Computing infrastructure for configurable-quality random data

Patent metadata

Field	Value
Publication number	US-9819727-B2
Application number	US-201313781289-A
Country	US
Kind code	B2
Filing date	Feb 28, 2013
Priority date	Feb 28, 2013
Publication date	Nov 14, 2017
Grant date	Nov 14, 2017

Abstract

Methods and apparatus for a computing infrastructure for configurable-quality random data are disclosed. A storage medium stores program instructions that when executed on a processor designate some servers of a provider network as members of a pool of producers of random data usable by random data consumers. The instructions, when executed, determine a subset of the pool to be used to supply a collection of random data intended for a random data consumer, and one or more sources of random phenomena to be used to generate the collection of random data. The instructions, when executed, initiate a transmission of the collection of random data directed to the random data consumer.

First claim

What is claimed is:

1. A system, comprising:
one or more computing devices comprising one or more hardware processors and memory and configured to:
designate one or more servers of a provider network as members of a pool of producers of random data usable by one or more random data consumers;
determine, for a particular server of the pool, a plurality of candidate entropy sources, wherein the particular server is configurable to generate random data based at least in part on a representation of random phenomena from at least one candidate source of the plurality of candidate entropy sources;
determine (a) a subset of the pool of producers to be used to supply a first collection of random data intended for a first random data consumer and a second collection of random data intended for a second random data consumer, wherein the subset includes the particular server, (b) a first subset and a second subset of the plurality of candidate entropy sources of the particular server to be used to generate the respective first collection of random data for the first random data consumer and the second collection of random data for the second random data consumer, wherein the first subset includes at least one candidate entropy source not included in the second subset based at least on an indication of a desired first level of quality of random data for the first random data consumer that is different than a desired second level of quality of random data for the second random data consumer, and (c) one or more delivery parameters to be used to transmit the respective collections of random data to the first random data consumer and the second random data consumer;
generate the first collection of random data for the first random data consumer using the first subset of candidate entropy sources and the second collection of random data for the second random data consumer using the second subset of candidate entropy sources, wherein the first subset includes the at least one candidate entropy source not included in the second subset based on the indication of the desired first level of quality of random data that is different than the desired second level of quality of random data; and
transmit the respective first collection of random data and the second collection of random data to destinations associated with the first random data consumer and the second random data consumer in accordance with the one or more delivery parameters.

2. The system as recited in claim 1 , wherein the one or more computing devices are further configured to add an additional candidate entropy source to the first subset of the plurality of candidate entropy sources based at least in part on an indication of desired statistical properties of the random data for the first random data consumer.

3. The system as recited in claim 1 , wherein the first random data consumer comprises a first application executing on a first guest virtual machine of a plurality of guest virtual machines instantiated on a particular host of the provider network, wherein the one or more computing devices are further configured to:
coordinate generation and transmission of respective collections of random data to a plurality of applications running on respective guest virtual machines instantiated on the particular host, including a second application executing on a second guest virtual machine, in accordance with a uniqueness policy indicating a desired level of statistical independence between the collection of random data supplied to the first application and a second collection of random data supplied to the second application.

4. The system as recited in claim 1 , wherein the first random data consumer comprises a software component executing on a particular host, wherein the delivery parameters include an indication of a local random data aggregator configured to receive, on the particular host, a portion of the first collection of random data for the first random data consumer, wherein the local random data aggregator is configured to:
combine, in accordance with an aggregation policy, the portion of the first collection of random data with additional random data derived at least in part from a local entropy source associated with the particular host; and
provide, to the random data consumer, a result of a combination of the portion of the first collection of random data and the additional random data.

5. The system as recited in claim 1 , wherein the one or more delivery parameters include representations of one or more of: (a) a push policy indicating that one or more collections of random data are to be transmitted on behalf of the first random data consumer in the absence of explicit data requests from the first random data consumer, (b) a pull policy indicating that a portion of the first collection of random data is to be transmitted on behalf of the first random data consumer in response to a data request from the first random data consumer, (c) a security policy to be used to transmit the portion of the first collection of random data in accordance with a set of confidentiality, authenticity, data integrity or replay protection specifications, (d) a size of the portion of the first collection of random data, or (e) a rate at which the portion of the first collection of random data is to be transmitted.

6. A method, comprising:
designating one or more servers of a provider network as members of a pool of producers of random data;
determining, for a particular server of the pool, a first subset and a second subset of a plurality of candidate entropy sources for a respective first random data consumer and a second random data consumer, wherein the first subset includes at least one candidate entropy source not included in the second subset based at least on an indication of a desired first level of quality of random data for the first random data consumer that is different than a desired second level of quality of random data for the second random data consumer, wherein the particular server is configurable to generate the random data for the first and second random data consumers based at least in part on a representation of random phenomena from at least one candidate source of the plurality of candidate entropy sources;
determining a subset of the pool of producers to be used to supply a first collection of random data intended for the first random data consumer and a second collection of random data intended for the second random data consumer, wherein the subset includes the particular server;
generating the first collection of random data for the first random data consumer using the first subset of candidate entropy sources and the second collection of random data for the second random data consumer using the second subset of candidate entropy sources, wherein the first subset includes the at least one candidate entropy source not included in the second subset based on the indication of the desired first level of quality of random data that is different than the desired second level of quality of random data; and
transmitting the respective first collection of random data and the second collection of random data directed to destinations associated with the first random data consumer and the second random data consumer.

7. The method as recited in claim 6 , further comprising adding an additional candidate entropy source to the first subset to increase a rate at which the particular server is configurable to generate the random data for the first random data consumer.

8. The method as recited in claim 6 , wherein the random first data consumer comprises a first application executing on a first guest virtual machine of a plurality of guest virtual machines instantiated on a particular host of the provider ne

Assignees

• Amazon Tech Inc

Inventors

• Potlapally Nachiketh Rao
• Mikulski Andrew Paul
• Bailey Jr Donald Lee
• Fitzgerald Robert Eric

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L9/0662

  with particular pseudorandom sequence generator · CPC title

• H04L67/1023

  based on a hash applied to IP addresses or costs · CPC title

• H04L9/0869

  involving random numbers or seeds · CPC title

• H04L67/10 Primary

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title