Inline data encryption

Patent metadata

Field	Value
Publication number	US-9515997-B1
Application number	US-201313946963-A
Country	US
Kind code	B1
Filing date	Jul 19, 2013
Priority date	Jul 19, 2013
Publication date	Dec 6, 2016
Grant date	Dec 6, 2016

Abstract

Organizations maintain and generate large amount of sensitive information that needs to be saved electronically and there is a need to store that data remotely with a data storage service provider. To prevent unauthorized access to the information stored by organizations on storage provided by the service provider special cryptographic devices, such as an Inline Data Encryptor, can be used to ensure that the information remains secret. The Inline Data Encryptor uses a fill device with secret cryptographic information to encrypt data.

First claim

What is claimed is:

1. A system, comprising:
a fill device reader configured to receive a fill device and obtain information stored on the fill device;
a device interface for communicating with one or more user devices;
one or more processors; and
memory storing executable instructions that causes the one or more processors of the cryptographic device to collectively:
obtain cryptographic information from the fill device through the fill device reader;
use the obtained cryptographic information to encrypt data received from another device received through the device interface;
obtain credentials for accessing a data storage service operated by a service provider including a user private key stored on the fill device;
generate a signature using the user private key; and
use the obtained credentials to transmit, to a computer system of the data storage service over a service provider network operated by the service provider, the encrypted data and the signature to the data storage service of the service provider, validation of the signature indicating authorization for at least one operation performed by the data storage service.

2. The system of claim 1 , wherein:
the cryptographic device receives a request from a user on a device through the device interface to perform an operation on the data;
performance of the operation involves at least one cryptographic process; and
the device establishes a connection between the device and the cryptographic device.

3. The system of claim 1 , wherein:
the user establishes a physical connection between the cryptographic device and the user device through the device interface;
the user inputs credentials in to the cryptographic device through a user interface on the cryptographic device; and
the physical connection is used to transmit data to the cryptographic device.

4. The system of claim 1 , wherein the encrypted data is encrypted using a stream cipher operation.

5. The system of claim 1 , wherein the cryptographic information obtain from the fill device through fill device reader is unknown to the service provider.

6. A cryptographic device comprising:
an object detector for detecting a presence of a physical object;
an interface for communicating with one or more devices; and
memory storing executable instructions that causes one or more processors of the cryptographic device to collectively or individually:
retrieve cryptographic information from the object;
uses the retrieved cryptographic information to encrypt data received through the interface from a device;
obtain credentials, where demonstration of access to the credentials authorizes operations to be performed by a service provider, the credentials including a private key;
generate an electronic signature based at least in part on the private key; and
transmit the encrypted data and information demonstrating access to the credentials to the service provider thereby causing the service provider to persistently store the encrypted data based at least in part on the credentials, where the information demonstrating access to the credentials includes the electronic signature.

7. The system of claim 6 , wherein the cryptographic information use to encrypted the data received through the interface from the device is stored on memory of the cryptographic device.

8. The system of claim 6 , wherein the cryptographic device operates as a proxy between the device and the service provider.

9. The system of claim 6 , wherein the credentials are inputted by a user into the device and obtained by the cryptographic device through the interface.

10. The system of claim 6 , wherein the interface for communicating with one or more devices is a serial attachment (SATA), fiber channel (FC-AL), internet small computer system interface (iSCSI), peripheral component interconnect (PCI) or peripheral component interconnect express (PCIE).

11. The system of claim 6 , wherein the interface for communicating with one or more devices is a virtual private network (VPN).

12. A computer-implemented method for encrypting data, comprising: under the control of a cryptographic device configured with executable instructions,
detecting through a key reader a presence of a physical key;
retrieving cryptographic information from the physical key;
obtaining credentials for authentication with a service provided by a service provider, the credentials including a private key;
obtaining through a device interface of the cryptographic device and from a data source external to the cryptographic device, data to be encrypted;
generating, by cryptographic device, a digital signature using the private key;
encrypting the data obtained through the device interface with the retrieved cryptographic information to generate encrypted data; and
transmitting a request to perform the service to the service provider, the request including the encrypted data and information indicating access to the credentials, the request being authenticated, by one or more computer systems of the service provider, based at least in part on the credentials, the information indicating access to the credentials including the digital signature.

13. The method of claim 12 , wherein:
the request to perform the service by the service causes the service provider to persistently store the encrypted data; and
the service provider lacks access to the cryptographic information used to encrypt the data causes to be persistently store.

14. The computer-implemented method of claim 12 , wherein:
the cryptographic information is obtained by the cryptographic device from the physical key through the key reader; and
encrypting the data is done by operation of a stream cipher.

15. The computer-implemented method of claim 12 , wherein detecting through the key reader of the cryptographic device the physical key further comprises inserting the physical key directly into the key reader.

16. The computer-implemented method of claim 12 , wherein the obtained credentials are used to encrypted the data.

17. A non-transitory computer-readable storage medium having stored thereon instructions that, when executed by one or more processors of a computer system, cause the computer system to:
detect a physical object; and
as a result of detecting the physical object, enabling the computer system to transfer information to an external data storage service operated by a service provider by at least:
using cryptographic information received from the physical object to encrypt data received through a device interface of the computer system; and
using credentials for accessing the service provider to transmit, to the external data storage service, an authentic request to store the encrypted data, the authentic request authenticated, by one or more computer systems associated with the external data storage service, based at least in part on the credentials, where the credentials include a user private key obtained from the physical object and the authentic request including a digital signature generated based at least in part on the user private key.

18. The non-transitory computer-readable storage medium of claim 17 , wherein the computer system transfers the encrypted data to the service provider over a direct connection to the service provider.

19. The non-transitory computer-readable storage medium of claim 17 , wherein the encrypted data is encrypted using a stream cipher operation.

20. The non-transitory computer-readable storage medium of claim 17 , wherein the compu

Assignees

• Amazon Tech Inc

Inventors

• Westman Michael
• Widom Jeffrey Harry
• Stella Josha Wind

Classifications

• H04L9/3247

  involving digital signatures · CPC title

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L9/065

  Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3 · CPC title

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/0471

  applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding · CPC title