Network file transfer

Patent metadata

Field	Value
Publication number	US-9560010-B1
Application number	US-201514673573-A
Country	US
Kind code	B1
Filing date	Mar 30, 2015
Priority date	Mar 30, 2015
Publication date	Jan 31, 2017
Grant date	Jan 31, 2017

Abstract

A technology is described for transferring a file from an unsecure network to a secure network. An example method may include identifying an unsecure account profile and determining that a file is to be transmitted from an unsecure network to a secure network using a one-way transfer device. In response, the file may be obtained from a file storage location and an unsecure account profile name for the unsecure account profile may be identified. A request may be made that the one-way transfer device to transmit the file and the unsecure account profile name to the secure network. The file and the unsecure account profile name may then be transmitted to the secure network, where a secure account profile corresponding to the unsecure account profile may be identified in the secure network and the file may be placed in a folder associated with the secure account profile.

First claim

What is claimed is:

1. A non-transitory machine readable storage medium having instructions embodied thereon, the instructions when executed by a processor:
identify an unsecure account profile and an unsecure account profile name located in an unsecure network that is associated with a transfer folder located in a first object storage service;
determine that the transfer folder contains a file that is to be transmitted to a secure network using a one-way transfer device that transmits data from the unsecure network to the secure network;
obtain the file from the transfer folder and place the file in a staging storage location;
generate a manifest file that includes a file hash value used to validate contents of the file;
generate a manifest hash value using a hash-based message authentication code (“HMAC”) that is used to validate contents of the manifest file;
append the manifest hash value to the manifest file; and
request that the one-way transfer device transmit the file, the unsecure account profile name, and the manifest file to the secure network, wherein the one-way transfer device obtains the file, the unsecure account profile name, and the manifest file from the staging storage location and transmits the file, the unsecure account profile name, and the manifest file to the secure network, where a secure account profile corresponding to the unsecure account profile is identified in the secure network using the unsecure account profile name and the file is placed in a folder in a second object storage service associated with the secure account profile.

2. A non-transitory machine readable storage medium as in claim 1 , wherein instructions that when executed by the processor prepare the file for transmission to the secure network by compressing the file using a data compression technique and dividing the file into a plurality of file parts.

3. A computer implemented method, comprising:
identifying an unsecure account profile located in an unsecure network that is associated with a file storage location, using the processor;
determining that a file is to be transmitted from the unsecure network to a secure network using a one-way transfer device that transmits data from the unsecure network to the secure network, using a processor;
obtaining the file from the file storage location, using the processor;
identifying an unsecure account profile name for the unsecure account profile, using the processor;
generating a manifest file that includes a file hash value used to validate contents of the file;
generating a manifest hash value using a hash-based message authentication code (“HMAC”) that is used to validate contents of the manifest file;
appending the manifest hash value to the manifest file;
requesting that the one-way transfer device transmit the file, the manifest file, and the unsecure account profile name to the secure network, using the processor, wherein the one-way transfer device obtains the file, the manifest file, and the unsecure account profile name from the storage location; and
transmitting the file and the manifest file to the secure network where a secure account profile corresponding to the unsecure account profile is identified using the unsecure account profile name; and
the file and the manifest file are placed in a folder associated with the secure account profile.

4. A method as in claim 3 , further comprising encrypting the file using an encryption key specified in the unsecure account profile and placing the file in the file storage location, wherein the file is decrypted prior to the one-way transfer device transmitting the file to the secure network.

5. A method as in claim 3 , further comprising:
associating the unsecure account profile with a first user having access to the unsecure network, wherein the unsecure account profile includes the unsecure account profile name; and
associating the secure account profile with a second user having access to the secure network, wherein the secure account profile includes a secure account profile name that is linked to the unsecure account profile name.

6. A method as in claim 3 , wherein determining that the file is to be transmitted further comprises, determining that a transfer folder contains a file folder and at least one file subfolder to be transmitted from the unsecure network to the secure network.

7. A method as in claim 6 , further comprising providing a diagnostic state of a file transfer via a graphical user interface by:
displaying the file in a transfer folder while the file is awaiting transfer to the secure network;
displaying the file in an in-progress folder while the file is being prepared for transfer to the secure network and during transmission of the file to the secure network; and
displaying the file in a completed folder after the file has been transmitted to the secure network, or displaying the file in a failed folder as a result of a transfer of the file to the secure network failing.

8. A method as in claim 3 , wherein determining that the file is to be transmitted further comprises, receiving an Application Programming Interface (API) request at a low side file transfer service to transfer the file to the secure network, the API request identifying a location of the file on the unsecure network.

9. A method as in claim 3 , wherein determining that the file is to be transmitted further comprises, receiving a message at a low side file transfer service via a message queue service that includes the file and the profile name for the profile located in the unsecure network, wherein receipt of the message is a request to transfer the file to the secure network.

10. A method as in claim 3 , further comprising:
sending a message to a first user associated with the unsecure account profile located in the unsecure network that the file has been transferred using a push messaging service; and
sending a message to a second user associated with the secure account profile located in the secure network that the file has been transferred using the push messaging service.

11. A method as in claim 3 , wherein requesting that the one-way transfer device transmit the file to the secure network further comprises:
executing a Representational State Transfer (RESTful) API call that is received by the one-way device; and
transmitting the file to the one-way device using a Secure File Transfer Protocol (SFTP) or Secure Copy Protocol (SCP) connection established by the one-way device.

12. A method as in claim 3 , wherein requesting that the one-way transfer device transmit the file to the secure network further comprises, identifying the one-way transfer device as being assigned to a server computer configured to initiate a transfer of the file from the unsecure network to the secure network.

13. A method as in claim 3 , further comprising regulating a number of files associated with the unsecure account profile that are transferred from the unsecured network to the secured network during a period of time.

14. A method as in claim 3 , further comprising assigning a security role to the unsecure account profile where the security role is used to control access to the file storage location.

15. A method as in claim 3 , further comprising transmitting a confirmation message conforming to a pre-defined message format from the secure network to the unsecure network using a reverse facing one-way transfer device, the confirmation message confirming successful transfer of the file to the secure network.

16. A system comprising:
a processor;
a memory device including instructions that, when exe

Assignees

• Amazon Tech Inc

Inventors

• Estes Matthew Allen
• Koenig David Eugene Walter
• Fitzgerald Robert Eric
• Farrell Brent William

Classifications

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/02 Primary

  for separating internal from external traffic, e.g. firewalls · CPC title

• H04L63/0209

  Architectural arrangements, e.g. perimeter networks or demilitarized zones · CPC title

• H04L63/123 Primary

  received data contents, e.g. message integrity · CPC title