Patent ID: 9077541
Filing Date: 2015-07-07
Classification: G06F,H04L

Abstract:
1. A method, comprising: receiving, by a storage service, a binary large object; by a processor of the storage service, creating a first set of data chunks, wherein each of the data chunks in the first set is a subset of the object, and together the data chunks in the first set equal the object; by the processor, assigning an encryption key to each data chunk in the first set; encrypting each of the data chunks in the first set to form a set of encrypted data chunks; by the processor, creating a second set of ciphertext chunks, wherein each of the ciphertext chunks in the second set will, taken together and decrypted, form the binary large object; by the processor, assigning a message authentication code (MAC) to each data chunk in the second set; storing the encrypted data chunks in one or more data stores; storing the encryption keys and the MACs as metadata in a metadata memory, wherein the metadata memory is separate from the one or more data stores; receiving, by the storage service, first user authentication information corresponding to a first authorized user of the binary lame object; storing, in a memory that is separate from the data store, a first access control list, wherein the first access control list includes data relating to the first user authentication information; receiving, by the storage service, a second instance of the binary lame object; receiving, by the storage service, second user authentication information corresponding to a second authorized user of the binary lame object; discarding the second instance of the binary lame object without storing the second instance in the data store; and storing, in a second access control list, data relating to the second user authentication information.