Amazon Technologies, Inc.

Hanson Char

Jason Curtis Jenks

Brandon B Low

Waylon Brunette

Jesper Mikael Johansson

Peter Sven Vosshall

Tushaar Sethi

Spencer Proffit

Jason Cetina

Matthew John Campagna

Gregory Alan Rubin

Zhengqiang Xu

Alan Greame Davison

Manikandan Subramanian

David Baiyor Murray

Srikanth Murali

Wade Alvin Matveyenko

Thomas J Ahearn

Brian P King

Isuru Ranaweera

Stepan P Yakovlev

Jason Fulghum

Data is encoded to be incrementally authenticable. A plaintext is used to generate a ciphertext that comprises a plurality of authentication tags. Proper subsets of the authentication tags are usable to authenticate respective portions of plaintexts obtained from the ciphertext. Portions of the plaintext can be obtained and authenticated without decrypting the complete ciphertext.

Incremental authenticated data encodings

Disclosed is secure decryption and business rule validation of encrypted confidential data within a hardware security module (HSM). The validation may include the use of a Bloom filter stored and executing within the HSM. The return order of encrypted data within the HSM as well as requests for external data relating to validation may be randomized to further harden against correlation attacks.

Secure validation using hardware security modules

Technology for provision and use of local metrics in a multi-tenant service provider environment is provided. In one example, a method may include receiving service provider environment metrics from a computing instance and receiving local metrics from a local machine in a multi-tenant service provider environment. The local metrics may be combined with the service provider environment metrics and provided for display together.

Local metrics in a service provider environment

A method of using a hardware security module and an adjunct application programming interface to harden tokenization security and encryption key rotation is disclosed. In various embodiments, the method comprises receiving encrypted data at a processor of a computer system, decrypting the encrypted data to cleartext in the processor, and issuing a unique token associated with the data.

Hardening tokenization security and key rotation

Techniques are described for migrating data from a first table to a second table while transforming at least one characteristic of the data. Characteristics transformed may include one or more of an encryption key or method, a table schema, a data structure, or a storage infrastructure. Migration may be performed in two or more phases. A first phase may migrate and transform a majority of the data, such as data that is older than a certain threshold age. A second phase may migrate and transform the remaining, newer data. A status table may indicate which tables are active and are to be written to and read from during data writing and data consuming processes. Moreover, embodiments support data replication across multiple regions.

Transformative migration of static data

Incremented authenticated encryption involves dividing a data stream to be encrypted into multiple data segments and encrypting each of the data segments. For each encrypted data segment, an authorization tag is generated. Each segment's authorization tag may be based on the corresponding segment's position in the sequence of data segments within the data stream. A segment authorization tag may be generated based on an segment initialization vector that may be incremented with each segment authorization tag. Each data segment may be encrypted independently of the others. Similarly, each encrypted data segment may be decrypted and authenticated independently of the others. Additionally, a final authentication tag may be generated. The final authentication tag may be used to authenticate all the data segments of the data stream as a whole.

Multipart authenticated encryption

Growing community of inventors

Mercer Island, WA, United States of America

Hanson Char