Authenticated device-based storage operations

Patent metadata

Field	Value
Publication number	US-9729524-B1
Application number	US-201414569038-A
Country	US
Kind code	B1
Filing date	Dec 12, 2014
Priority date	Dec 12, 2014
Publication date	Aug 8, 2017
Grant date	Aug 8, 2017

Abstract

Data storage operation commands are digitally signed to enhance data security in a distributed system. A data storage client and a compute-enabled data storage device may share access to a cryptographic key. The data storage client uses the cryptographic key to digitally sign commands transmitted to the data storage device, which can use its copy to verify a digital signature of a command before fulfilling the command. The storage device can also determine whether to perform a transformation, such that requests authenticated to a first identity might receive cleartext while a request authenticated to a second identity might receive ciphertext. The compute-enabled storage device can also receive unauthenticated calls and attempt to retrieve the appropriate key from a key management service or other such source.

First claim

What is claimed is:

1. A storage device, comprising:
at least one non-transitory computer-readable storage medium for storing data on behalf of one or more users in a multi-tenant environment;
at least one processor; and
memory including instructions that, when executed by the at least one processor, cause the storage device to:
receive, from a key management system, a cryptographic key;
receive, from a first computing device of a corresponding user of the one or more users, an input/output command and a digital signature of the input/output command of the corresponding user, the input/output command received from a process executing in a guest of a hypervisor and the input/output command involving at least a read operation to be performed by the storage device with respect to data stored on behalf of the corresponding user of the one or more users in the multi-tenant environment, the digital signature generated based at least in part on the cryptographic key;
verify the digital signature of the input/output command using the cryptographic key;
authenticate a user identity of the corresponding user associated with the input/output command; and
fulfill the input/output command using (a) cleartext in response to determining that the user identity corresponds to a first identity and (b) ciphertext in response to determining that the user identity corresponds to a second identity.

2. The storage device of claim 1 , wherein the instructions when executed further cause the storage device to:
fulfill the input/output command at least in part by generating the cleartext by decrypting ciphertext, stored in the at least one non-transitory computer-readable storage, or generating the ciphertext by decrypting cleartext stored in the at least one non-transitory computer-readable storage.

3. The storage device of claim 1 , wherein the instructions when executed further cause the storage device to:
return no data in response to at least one of the digital signature not being verified, the user identity not being authenticated, or the user identity determined to correspond to a third identity.

4. The storage device of claim 1 , wherein the instructions when executed further cause the storage device to:
store a plurality of cryptographic keys capable of being used for at least one of encrypting or decrypting the data stored on the storage device; and
select, based at least in part on the corresponding user associated with the input/output command, the cryptographic key from the plurality of cryptographic keys stored by the storage device.

5. The storage device of claim 1 , wherein the input/output command is received over a storage bus utilizing an embedded storage protocol.

6. The storage device of claim 1 , wherein the instructions when executed further cause the storage device to:
fulfill the input/output command, in part, utilizing a device-level address that is specified by the input/output command and that is the source for data to be operated upon in the fulfilling of the input/output command.

7. The storage device of claim 1 , wherein the instructions when executed further cause the storage device to:
receive, from the first computing device, a second input/output command and a second digital signature of the second input/output command, the second input/output command involving at least a write operation to be performed by the storage device;
verify the second digital signature using the cryptographic key; and
fulfill the second input/output command at least in part by writing at least one of a second cleartext, decrypted using a respective cryptographic key, or a second ciphertext of the data corresponding to the second input/output command to the at least one non-transitory computer-readable storage medium.

8. The storage device of claim 1 , wherein the instructions when executed further cause the storage device to:
receive, from the first computing device, a second input/output command, the second input/output command unassociated with the digital signature; and
determine the second input/output command to be associated with the second identity.

9. A storage device, comprising:
at least one non-transitory computer-readable storage medium for storing data on behalf of one or more users;
at least one processor; and
memory including instructions that, when executed by the at least one processor, cause the storage device to:
receive an input/output command comprising a digital signature, the input/output command of a corresponding user of the one or more users and configured to cause the storage device to perform a storage operation with respect to the data stored, or to be stored, on the at least one non-transitory computer-readable storage medium, the input/output command received from a process executing in a guest of a hypervisor and the input/output command referencing a specific offset within an allocation of the at least one non-transitory computer-readable storage medium, the data stored or to be stored on behalf of the corresponding user, the digital signature associated with the corresponding user;
use a cryptographic key to verify the digital signature of the input/output command; and
as a result of the digital signature of the input/output command being verified, fulfill the input/output command.

10. The storage device of claim 9 , wherein the instructions when executed further cause the storage device to:
obtain the cryptographic key from a key management system.

11. The storage device of claim 9 , wherein the instructions when executed further cause the storage device to:
fulfill the input/output command in part utilizing a device-level address, specified by the input/output command, for data to be operated upon by fulfillment of the input/output command.

12. The storage device of claim 9 , wherein the storage device comprises at least one of a solid state drive (SSD) or Serial ATA (SATA) drive.

13. The storage device of claim 9 , wherein the instructions when executed further cause the storage device to:
derive the cryptographic key based at least in part on a second cryptographic key corresponding to data affected by the input/output command.

14. The storage device of claim 9 , wherein the instructions when executed further cause the storage device to:
alter behavior of the storage device, with respect to the input/output command, based at least in part upon analyzing content of the input/output command.

15. The storage device of claim 9 , wherein the instructions when executed further cause the storage device to:
obtain a first cryptographic key usable to decrypt a portion of the data responsive to the input/output command;
decrypt the portion of the data to obtain a plaintext version of the portion;
obtain a second cryptographic key usable for encryption;
encrypt the plaintext version to obtain encrypted output data; and
perform the input/output command using the encrypted output data.

16. The storage device of claim 15 , wherein at least one of the first cryptographic key or the second cryptographic key is determined based at least in part upon the cryptographic key used to verify the signature of the input/output command.

17. The storage device of claim 15 , wherein the instructions when executed further cause the storage device to:
perform one or more logical operations on the plaintext version prior to encryption of the plaintext version.

18. A method of performing an input/output command on a storage device including processing capability, the method comprising:
receiving, to the storage dev

Assignees

• Amazon Tech Inc

Inventors

• Brandwine Eric Jason
• Roth Gregory Branchek

Classifications

• H04L63/0457 Primary

  wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption (cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065) · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L63/126

  the source of the received data · CPC title