Data protection using active data

Patent metadata

Field	Value
Publication number	US-9747455-B1
Application number	US-201414561044-A
Country	US
Kind code	B1
Filing date	Dec 4, 2014
Priority date	Dec 4, 2014
Publication date	Aug 29, 2017
Grant date	Aug 29, 2017

Abstract

Data of an organization or other entity may be protected using active data objects. The data may be storage in a storage system maintained by the organization or a separate organization. The data storage system may receive request for data, if the request violates one or more constraint conditions, the storage system may provide in response to the received request active data. The active data may include executable code that, when executed by a computer system, causes depletion of one or more resources used by a computer system executing the code.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
under the control of one or more computer systems configured with executable instructions,
receiving, at an interface of a data storage service, a request to interact with a data object maintained by the data storage service;
determining that the request violates one or more constraint conditions based at least in part on the request by at least determining that the request lacks a value indicated by the one or more constraint conditions as to be included in requests; and
providing, in response to the request, obfuscated active decoy data, as a result of the determination, where the obfuscated active decoy data comprises a payload containing code that is configured to cause depletion of one or more resources used by a computer system executing the code.

2. The computer-implemented method of claim 1 , wherein depletion of the one or more resources used by the computer system executing the code further includes exhaustion of a hard disk capacity of the computer system and a network capacity of the computer system.

3. The computer-implemented method of claim 1 , wherein depletion of one or more resources used by the computer system executing the code further includes exhaustion of a memory of the computer system and exhaustion of a processing capacity of the computer system.

4. The computer-implemented method of claim 1 , wherein the value includes a flag in the request.

5. A system comprising:
one or more processors; and
memory that stores computer-executable instructions that, if executed, cause the one or more processors to:
receives a request to access at least one data object maintained by a data vending service;
determines to provide active data in response to the request based at least in part on the request violates one or more constraint conditions by at least determining that the request lacks a value indicated by the one or more conditions, wherein the active data comprises code that is configured to cause depletion of computing resources of a computer system interacting with the active data; and
provides the active data in response to the request.

6. The system of claim 5 , the system further determines a particular level of active data to provide in response to the request, where the particular level corresponds an amount of computing resource depletion to be caused by the active data.

7. The system of claim 5 , wherein the active data further causes the computer system interacting with the active data to generate a signal detectable by one or more services.

8. The system of claim 5 further:
determines that the computer system interacting with the active data is included in a whitelist of computer systems; and
provides an antidote to the active data in response to the determination.

9. The system of claim 5 further provides to the computer system interacting with the active data an antidote to the active data, where the code included in the active data is further configured to detect the antidote and prevent depletion of computing resources of the computer system interacting with the active data.

10. The system of claim 5 , wherein the request to access the at least one data object further includes a database query in violation of the one or more constraint conditions.

11. The system of claim 5 , wherein the active data further causes the computer system interacting with the active data to transmit a notification including identifying information of the computer system to at least one service of the one or more services.

12. The system of claim 5 further interleaves active data into one or more data objects maintained by the data vending service.

13. A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:
receive a request to interact with at least one data object of a set of data objects;
determine the request violates one or more constraint conditions by at least determining that the request lacks a value indicated by the one or more constraint conditions as to be included in the request; and
provide, in response to the request, at least one active data object of a set of active data objects, where at least a portion of the active data objects of the set of active data objects includes executable code that when executed by another computer system prevents the other computer system from interacting with at least one data object of the set of data objects.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to include in the portion of the active data objects of the set of active data objects, executable code that, when executed by the other computer system, causes the other computer system to transmit information identifying the other computer system to a reporting service.

15. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to include in the portion of the active data objects of the set of active data objects, executable code that, when executed by the other computer system, causes the other computer system to encrypt data stored in memory of the other computer system.

16. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to include in the portion of the active data objects of the set of active data objects, executable code that, when executed by the other computer system, causes the other computer system to delete one or more data objects of the set of data objects stored in memory of the other computer system.

17. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions that cause the computer system to determine the request violates one or more constraint conditions further include instructions that cause the computer system to:
determine the request was submitted by an attacker; and
provide an active data object of the set of active data objects including executable code that, when executed by the other computer system, causes the other computer system to be at least temporarily inoperable.

18. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to populate a storage system with the set of active data objects, where the set of active data objects are obfuscated such that the set of active data objects are not distinguishable from the set of data objects of the storage system without transforming the obfuscated active data objects.

19. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to provide an antidote to the at least one active data object of the set of active data objects.

20. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to include in the portion of the active da

Assignees

• Amazon Tech Inc

Inventors

• Mcclintock Jon Arron
• Stathakopoulos George Nikolaos

Classifications

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• G06F21/60 Primary

  Protecting data · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06F21/6227

  where protection concerns the structure of data, e.g. records, types, queries · CPC title