security module as a result of calling the second function further comprises after the serialization event.

13 . A computer-implemented method, comprising:
under the control of one or more computer systems configured with executable instructions,
exposing, to a computer system instance, at least two functions, the at least two functions comprising:
a first function configured to cause sensitive information contained in memory of the computer system instance to be unavailable for inclusion in serialization data; and
a second function configured to restore the sensitive information to the computer system instance;

detecting, by a hypervisor, that an event will occur which will expose sensitive information of the computer system instance;
signaling the event will occur to the computer system instance by at least calling the first function; and
at a time after signaling the event will occur, generating serialization data based at least in part on the computer system instance.

14 . The computer-implemented method of claim 13 , wherein the computer-implemented method further comprises preventing plaintext representations of sensitive information from being stored persistently in serialization data by at least encrypting sensitive information with a cryptographic key as a result of calling the first function.

15 . The computer-implemented method of claim 13 , wherein generating serialization data based at least in part on the computer system instance further comprises waiting for a response indicating that sensitive information has been deleted before generating serialization data.

16 . The computer-implemented method of claim 13 , wherein generating serialization data based at least in part on the computer system instance further comprises generating serialization data as a result of a time interval expiring.

17 . The computer-implemented method of claim 13 , wherein the computer-implemented method further comprises detecting one or more non-contiguous areas of memory of the computer system instance containing sensitive information and preventing the one or more non-contiguous areas of memory from being included in serialization data as a result of calling the first function.

18 . The computer-implemented method of claim 13 , wherein the computer-implemented method further comprises tracing an audit log to ensure sensitive information was not included in serialization data.

19 . The computer-implemented method of claim 13 , wherein the computer-i

Assignees

• Amazon Tech Inc

Inventors

• Cignetti Todd Lawrence
• Brandwine Eric Jason
• Fitzgerald Robert Eric
• Doane Andrew J

Classifications

• G06F2221/2143

  Clearing memory, e.g. to prevent the data from being stolen · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06F2221/2101

  Auditing as a secondary aspect · CPC title

• H04L63/061 Primary

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title