Token-based storage service

• US 9,648,007 B1
• Filed: 06/17/2015
• Issued: 05/09/2017
• Est. Priority Date: 06/17/2015
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Sterling, Matthew Ross, Padilla, Oscar, Rader, Thomas James, Gober, Eric Dominique, Geiser, Scott Eric, Zlatkov, Dimitar Todorov
• Primary Examiner(s): Mehrmanesh, Amir
• Assistant Examiner(s): Shayanfar, Ali
• Application Number:
  US14/742,450
• Time in Patent Office: 692 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

A token-based storage service may comprise a repository of key-value data. In response to a request to store a data item, the storage service may generate a token comprising a namespace and a unique identifier. The token may be used as a key to store and retrieve the data item from the repository. Requests to access the data may be validated based on ownership information stored with the data item and information indicative of the origin of the request for access. In response to a request to store a new version of the data item, a new token may be generated.

Claims

1. A system comprising:

one or more computing nodes configured as a repository of key-value data;

one or more memories having stored thereon computer-readable instructions that, upon execution by a computing device, cause the system at least to;

receive a first request to store a data item;

in response to the first request to store the data item, generate a first token comprising a namespace and a first identifier, and store, in the repository of key-value data, a first association between the first token and the data item, and a second association between the first token and metadata indicative of an owner of the data item;

validate a request to retrieve the data item, based at least in part on using a copy of the first token included in the request to retrieve the data item and access the metadata indicative of the owner of the data item; and

in response to a second request to store a version of the data item, add the first token to a list of invalid tokens and generate a second token comprising the namespace and a second identifier, and store, in the repository of key-value data, associations between the second token, the version of the data item, and the metadata indicative of the owner of the data item.

2. The system of claim 1, further comprising one or more memories having stored thereon computer-readable instructions that, upon execution by the computing device, cause the system at least to:

determine that the request to access the data item is associated with the owner of the data item based on at least one of a user, device, or application being associated with both the first request to store the data item and the request to access the data item.

3. The system of claim 1, further comprising one or more memories having stored thereon computer-readable instructions that, upon execution by the computing device, cause the system at least to:

cause the data item and the metadata indicative of the owner of the data item to be stored in the repository of key-value using the first token as a key.

4. The system of claim 1, further comprising one or more memories having stored thereon computer-readable instructions that, upon execution by the computing device, cause the system at least to:

remove associations between the first token, the data item, and the metadata indicative of the owner of the data item in response to the second request to store the version of the data item.

5. A method of providing access to a multi-tenant collection of data maintained in a repository of key-value data, the method comprising:

generating a first token in response to a first request to store a data item, the first token comprising a namespace and a first identifier;

storing, in the repository of key-value data, a first association between the first token and the data item;

validating a request to access the data item by at least comparing information indicative of an origin of the request to access the data item to information indicative of an owner of the data item;

generating a second token in response to a second request to store a second version of the data item, the second token comprising the namespace and a second identifier generated in response to the second request;

storing, in the repository of key-value data, a second association between the second token and the second version of the data item; and

storing information adding the first token to a list of tokens that are invalid for retrieving the data item.

6. The method of claim 5, further comprising:

determining that the request to access the data item is associated with the owner of the data item based on at least one of a user, device, or application being associated with both the first request to store the data item and the request to access the data item.

7. The method of claim 5, further comprising:

storing the data item and the information indicative of the owner of the data item in the repository.

8. The method of claim 5, wherein the second version of the data item is equivalent to the data item.

9. The method of claim 5, wherein the first token is not based on identifiable information.

10. The method of claim 5, wherein the information indicative of the owner of the data item comprises one or more identifiers corresponding to at least one of a user, device, application, or tenant.

11. The method of claim 5, further comprising:

removing the first association between the first token and the data item in response to the second request to store the second version of the data item.

12. The method of claim 5, further comprising:

storing, in the repository of key-value data, information indicative of an expiration time for the first token; and

causing the first token to be unusable for retrieving the data item based at least in part on the expiration time.

13. A non-transitory computer-readable storage medium having stored thereon instructions that, upon execution by a computing device, cause the computing device at least to:

receive a first request to store a data item;

form, in response to the first request, a first token comprising a namespace and a first identifier;

store, in a repository of key-value data, associations between the first token, the data item, and information indicative of an owner of the data item;

determine that a request to access the data item is authorized by at least comparing information indicative of an origin of the request to access the data item to the information indicative of the owner of the data item;

generate a second token in response to a second request to store a second version of the data item, the second token comprising the namespace and a second identifier generated in response to the second request;

store, in the repository of key-value data, associations between the second token, the second version of the data item, and the information indicative of the owner of the data item; and

store information indicative of the first token being invalid, wherein storing the information comprises adding the first token to a list of invalid tokens.

14. The non-transitory computer-readable storage medium of claim 13, comprising further instructions that, upon execution by the computing device, cause the computing device to at least:

determine that the request to access the data item is associated with the owner of the data item based on at least one of a user, device, or application being associated with both the first request to store the data item and the request to access the data item.

15. The non-transitory computer-readable storage medium of claim 13, comprising further instructions that, upon execution by the computing device, cause the computing device to at least:

store the data item and the information indicative of the owner of the data item in the repository, indexed by the first token.

16. The non-transitory computer-readable storage medium of claim 13, wherein the namespace is represented in the first token by a randomly generated sequence.

17. The non-transitory computer-readable storage medium of claim 13, comprising further instructions that, upon execution by the computing device, cause the computing device to at least:

determine that a request to access the data item is authorized based at least in part on comparing a portion of the data item to a value of a parameter included in the request to access the data item.

18. The non-transitory computer-readable storage medium of claim 13, comprising further instructions that, upon execution by the computing device, cause the computing device to at least:

mark the data item for deletion in response to the second request to store the second version of the data item.

19. The non-transitory computer-readable storage medium of claim 13, comprising further instructions that, upon execution by the computing device, cause the computing device to at least:

add the first token to the list of invalid tokens in response to the second request to store the second version of the data item.