Policy based data aggregation

• US 10,333,901 B1
• Filed: 09/10/2014
• Issued: 06/25/2019
• Est. Priority Date: 09/10/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Bauman, Daniel, Buys, Willem Jacob, Mentz, Joshua Dawie, Musnitzky, Aidan, Sjoberg, Timothy Ralph, Engers, Ross Bevan, Agranat, Ronen Dov, Mulder, Brian Frederick, Letz, Stefan
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Le, Thanh T
• Application Number:
  US14/483,069
• Time in Patent Office: 1,749 Days
• Field of Search: 726 1
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for data aggregation of declassified sensitive data may include obtaining a policy associated with an isolated region of a service provider. The policy may identify a plurality of rules for declassifying sensitive data accessible within the isolated region. At least a portion of the plurality of rules identified by the policy may be obtained. A file with the sensitive data may be identified, the file being generated within the isolated region. An output file may be generated based on applying the obtained rules to the file. At least a portion of the sensitive data may be filtered out using the obtained rules. The generated output file may be provided for access outside of the isolated region. The sensitive data may be inaccessible by at least another region of the service provider.

Claims

1. A method for data aggregation of declassified sensitive data, comprising:

receiving a request for a file stored on a first server computer in an isolated network region of a service provider, the request being received from a second server computer;

obtaining, by the first server computer, a policy associated with the isolated network region of the service provider, the policy identifying a plurality of rules for declassifying sensitive data accessible within the isolated network region;

identifying the file with the sensitive data on the first server computer;

obtaining, by the first server computer, at least a portion of the plurality of rules identified by the policy, the obtained rules associated with the identified file;

transforming, using the first server computer on which the file is stored, the identified file to an output file by replacing sensitive information with non-sensitive information, which is indicative of a type of sensitive information, using the obtained portion of the plurality of rules, wherein the sensitive information includes identification information of a customer associated with the file and the non-sensitive information includes performance metrics associated with the architecture of the first server computer; and

,

transmitting the output file outside of the isolated network region to the second server computer as a response to the request for the file, wherein the output file includes the performance metrics.

2. The method according to claim 1, wherein the sensitive data is inaccessible by at least another region of the service provider.

3. The method according to claim 1, wherein the file is a log file and the method further comprises:

generating the output file based on performing one or both of anonymizing and tokenizing operations on the file, the anonymizing and tokenizing operations specified by the obtained rules.

4. The method according to claim 1, comprising:

storing the output file in a network storage location accessible by at least a first host computer within the isolated region and at least a second host computer in at least another non-isolated network region of the service provider.

5. The method according to claim 1, wherein the portion of the plurality of rules comprise:

at least a first rule for tokenizing a specific IP address by replacing the specific IP address with a token that does not reveal the specific IP address;

or

at least a second rule for tokenizing a plurality of IP addresses with a corresponding plurality of unique tokens.

6. A computer-readable storage including instructions thereon for executing a method for data aggregation in a multi-tenant network of a service provider, the method comprising:

receiving a request for a file including sensitive data stored on a first server computer in an isolated region from a second server computer;

accessing a policy with a plurality of filtering rules by the first server computer;

selecting within a virtual private network, at least a portion of the plurality of filtering rules, the selecting based on the sensitive data;

transforming, within the virtual private network, the file into output data based on filtering the sensitive data using the selected plurality of filtering rules, wherein the transforming includes replacing identification information of a tenant associated with the sensitive data with tokens that are indicative of generic identification information and wherein the transforming allows performance metrics associated with an architecture of the first server computer to be included in the output data;

transmitting the generated output data, including the performance metrics, to the second server computer, which is outside of the isolated region; and

storing the output data on the second server computer.

7. The computer-readable storage of claim 6, further including:

providing authorization to the second server computer for accessing the generated output data from within the virtual private network.

8. The computer-readable storage of claim 6, wherein the method further comprises:

filtering out the sensitive data within the file using the selected plurality of filtering rules.

9. The computer-readable storage of claim 6, further including:

filtering the sensitive data using at least one anonymization rule within the plurality of filtering rules, the at least one anonymization rule associated with replacing at least a portion of the data with anonymous data.

10. The computer-readable storage of claim 6, further including:

filtering the sensitive data using at least one tokenization rule within the plurality of filtering rules, the at least one tokenization rule associated with replacing at least a portion of data within the file with token data indicating at least a data type of the replaced data.

11. The computer-readable storage of claim 6, wherein the filtered data comprises at least one of the first server computer settings, the first server computer IP address, customer account identification, virtual machine instance identification, and customer email address.

12. The computer-readable storage of claim 6, wherein the sensitive data comprises file data and at least a portion of the plurality of filtering rules are associated with filtering the sensitive data from one or more files of a pre-determined file type, the one or more files generated within the virtual private network.

13. The computer-readable storage of claim 6, wherein the policy comprises filtering rules associated with at least a third server computer outside the virtual private network.

14. The computer-readable storage of claim 13, further including:

updating the plurality of filtering rules within the policy to include at least one or more filtering rules associated with data generated by at least one virtual machine instance running on the third server computer.

15. A system for data aggregation in a distributed system of a compute service provider, the system comprising:

a plurality of server computers disposed among a plurality of isolated regions of the compute service provider coupled together through a network, wherein;

at least a portion of the server computers for executing a plurality of virtual machine instances associated with a customer account;

at least one server computer of the plurality of server computers associated with an isolated region of the plurality of isolated regions of the compute service provider;

a policy store operable to store a plurality of policies for filtering data generated within at least one of the plurality of isolated regions of the compute service provider; and

an aggregator service communicatively coupled to the plurality of server computers and the policy store, the aggregator service operable to;

obtain a policy from the policy store, the policy associated with the at least one server computer and identifying a plurality of rules for filtering sensitive data generated within the isolated region;

identify within the isolated region, a file with the sensitive data, the file generated within the isolated region;

retrieve at least one of the plurality of rules based on the identified file;

generate an output file based on applying the at least one of the plurality of rules to the file, wherein at least a portion of the sensitive data is one of anonymized or tokenized using the plurality of rules so that a type of the sensitive data can be identified without the sensitive data, and wherein the output file includes performance metrics associated with an operation of hardware on the at least one server computer; and

store the output file on the at least one server computer.

16. The system of claim 15, wherein the aggregator service is operable to:

store the output file in network storage accessible from at least another one of the plurality of isolated regions.

17. The system of claim 16, wherein the aggregator service is operable to:

filter the file using at least one anonymization rule within the plurality of rules, the at least one anonymization rule associated with replacing at least a portion of the sensitive data with anonymous data;

or

filter the file using at least one tokenization rule within the plurality of rules, the at least one tokenization rule associated with replacing at least a portion of the sensitive data with token data indicating at least a data type of the replaced data.

18. The system according to claim 15, wherein the file is a log file generated by the at least one server computer.

19. The system according to claim 15, wherein the file is inaccessible to at least a second server computer within another one of the plurality of isolated regions.