Token-based storage service

• US 9,811,684 B1
• Filed: 03/23/2017
• Issued: 11/07/2017
• Est. Priority Date: 06/17/2015
• Status: Expired due to Fees

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Sterling, Matthew Ross, Padilla, Oscar, Rader, Thomas James, Gober, Eric Dominique, Geiser, Scott Eric, Zlatkov, Dimitar Todorov
• Primary Examiner(s): Shayanfar, Ali
• Application Number:
  US15/467,913
• Time in Patent Office: 229 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

A token-based storage service may comprise a repository of key-value data. In response to a request to store a data item, the storage service may generate a token comprising a namespace and a unique identifier. The token may be used as a key to store and retrieve the data item from the repository. Requests to access the data may be validated based on ownership information stored with the data item and information indicative of the origin of the request for access. In response to a request to store a new version of the data item, a new token may be generated.

Claims

1. A system, comprising:

at least one processor;

one or more memories having stored thereon computer-readable instructions that, upon execution by the at least one processor, cause the system at least to;

store a data item in a database, the data item indexed in the database by a first token;

validate a request to modify the data item, the validating based at least in part on the first token and a stored association between the first token and information indicative of ownership of the data item;

remove the stored association and generate a second token in response to the request to modify the data item;

store the modified data in the database, the data item indexed by the second token; and

store data indicating that the first token is invalid for accessing the data item.

2. The system of claim 1, wherein the first token comprises a randomly generated sequence of data.

3. The system of claim 1, wherein the one or more memories have stored thereon further computer-readable instructions that, upon execution by the at least one processor, cause the system at least to:

determine that the request to modify the data item is associated with an owner of the data item, based on at least one of a user, device, or application associated with both of a request to store the data item and the request to modify the data item.

4. The system of claim 1, wherein the one or more memories have stored thereon further computer-readable instructions that, upon execution by the at least one processor, cause the system at least to:

retrieve the data item based on the first token.

5. The system of claim 1, wherein metadata for the first token is stored in a key-value repository.

6. A method, comprising:

storing, in database, a data item indexed by a first token;

validating a request to modify the data item, the validating based at least in part on the first token and a stored association between the first token and information indicative of ownership of the data item;

removing the stored association and generating a second token in response to the request to modify the data item;

storing, in the database, the modified data item indexed by the second token; and

adding the first token to a list of tokens that are invalid for accessing the data item.

7. The method of claim 6, further comprising:

determining that the request to modify the data item is associated with an owner of the data item.

8. The method of claim 6, further comprising:

forming the first token in response to receiving a request to store the data item.

9. The method of claim 6, wherein the first token comprises a first unique identifier and information indicative of at least one of a tenant, application, or meaning of the data item.

10. The method of claim 9, wherein the second token comprises a second unique identifier and the information indicative of at least one of a tenant, application, or meaning of the data item.

11. The method of claim 6, further comprising:

associating the first token with information other than the data item in response to the request to modify the data item.

12. The method of claim 6, further comprising:

retrieving the data item based on the first token.

13. The method of claim 6, wherein metadata for the first token is stored in a key-value repository.

14. A non-transitory computer-readable storage medium having stored thereon instructions that, upon execution by a computing device, cause the computing device at least to:

store a data item in a database, wherein the stored data item is indexed by a first token;

validate a request to access the data item, the validating based at least in part on the first token and a stored association between the first token and information indicative of ownership of the data item;

remove the stored association and generate a second token in response to the request to access the data item;

store the modified data item indexed by the second token; and

store data indicating that the first token is invalid for accessing the data item.

15. The non-transitory computer-readable storage medium of claim 14, comprising further instructions that, upon execution by the computing device, cause the computing devices to at least:

determine that the request to modify the data item is associated with an owner of the data item.

16. The non-transitory computer-readable storage medium of claim 14, comprising further instructions that, upon execution by the computing device, cause the computing devices to at least:

form the first token in response to receiving a request to store the data item.

17. The non-transitory computer-readable storage medium of claim 14, comprising further instructions that, upon execution by the computing device, cause the computing devices to at least:

reassociate the first token with information other than the data item in response to the request to modify the data item, wherein the first token is invalidated by the reassociation.

18. The non-transitory computer-readable storage medium of claim 14, wherein the first token comprises a first unique identifier and the second token comprises a second unique identifier.

19. The non-transitory computer-readable storage medium of claim 14, comprising further instructions that, upon execution by the computing device, cause the computing devices to at least:

retrieve the data item based on the first token.

20. The non-transitory computer-readable storage medium of claim 14, wherein metadata for the first token is stored in a key-value repository.