Inexpensive deletion in a data storage system

• US 9,165,002 B1
• Filed: 06/27/2012
• Issued: 10/20/2015
• Est. Priority Date: 06/27/2012
• Status: Expired due to Fees

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Lazier, Colin L.
• Primary Examiner(s): Ehichioya, Fred I
• Assistant Examiner(s): MACKES, KRIS E
• Application Number:
  US13/535,195
• Time in Patent Office: 1,210 Days
• Field of Search: 707/663
• US Class Current: 1/1
• CPC Class Codes: G06F 16/125 characterised by the use of retention policies retention policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/162 Delete operations erasing in storage systems G06F3/0652

Abstract

Systems and methods are provided herein for storing data to enable inexpensive and/or guaranteed deletion of data. In various embodiments, a customer specifies a data deletion indication associated with a data object to be stored, specifying when and/or how to delete the data object. Such a data deletion indication may be based, for example, on a regulatory compliance requirement. Based at least in part on the data deletion indication, the storage system may select, from a plurality of storage devices, a storage device to store the data object. Data objects with similar data deletion indications may be stored in the same storage device. In some embodiments, a data object stored in a storage device using the methods described herein may be deleted as part of the deletion of all or a portion of the storage device near a time specified by the data deletion indication of the data object.

Claims

1. A computer-implemented method for storing data, comprising:

under the control of one or more computer systems configured with executable instructions,

receiving a request, from a customer entity connected to a storage system, to store a data object, the request including a data deletion indication, specified by the customer entity when the request is made to store the data object, that indicates when to make the data object inaccessible and a particular deletion method specified by the customer entity when the request is made to store the data object that indicates how to delete the data object;

in response to the request,

obtaining, based at least in part on an encoding algorithm and the data object, a plurality of encoded data shards; and

for each encoded data shard of at least some of the plurality of encoded data shards,

selecting, from a plurality of storage devices in the storage system, a storage device based at least in part on a device-specific deletion indication associated with the storage device and on the data deletion indication, the device-specific deletion indication that indicates when to make inaccessible at least a portion of data stored in the storage device;

updating the device-specific deletion indication associated with the storage device based at least in part on the data deletion indication of the request;

storing the encoded data shard in the selected storage device as part of the portion of data stored in the storage device; and

at a time corresponding to the device-specific deletion indication of the selected storage device, making inaccessible the portion of data stored in the selected storage device based at least in part on the data deletion indication.

2. The computer-implemented method of claim 1, wherein the device-specific deletion indication associated is based at least in part on one or more data deletion indications associated with one or more data objects stored in the storage device.

3. The computer-implemented method of claim 1, wherein selecting the storage device is based at least in part on an estimated life expectancy of the storage device.

4. The computer-implemented method of claim 1, wherein making inaccessible the portion of data includes rendering the portion of data irrecoverably inaccessible.

5. The computer-implemented method of claim 1, wherein making inaccessible the portion of data includes physically destroying the selected storage device.

6. The computer-implemented method of claim 1, wherein the data deletion indication is based at least in part on a regulatory compliance requirement.

7. The computer-implemented method of claim 1, wherein the particular deletion method includes at least one of:

overwriting the data object with other data, encrypting the data object and rendering a cryptographic key for the encrypted data inaccessible, degaussing the storage device storing the data object, or shredding the storage device storing the data object.

8. A computer-implemented method for storing information, comprising:

under the control of one or more computer systems configured with executable instructions,

receiving a request, from a customer entity connected to a storage system, to store information, the request including an information deletion indication, specified by the customer entity when the request is made to store the information, that indicates when to make a portion of the information inaccessible and a particular deletion method specified by the customer entity when the request is made to store the information that specifies how to delete the portion of the information;

selecting, from a plurality of storage devices in the storage system, a storage device based at least in part on the information deletion indication and a device-specific deletion indication associated with the storage device, the device-specific deletion indication indicating when to make inaccessible the information stored on the storage device;

updating the device-specific deletion indication associated with the storage device based at least in part on the information deletion indication of the request; and

causing storage of at least the portion of the information in the selected storage device.

9. The computer-implemented method of claim 8, wherein receiving the request comprises determining the information deletion indication based at least in part on a customer entity specified regulatory compliance requirement.

10. The computer-implemented method of claim 8, wherein selecting the storage device comprises:

determining a plurality of device-specific deletion indications associated with the plurality of storage devices, each of the plurality of device-specific deletion indications indicating when to make inaccessible at least the portion of information stored in the corresponding storage device; and

wherein causing storage of the information includes causing the information to be stored as part of the portion of information stored in the storage device.

11. The computer-implemented method of claim 10, wherein determining the device-specific deletion indications is based at least in part on one or more criteria unrelated to the information deletion indication.

12. The computer-implemented method of claim 10, further comprising:

making inaccessible at least the portion of information stored in the storage device according to the device-specific deletion indication.

13. The computer-implemented method of claim 8, further comprising:

receiving a second request to store second information, the second information being associated with a second information deletion indication that indicates when to make the second information inaccessible; and

storing the second information in the selected storage device, based at least in part on the proximity of the information deletion indication and the second information deletion indication.

14. A non-transitory computer-readable storage medium having stored thereon instructions for causing at least one computer system to store data, the instructions comprising:

instructions that cause said at least one computer system to, as a result of a received request, from a customer entity connected to a storage system, to store a data object, the received request including a data deletion indication, specified by the customer entity when the request is made to store the data object, indicating when to make the data object inaccessible and a particular deletion method specified by the customer entity when the request is made to store the data object that specifies how to delete the data object, the data object stored by at least;

cause said at least one computer system to select, from a plurality of storage devices of the storage system, a storage device based at least in part on the data deletion indication and a device-specific deletion indication associated with the storage device, the device-specific deletion indication indicating when to make inaccessible the information stored on the storage device;

update the device-specific deletion indication associated with the storage device based at least in part on the data deletion indication of the received request; and

cause said at least one computer system to cause storage of the data object in the selected storage device.

15. The non-transitory computer-readable storage medium of claim 14, wherein the instructions that cause said at least one computer system to select the storage device are based at least in part on one or more criteria other than the data deletion indication.

16. The non-transitory computer-readable storage medium of claim 14, wherein the instructions that cause said at least one computer system to select the storage device comprises instructions that cause the at least one computer system to determine the device-specific deletion indication that indicates when to make inaccessible at least a portion of data stored in the selected storage device.

17. The non-transitory computer-readable storage medium of claim 16, instructions that cause said at least one computer system to cause storage of the data object comprises instructions that cause the at least one computer system to cause the data object to be stored as part of the portion of data stored in the selected storage device.

18. The non-transitory computer-readable storage medium of claim 17, further comprising instructions that cause the at least one computer system to make inaccessible the portion of data stored in the selected storage device according to the device-specific deletion indication.

19. The non-transitory computer-readable storage medium of claim 18, wherein the instructions that cause the at least one computer system to make inaccessible the portion of data includes instructions that cause the at least one computer system to make the portion of data permanently inaccessible.

20. The non-transitory computer-readable storage medium of claim 14, wherein the data deletion indication is based at least in part on a regulatory compliance requirement.

21. A system for storing data, comprising:

a communication device operable to receive requests, from a customer entity connected to a storage system, to store data objects, the received requests including data deletion indications, specified by the customer entity when the requests are made to store data objects, indicating when to make the data objects inaccessible and particular deletion methods specified by the customer entity when the requests are made to store the data objects that specify how to delete the data objects;

a plurality of storage devices in the storage system; and

at least one processor operable to, in response to a received request to store a data object that is associated with a corresponding data deletion indication;

select a storage device from the plurality of storage devices based at least in part on the data deletion indication and a device-specific deletion indication associated with the storage device, the device-specific deletion indication indicating when to make inaccessible the data objects on the storage device;

update the device-specific deletion indication associated with the storage device based at least in part on the data deletion indication; and

store the data object in the selected storage device.

22. The system of claim 21, wherein said at least one processor is further operable to determine the device-specific deletion indication that indicates when to make inaccessible at least a portion of data stored in the selected storage device.

23. The system of claim 22, further comprising at least one processor operable to make inaccessible at least the portion of data stored in the selected storage device according to the device-specific deletion indication.

24. The system of claim 23, wherein the data deletion indication is based at least in part on at least in part on a user-specified regulatory compliance requirement.

25. The system of claim 21, wherein:

the communication device is operable to receive and process requests to store data objects from devices of multiple tenants;

the system stores data for a plurality of the multiple tenants on the same storage device of the plurality of storage devices.