Independent encryption for cross region data set replication

Abstract

A write to a data set may be replicated across regions using independent encryption. Replicated writes are encrypted using payload keys specific to regions. Payload keys can be encrypted and be shared between regions using respective hierarchies of keys for each region, including shared public keys of public-private key pairs.

Description

INDEPENDENT ENCRYPTION FOR CROSS REGION DATA SET REPLICATIONBACKGROUND

[0001] Data storage systems often serve applications where access performance can have important impacts on the quality of work performed by the application. Many different factors can contribute to access performance on a database. Techniques that can improve access performance to data sets of data storage systems are thus highly desirable.BRIEF DESCRIPTION OF THE DRAWINGS

[0002] FIG. 1 is a logical block diagram illustrating independent encryption for cross-region data set replication, according to some embodiments.

[0003] FIG. 2 is a logical block diagram illustrating a provider network offering a database service that may implement independent encryption for cross-region data set replication, according to some embodiments.

[0004] FIG. 3 is a logical block diagram illustrating interactions to perform a write request received for a synchronously replicated table across regions, according to some embodiments.

[0005] FIG. 4 is a logical block diagram illustrating interactions to perform a read request received for a synchronously replicated table across regions, according to some embodiments.

[0006] FIG. 5 is a logical block diagram illustrating replication of a table append-only log across different regions, according to some embodiments.

[0007] FIG. 6 is a logical block diagram illustrating the generation of public-private shard key pairs, according to some embodiments.

[0008] FIG. 7 is a logical block diagram illustrating encryption and decryption using payload keys, according to some embodiments.

[0009] FIG. 8 is a logical block diagram illustrating sharing new payload keys, according to some embodiments.

[0010] FIG. 9 is a high-level flowchart illustrating various methods and techniques to implement independent encryption for cross-region data set replication, according to some embodiments.

[0011] FIG. 10 is a high-level flowchart illustrating various methods and techniques to implement providing payload keys for independent encryption for cross-region data set replication, according to some embodiments.

[0012] FIG. 11 is a block diagram illustrating an example computing system, according to some embodiments.

[0013] While embodiments are described herein by way of example for several embodiments and illustrative drawings, those skilled in the art will recognize that the embodiments are not limited to the embodiments or drawings described. It should be understood, that the drawings and detailed description thereto are not intended to limit embodiments to the particular form disclosed, but on the contrary, the intention is to cover all modifications, equivalents and alternatives falling within the spirit and scope as defined by the appended claims. The headings used herein are for organizational purposes only and are not meant to be used to limit the scope of the description or the claims. As used throughout this application, the word "may" is used in a permissive sense (i.e., meaning having the potential to), rather than the mandatory sense (i.e., meaning must). Similarly, the words “include”, “including”, and “includes” mean including, but not limited to.DETAILED DESCRIPTION

[0014] The techniques described herein may describe independent encryption for crossregion data set replication. Distributed data storage systems offer increased availability and resiliency to failures. However, coordinating interactions with distributed data storage systems may increase in complexity when, for instance, each location may support both read and write access to a data set that is replicated across locations. Further still, the characteristics of each location may add to the challenge of supporting read and write across locations. Regions, for instance, of a provider network may be separated by large distances and communicate via public network communications in order for a communication from one region to reach another. Therefore, implementing encryption to support read and write operations at different locations, such as regions, without interfering with the performance of any one region (e.g., to retain the resiliency of using multiple locations) may be highly desirable.

[0015] As discussed in detail below, independent encryption for cross-region data set replication may provide encryption that can be independently defined by each region so that each region can setup encryption for data updates originating within that region without requiring the consent or agreement of other regions. In this way, if one region becomes unavailable, other regions may continue to operate, using their own respective encryptions schemes. Thus, independent encryption for cross-region data set replication may improve the performance of encryption for a distributed storage system by making encryption resilient to failures of individual storage locations. Furthermore, independent encryption may allow for improved performance of reading or accessing data encrypted at another region. Independent encryption for cross-region data set replication may further improve performance as each region can rotateor change keys for its own region without impact to availability at other regions. As one of ordinary skill in the art may appreciate, independent encryption for cross-region data set replication may improve the performance of distributed data storage systems, as well as computer-related technology more generally.

[0016] FIG. 1 is a logical block diagram illustrating independent encryption for cross-region data set replication, according to some embodiments. A data set 120 may be maintained in respective copies in different regions, such as regions 102a, 102b, 102c, and 102d. Each data store 110a, 110b, 110c, and HOd may include other data sets (not illustrated) that may not be replicated across regions 102. Data set 120 can be written to and read from each region, as indicated at 104a, 104b, 104c, and 104d.

[0017] To ensure that each data set 120 is viewed consistently and can still include the latest updates in the event of a failure of a region (e.g., data set 120 still be read with up-to-date data in the event that region 102c fails or otherwise cannot communicate with other regions), each database 110 may use multi-region replication append only log 130 for table 120. Multi-region replication append-only log 130 may order writes to different items according to respective timestamps assigned to those writes. These timestamps may be assigned at the different regions 102 but may use a global ordering technique (e.g., timestamps using clock values synchronized across regions 102 using, for example, a time synchronization service, like time synchronization service 290 discussed below).

[0018] To perform reads and writes 104 each database 110 may respectively read from and append to the log records in multi -region replication append only log 130, as indicated at 106a, 106b, 106c and 106d. As discussed in detail below with regard to FIGS. 3 - 5, these techniques may be performed to ensure that conflicting writes do not succeed no matter which region the originate at or replicate too (e.g., a write that fails at one region also fails at all other regions). For example, given recorded writes in multi-region replication append-only log 130, each data store 110 can independently reason over the writes and reach the same conclusion for which writes succeed and fail and the order in which they are applied to data set 120.

[0019] In order to ensure that items in data set 120 may be independently encrypted at each region, both in transit and at rest, each region can independently specify its own region-specific keys to implement independent encryption for cross region replication 160 using region-specific encryption hierarchies, such as region encryption hierarchies 150a. 150b, 150c, and 150d. Each region’s hierarchy may include a data set key, such as data set keys 152a, 152b, 152c, and 152d. Data set keys may be used to generate a public-private key pair, such as public-private key pairs 154a, 154b, 154c, and 154d, as well as payload keys, such as payload keys 156a, 156b, 156c, and156d. As discussed in detail below with regard to FIGS. 6 - 10, the encryption key hierarchies 150 may be used to encrypt log records appended to multi -region replication append-only log 130, allowing each region to decrypt updates performed in other regions using an encryption key determined by the region that is the source of the update. For example, using region encryption hierarchy 150b, data store 110b in region 102b, can perform a write request, and append a log record to replicate the write, as indicated at 106b, which can be obtained in other regions, such as region 102c, which can decrypt the log record using a payload key 156b provided to region 102c and encrypted using the private key of public-private key pair 154b and decrypted using the public key of public-private key pair 154b.

[0020] Please note that previous descriptions of a database, data set, region, encryption hierarchy, and multi-region replication append-only log are not intended to be limiting, but are merely provided as logical examples.

[0021] This specification continues with a general description of a provider network that may implement a database service that may implement independent encryption for cross-region data set replication. Then various examples of a database service are discussed, including different components / modules, or arrangements of components / module, that may be employed as part of implementing the database service, in some embodiments. A number of different methods and techniques to implement independent encryption for cross-region data set replication are then discussed, some of which are illustrated in accompanying flowcharts. Finally, a description of an example computing system upon which the various components, modules, systems, devices, and / or nodes may be implemented is provided. Various examples are provided throughout the specification.

[0022] FIG. 2 is a logical block diagram illustrating a provider network offering a database service that may implement independent encryption for cross-region data set replication, according to some embodiments. In various embodiments, a provider network, such as provider network 200, may be a private or closed system or may be set up by an entity such as a company or a public sector organization to provide one or more services (such as various types of cloudbased storage, processing, or other computing resources) accessible via the Internet and / or other networks to clients 270. The provider network 200 may be implemented in a single location or may include numerous data centers hosting various resource pools, such as collections of physical and / or virtualized computer servers, storage devices, networking equipment and the like (e.g., computing system 2000 described below with regard to FIG. 11), needed to implement and distribute the infrastructure and storage services offered by the provider network.

[0023] For example, the provider network (which may, in some implementations, be referred to as a “cloud provider network” or simply as a “cloud”) may refer to a pool of network- accessible computing resources (such as compute, storage, and networking resources, applications, and services), which may be virtualized or bare-metal (e.g., providing direct access to underlying hardware without a virtualization platform). In this way, the provider network can provide convenient, on-demand network access to a shared pool of configurable computing resources that can be programmatically provisioned and released in response to user commands. These resources can be dynamically provisioned and reconfigured to adjust to variable load, providing a fully-managed service and / or server-less experience for users.

[0024] In various embodiments, provider network 200 can be formed as a number of regions, where a region may be a separate geographical area in which the provider network clusters or manages data centers, in some embodiments. Each region may include two or more availability zones (sometimes referred to as fault tolerant zones) connected to one another via a private high speed network, for example a fiber communication connection. An availability zone (also known as an availability domain, or simply a “zone”) may refer to an isolated failure domain including one or more data center facilities with separate power, separate networking, and separate cooling from those in another availability zone, in some embodiments. Preferably, availability zones within a region are positioned far enough away from one another that the same natural disaster should not take more than one availability zone offline at the same time, in some embodiments. Clients 270 can connect to availability zones of the provider network 200 via a publicly accessible network (e.g., the Internet, a cellular communication network).

[0025] Regions may be connected to a global network which includes private networking infrastructure (e.g., fiber connections controlled by the cloud provider) connecting each region to at least one other region, in some embodiments. The provider network 200 may deliver content from points of presence outside of, but networked with, these regions by way of edge locations and regional edge cache servers, in some embodiments. This compartmentalization and geographic distribution of computing hardware enables the provider network to provide low- latency resource access to users on a global scale with a high degree of fault tolerance and stability.

[0026] In some embodiments, provider network 200 may implement various computing resources or services across one or more regions, such as database services 210 (various types of database services including SQL, NoSQL, document, graph, time series, and so on)), storage service 240, which provide various data storage services, time synchronization service 290, which synchronize local times across different regions, and other services 280, which mayinclude a virtual compute service, data processing service(s) (e.g., map reduce, data flow, and / or other large scale data processing techniques), and / or any other type of network-based services (which may include various other types of storage, processing, analysis, communication, event handling, visualization, and security services not illustrated). The resources used to support the operations of such services (e.g., compute and storage resources) may be provisioned in an account associated with the provider network, in contrast to resources requested by users of the provider network, which may be provisioned in user accounts, in some embodiments.

[0027] In various embodiments, the components illustrated in FIG. 2 may be implemented directly within computer hardware, as instructions directly or indirectly executable by computer hardware (e.g., a microprocessor or computer system), or using a combination of these techniques. For example, the components of FIG. 2 may be implemented by a system that includes a number of computing nodes (or simply, nodes), in some embodiments, each of which may be similar to the computer system embodiment illustrated in FIG. 11 and described below. In some embodiments, the functionality of a given system or service component (e.g., a component of database service 210) may be implemented by a particular node or may be distributed across several nodes. In some embodiments, a given node may implement the functionality of more than one service system component (e.g., more than one data store component).

[0028] Database service 210 may implement various types of distributed database services, in some embodiments, for storing, accessing, and updating data in tables hosted in a database. Such services may be enterprise-class database systems that are highly scalable and extensible. In some embodiments, access requests (e.g., requests to get / obtain items, put / insert items, delete items, update or modify items, scan multiple items) may be directed to a table in database service 210 that is distributed across multiple physical resources, and the database system may be scaled up or down on an as needed basis. In some embodiments, clients / subscribers may submit requests in a number of ways, e.g., interactively via graphical user interface (e.g., a console) or a programmatic interface to the database system. In some embodiments, database service 210 may provide a RESTful programmatic interface in order to submit access requests (e.g., to get, insert, delete, or scan data). In some embodiments, a query language (e.g., Structured Query Language (SQL)) may be used to specify access requests.

[0029] In some embodiments, clients 270 may encompass any type of client configurable to submit network-based requests to provider network 200 via network 260, including requests for database service 210 (e.g., to access item(s) in a table or secondary index in database service 210). For example, in some embodiments a given client 270 may include a suitable version of aweb browser, or may include a plug-in module or other type of code module that executes as an extension to or within an execution environment provided by a web browser. Alternatively in a different embodiment, a client 270 may encompass an application such as a database client / application (or user interface thereof), a media application, an office application or any other application that may make use of a database in database service 210 to store and / or access the data to implement various applications. In some embodiments, such an application may include sufficient protocol support (e.g., for a suitable version of Hypertext Transfer Protocol (HTTP)) for generating and processing network-based services requests without necessarily implementing full browser support for all types of network-based data. That is, client 270 may be an application that interacts directly with provider network 200, in some embodiments. In some embodiments, client 270 may generate network-based services requests according to a Representational State Transfer (REST)-style network-based services architecture, a documentor message-based network-based services architecture, or another suitable network-based services architecture. Note that in some embodiments, clients of database service 210 may be implemented within provider network 200 (e.g., applications hosted on a virtual compute service).

[0030] In some embodiments, clients of database service 210 may be implemented on resources within provider network 200 (not illustrated). For example, a client application may be hosted on a virtual machine or other computing resources implemented as part of another provider network service that may send access requests to database service 210 via an internal network (not illustrated).

[0031] In some embodiments, a client 270 may provide access to provider network 200 to other applications in a manner that is transparent to those applications. For example, client 270 may integrate with a database on database service 210. In such an embodiment, applications may not need to be modified to make use of a service model that utilizes database service 210. Instead, the details of interfacing to the database service 210 may be coordinated by client 270.

[0032] Client(s) 270 may convey network-based services requests to and receive responses from provider network 200 via network 260, in some embodiments. In some embodiments, network 260 may encompass any suitable combination of networking hardware and protocols necessary to establish network-based-based communications between clients 270 and provider network 200. For example, network 260 may encompass the various telecommunications networks and service providers that collectively implement the Internet. In some embodiments, network 260 may also include private networks such as local area networks (LANs) or wide area networks (WANs) as well as public or private wireless networks. For example, both a givenclient 270 and provider network 200 may be respectively provisioned within enterprises having their own internal networks. In such an embodiment, network 260 may include the hardware (e.g., modems, routers, switches, load balancers, proxy servers, etc.) and software (e.g., protocol stacks, accounting software, firewall / security software, etc.) necessary to establish a networking link between given client(s) 270 and the Internet as well as between the Internet and provider network 200. It is noted that in some embodiments, client(s) 270 may communicate with provider network 200 using a private network rather than the public Internet.

[0033] In some embodiments, database service 210 may implement control plane 220 to implement one or more administrative components, such as automated admin instances or nodes (not illustrated but which may provide a variety of visibility and / or control functions). In various embodiments, control plane 220 may direct the performance of different types of control plane operations among the nodes, systems, or devices implementing database service 210, in some embodiments. Control plane 220 may provide visibility and control to system administrators via administrator console 226, in some embodiments. Administrator console 226 may allow system administrators to interact directly with database service 210 (and / or the underlying system). In some embodiments, the administrator console 226 may be the primary point of visibility and control for database service 210 (e.g., for configuration or reconfiguration by system administrators). For example, the administrator console may be implemented as a relatively thin client that provides display and control functionally to system administrators and / or other privileged users, and through which system status indicators, metadata, and / or operating parameters may be observed and / or updated. Control plane 220 may provide an interface or access to information stored about one or more detected control plane events, such as data backup or other management operations for a table, at database service 210, in some embodiments.

[0034] Storage node management 224 may provide resource allocation, in some embodiments, for storing additional data in table submitted to database service 210. For instance, control plane 220 may communicate with storage nodes 230 to initiate the performance of various control plane operations, such as moves of table partitions, merges of table partitions, splits of table partitions, update tables, delete tables, create secondary indexes, etc.... In some embodiments, control plane 220 may include a node recovery feature or component that handles failure events for storage nodes 230, propagation architectures 290 and request routers 250 (e.g., adding new nodes, removing failing or underperforming nodes, deactivating or decommissioning underutilized nodes, etc).

[0035] Various durability, resiliency, control, or other operations may be directed by control plane 220. For example, storage node management 224 may detect merge, split, copy, or move events for partitions at storage nodes in order to ensure that the storage nodes maintain satisfy a minimum performance level for performing access requests. For instance, in various embodiments, there may be situations in which a partition (or a replica thereof) may need to be copied, e.g., from one storage node to another. For example, if there are three replicas of a particular partition, each hosted on a different physical or logical machine, and one of the machines fails, the replica hosted on that machine may need to be replaced by a new copy of the partition on another machine. In another example, if a particular machine that hosts multiple partitions of one or more tables experiences heavy traffic, one of the heavily accessed partitions may be moved (using a copy operation) to a machine that is experiencing less traffic in an attempt to more evenly distribute the system workload and improve performance. In some embodiments, storage node management 224 may perform partition moves using a physical copying mechanism (e.g., a physical filesystem mechanism, such as a file copy mechanism) that copies an entire partition from one machine to another, rather than copying a snapshot of the partition data row by. While the partition is being copied, write operations targeting the partition may be logged. During the copy operation, any logged write operations may be applied to the partition by a catch-up process at periodic intervals (e.g., at a series of checkpoints). Once the entire partition has been copied to the destination machine, any remaining logged write operations (i.e. any write operations performed since the last checkpoint) may be performed on the destination partition by a final catch-up process. Therefore, the data in the destination partition may be consistent following the completion of the partition move, in some embodiments. In this way, storage node management 224 can move partitions amongst storage nodes 230 while the partitions being moved are still “live” and able to accept access requests.

[0036] In some embodiments, the partition moving process described above may be employed in partition splitting operations by storage node management 224 in response to the detection of a partition split event. For example, a partition may be split because it is large, e.g., when it becomes too big to fit on one machine or storage device and / or in order to keep the partition size small enough to quickly rebuild the partitions hosted on a single machine (using a large number of parallel processes) in the event of a machine failure. A partition may also be split when it becomes too “hot” (i.e. when it experiences a much greater than average amount of traffic as compared to other partitions). For example, if the workload changes suddenly and / or dramatically for a given partition, the system may be configured to react quickly to the change. In some embodiments, the partition splitting process described herein may be transparent toapplications and clients / users, which may allow the data storage service to be scaled automatically (i.e. without requiring client / user intervention or initiation).

[0037] In some embodiments, each database partition 234 may be identified by a partition ID, which may be a unique number (e.g., a GUID) assigned at the time the partition is created. A partition 234 may also have a version number that is incremented each time the partition goes through a reconfiguration (e.g., in response to adding or removing replicas, but not necessarily in response to a master failover). When a partition is split, two new partitions may be created, each of which may have a respective new partition ID, and the original partition ID may no longer be used, in some embodiments. In some embodiments, a partition may be split by the system using a split tool or process in response to changing conditions.

[0038] Split or move events may be detected by storage node management 224 in various ways. For example, partition size and heat, where heat may be tracked by internally measured metrics (such as IOPS), externally measured metrics (such as latency), and / or other factors may be evaluated with respect to various performance thresholds.

[0039] System anomalies may also trigger split or move events (e.g., network partitions that disrupt communications between replicas of a partition in a replica group, in some embodiments. Storage node management 224 may detect storage node failures, or provide other anomaly control, in some embodiments. If the partition replica hosted on the storage node on which a fault or failure was detected was the master for its replica group, a new master may be elected for the replica group (e.g., from amongst remaining storage nodes in the replica group). Storage node management 224 may initiate creation of a replacement partition replica while the source partition replica is live (i.e. while one or more of the replicas of the partition continue to accept and service requests directed to the partition), in some embodiments. In various embodiments, the partition replica on the faulty storage node may be used as the source partition replica, or another replica for same partition (on a working machine) may be used as the source partition replica, e.g., depending type and / or severity of the detected fault.

[0040] Control plane 220 may implement table / index creation and management 222 to manage the creation (or deletion) of database tables and / or secondary indexes hosed in database service 210, in some embodiments. For example, a request to create a secondary index may be submitted via administrator console 226 (or other database service 210 interface) which may initiate performance of a workflow to generate appropriate system metadata (e.g., a table identifier that is unique with respect to all other tables in database service 210, secondary index performance or configuration parameters, and / or various other operations for creating a secondary index as discussed below). Backup management (not illustrated) may handle ormanage backup requests to make copies as of a version or point-in-time of a database, as partition snapshots 242 and partition change log(s) 244 that together makeup partition backup(s) 241 in storage service 240 which may be used to perform an offline build of a replicated data set like a secondary index.

[0041] Database service 210 may implement request routers 250, in some embodiments. Request routers 250 may receive and parse client access requests, in various embodiments in order to determine various features of the request, to parse, authenticate, throttle and / or dispatch access requests, among other things, in some embodiments.

[0042] In some embodiments, database service 210 may also implement a plurality of storage nodes 230, each of which may manage one or more partitions of a database table or secondary index on behalf of clients / users or on behalf of database service 210 which may be stored in database storage 234 (on storage devices attached to storage nodes 230 or in network storage accessible to storage nodes 230).

[0043] Storage nodes 230 may implement item request processing 232, in some embodiments. Item request processing 232 may perform various operations (e.g., read / get, write / update / modify / change, insert / add, delete / remove, or conditional write) to access individual items stored in tables in database service 210, in some embodiments. In some embodiments, item request processing 232 may support operations performed as part of a transaction, including techniques such as locking items in a transaction and / or ordering requests to operate on an item as part of transaction along with other requests according to timestamps (e.g., timestamp ordering) so that storage nodes 230 can accept or reject the transaction-related requests. In some embodiments, item request processing 232 may maintain database partitions 234 according to a database model (e.g., a non-relational, NoSQL, or other key-value database model).

[0044] In some embodiments, database service 210 may provide functionality for creating, accessing, and / or managing tables or secondary indexes at nodes within a multi-tenant environment. For example, database partitions 234 may store table item(s) from multiple tables, indexes, or other data stored on behalf of different clients, applications, users, accounts or nonrelated entities, in some embodiments.

[0045] In addition to dividing or otherwise distributing data (e.g., database tables) across storage nodes 230 in separate partitions, storage nodes 230 may also be used in multiple different arrangements for providing resiliency and / or durability of data as part of larger collections or groups of resources. A replica group, for example, may be composed of a number of storage nodes maintaining a replica of particular portion of data (e.g., a partition) for the database service 210. In some embodiments, a replica group may include a primary storage node which may actas, for instance, a read-write node, for the partition. A primary storage node of a replica group may also be involved in the management of partition. Moreover, different replica groups may utilize overlapping nodes, where a storage node 230 may be a member of multiple replica groups, maintaining replicas for each of those groups whose other storage node 230 members differ from the other replica groups.

[0046] Different models or formats for storing data for database tables in database service 210 may be implemented, in some embodiments. For example, in some embodiments, nonrelational, NoSQL, semi-structured, or other key-value data formats may be implemented. In at least some embodiments, the data model may include tables containing items that have one or more attributes. In such embodiments, each table maintained on behalf of a client / user may include one or more items, and each item may include a collection of one or more attributes. The attributes of an item may be a collection of one or more key-value pairs, in any order, in some embodiments. In some embodiments, each attribute in an item may have a key, a type, and a value. In some embodiments, the items may be managed by assigning each item a primary key value (which may include one or more attribute values), and this primary key value may also be used to uniquely identify the item. In some embodiments, a large number of attributes may be defined across the items in a table, but each item may contain a sparse set of these attributes (with the particular attributes specified for one item being unrelated to the attributes of another item in the same table), and all of the attributes may be optional except for the primary key attribute(s) and version attributes, in some embodiments. In some embodiments, the tables maintained by the database service 210 (and the underlying storage system) may have no predefined format other than their reliance on the primary key. Accordingly, a table may, in some embodiments, not include the same numbers or types of columns in each row. In some embodiments, tables may referred to as a collection, document store, of various other set of items with varying attributes.

[0047] Metadata or other system data for tables may also be stored as part of database partitions using similar partitioning schemes and using similar indexes, in some embodiments.

[0048] Database service 210 may provide an application programming interface (API) for requesting various operations targeting tables, indexes, items, and / or attributes maintained on behalf of storage service clients. In some embodiments, the service (and / or the underlying system) may provide both control plane APIs and data plane APIs. The control plane APIs provided by database service 210 (and / or the underlying system) may be used to manipulate table-level entities, such as tables and indexes and / or to re-configure various tables These APIs may be called relatively infrequently (when compared to data plane APIs). In someembodiments, the control plane APIs provided by the service may be used to create tables or secondary indexes for tables at separate storage nodes, import tables, export tables, delete tables or secondary indexes, explore tables or secondary indexes (e.g., to generate various performance reports or skew reports), modify table configurations or operating parameter for tables or secondary indexes, and / or describe tables or secondary indexes, and create and / or associate functions with tables. In some embodiments, control plane APIs that perform updates to tablelevel entries may invoke asynchronous workflows to perform a requested operation. Methods that request “description” information (e.g., via a describeTables API) may simply return the current known state of the tables or secondary indexes maintained by the service on behalf of a client / user. The data plane APIs provided by database service 210 (and / or the underlying system) may be used to perform item-level operations, such as requests for individual items or for multiple items in one or more tables table, such as queries, batch operations, and / or scans.

[0049] The APIs provided by the service described herein may support request and response parameters encoded in one or more industry-standard or proprietary data exchange formats, in different embodiments. For example, in various embodiments, requests and responses may adhere to a human-readable (e.g., text-based) data interchange standard, (e.g., JavaScript Object Notation, or JSON), or may be represented using a binary encoding (which, in some cases, may be more compact than a text-based representation). In various embodiments, the system may supply default values (e.g., system-wide, user-specific, or account-specific default values) for one or more of the input parameters of the APIs described herein.

[0050] Database service 210 may include support for some or all of the following operations on data maintained in a table (or index) by the service on behalf of a storage service client: perform a transaction (inclusive of one or more operations on one or more items in one or more tables), put (or store) an item, get (or retrieve) one or more items having a specified primary key, delete an item, update the attributes in a single item, query for items using an index, and scan (e.g., list items) over the whole table, optionally filtering the items returned, or conditional variations on the operations described above that are atomically performed (e.g., conditional put, conditional get, conditional delete, conditional update, etc.). For example, the database service 210 (and / or underlying system) described herein may provide various data plane APIs for performing item-level operations, such as a Transactltems API, Putltem API, a Getltem (or Getltems) API, a Deleteltem API, and / or an Updateitem API, as well as one or more indexbased seek / traversal operations across multiple items in a table, such as a Query API and / or a Scan API.

[0051] Storage service 240 may be file, object-based, or other type of storage service that may be used to store partition snapshots as backups 241. Storage service 240 may implement striping, sharding, or other data distribution techniques so that different portions of a partition backup 241 are stored across multiple locations (e.g., at separate nodes). In at least some embodiments, update logs (e.g., created by updates for database partitions by item request processing 232) may be stored as objects in storage service 240.

[0052] In some embodiments, requests to convert, enable, or disable synchronous global replication of a datable in multiple regions of a provider network may be supported (e.g., via requests to control plane 220 via administrator console 226). For example a request to convert an existing global table that performs asynchronous replication to synchronous replication may be performed. To perform this request, table management 222 may create or establish various data and metadata information to create a multi-region replication log in multi-region replication journal 258 and update request routers 252, and begin enabling the use of system attributes to be stored for item attribute values (e.g., timestamps, source of updates, etc.). As discussed in detail below with regard to FIGS. 3 - 5, request routers 252 and cross-region synchronous request handling nodes 356 may work together with multi-region replication journal 258 in order to implement synchronous cross-region replication for a multi-writer database table. Although not illustrated, write requests may be writes received and initially dispatched to transaction coordination nodes 254, which may handle transactions and dispatch the performance of individual operations with respect to a table replicated across regions synchronously to crossregion synchronous request handling 256).

[0053] FIG. 3 is a logical block diagram illustrating interactions to perform a write request received for a synchronously replicated table across regions, according to some embodiments. Each region maintaining a replica of a table may communicate updates to the table via a shared log, such as append-only table log 321, as discussed in detail above with regard to FIG. 1. Each instantiation (e.g., participant) that updates and provides access to append-only table log 321 (e.g., multi-region replication journal 320 in region 302 and multi-region replication journal 325 in region 301) may be in frequent or continuous communication, as indicated at 303, according to the respective consensus protocol used for maintaining append-only table log 321 across regions (as discussed in detail below with regard to FIG. 5).

[0054] Cross-region synchronous request handling nodes, 311 and 313, may respectively handle interactions to read and write from append-only table log 321, as indicated at 304 and 305. Various styles of interactions may be implemented to read and write 304 and 305 from append-only table log 321. For example, in some embodiments, a pull-based model, where cross-region synchronous request handling 311 specifically requests to read from append-only table log 321 and write from append-only table log 321 may be implemented (not illustrated). In other embodiments, a push-based model, where cross-region synchronous request handling 311 receives log records from append-only table log 321 when they are confirmed by multi -region replication journal 320 (e.g., similarly for multi -region replication journal 325 with respect to cross-region synchronous request handling 313). For instance, read / write log 304 and 305 interactions may be one (or more) background processes or threads, which may listen for updates and push out new updates in singly and / or in batches. In this way, other request handling flows (e.g., for reads and writes as depicted in FIGS. 3 and 4) may not be “waiting” on specific requests to read / append to append-only table log 321.

[0055] A write request 312 is received at request router 310 in region 302. Request router 310 may dispatch the request, as indicated 314, to the assigned cross-region synchronous request handling 311. Although not illustrated, cross-region synchronous request handling node 311 may implement a daemon or other component of time synchronization service 290, which may provide a globally, synchronized clock time according to a time synchronization service 290. In this way, clock times used to assign / determine a timestamp for writes (or reads) received at cross-region synchronous request handling nodes 311 and 313 (or any other region) can accurately assign timestamps. For example, the time synchronization service 290 may provide a range of time for which a point in time can be considered to be accurate. This range may be described as clock boundaries, “Clockbound.” The use of Clockbound may be to assign a time value (e.g., timestamp) to database system actions in order to support accurate ordering of writes to items in time (e.g., the write received at one region with a timestamp before the timestamp of a write for the same item received at another region was actually before the later write (and not, for example, erroneously considered earlier because of clock-skew between local clocks maintained at different regions).

[0056] Different items of a table that is stored across multiple partitions may use a number of different cross-region synchronous request handling nodes assigned to different partition(s), in some embodiments. Therefore, request router 310 may, in some embodiments, access a node mapping between cross-region synchronous request handling nodes 311 for a table and particular partitions or other ranges / portions of the table to identify node 311 for write request 312.

[0057] Cross-region synchronous request handling 311 may read the item 316 from storage node 340. The item may be returned, as indicated at 318. Cross-region synchronous request handling 311 may use the item as the current local version. Cross-region synchronous request handling 311 may view, read, or otherwise obtain the item log record(s) from append-only tablelog 321 at multi-region replication journal 330. These item log records may correspond to other region writes for the same item. Cross-region synchronous request handling 311 may generate an updated version of the item in accordance with the write request and the obtained log records. For example, each log record may describe a value of the item, timestamp, and corresponding condition to be satisfied for the log record to be applied so that the sequence of log records can be reasoned over to determine the updated version (e.g., a timestamp value of a previous write to the item, such as Record A {item x=‘5’, timestamp=‘ 10’, condition=(if x.current_timestamp==null), Record B {item x=‘6’, timestamp=‘ 13’, condition=(if x.current_timestamp==10), Record C {item x=‘8’, timestamp=‘22’, condition=(if x.current_timestamp==13)). In this way, conflicting writes (e.g., writes where the condition is not satisfied based on timestamp ordering provided in the log are not performed (because they conflict).

[0058] The updated version of the item may be generated based on the write request and the obtained log records, and appended to append only table log 321 as part of read / write log 304. For example, if the write says x=‘7’, timestamp =‘25’, and condition is if x.current_timestamp==22, then the updated version may be x=’7’. A conditional write may be performed, as indicated at 328, to store the update. The condition may be based on the timestamp determined for the write request (e.g., by cross-region synchronous request handling 311 when it is received using clock-values based on a synchronized time range provided by time sync service 290 (discussed above with regard to FIG. 2), such as “x.current_timestamp==22” in the above example). If the condition fails at storage node 340, then the write is not applied. This could occur because a new write could have been received from multi-region replication journal 320 in append-only table log 321 (e.g., background read / write 304) with an earlier timestamp (e.g., <25 that was performed and succeeded prior to the other write) as in various embodiments, read / write log and cross-region synchronous request handling 311 may be performing requests both on what was received from request router 310 and also from the append-only table log 321 from another region. For instance, as illustrated in FIG. 3, the same conditional write may be performed, as indicated at 322 (for write request 312), and success / failure received 324. Both storage node 341 and storage node 340 should reach the same conclusion about the condition in each region. Success or failure for write request 312 may be passed through, as indicated at 332 and 334 to provide a write response 336.

[0059] FIG. 4 is a logical block diagram illustrating interactions to perform a read request received for a synchronously replicated table across regions, according to some embodiments. Similar to the discussion above with regard to FIG. 3, each region maintaining a replica of atable may communicate updates to the table via a shared log, such as append-only table log 421, as discussed in detail above with regard to FIG. 1. Each instantiation (e.g., participant) that updates and provides access to append-only table log 421 (e.g., multi-region replication journal 420 in region 402 and multi-region replication journal 431 in region 401) may be in frequent or continuous communication, as indicated at 403, according to the respective consensus protocol used for maintaining append-only table log 421 across regions (as discussed in detail below with regard to FIG. 5). Cross-region synchronous request handling node, 411, may respectively handle interactions to read and write from append-only table log 421, as indicated at 404. Various styles of interactions may be implemented to read and write 404 from append-only table log 421. For example, in some embodiments, a pull-based model, where cross-region synchronous request handling 411 specifically requests to read from append-only table log 421 and write from append-only table log 421 may be implemented (not illustrated). In other embodiments, a push-based model, where cross-region synchronous request handling 411 receives log records from append-only table log 421 when they are confirmed by multi -region replication journal 430. For instance, read / write log 404 interactions may be one (or more) background processes or threads, which may listen for updates and push out new updates in singly and / or in batches.

[0060] A read request 412 is received at request router 410 in region 402. Request router 410 may dispatch the read request, as indicated 414, to the assigned cross-region synchronous request handling node 411. Different items of a table that is stored across multiple partitions may use a number of different cross-region synchronous request handling nodes assigned to different partition(s), in some embodiments.

[0061] Cross-region synchronous request handling 411 may assign a timestamp for read request 412 (e.g., using the time synchronization service 290 as discussed above). Cross-region synchronous request handling 411 may also obtain the log record(s) for the item from append- only table log 421 at multi-region replication journal 430 (e.g., via read / write log 404). These item log records may correspond to other region writes that are inflight (or writes at region 402 that have not yet been completed). As indicated at 423, cross-region synchronous request handling node 411 may wait until the timestamps of records earlier than the assigned timestamp of the read request have been processed by cross-region request handling node 411. For example, wait 432 may happen until a timestamp value is seen that occurs after the timestamp of read request 412 (in this way, any writes with earlier timestamps that are slow to replicate may have been seen). In some embodiments, multi-region replication journal 430 may insert a heartbeatwrite to advance the timestamp (but not change the value). In this way, wait 423 does not happen indefinitely (in the event no writes arrive to have a later timestamp).

[0062] Once wait 423 is completed, cross-region synchronous request handling 411 may send a request to read the item, as indicated at 422, from storage node 440. The item may be returned 424 and passed back, as indicated 426 in order to provide a response with the item, as indicated at 428.

[0063] Although FIG. 4 depicts a wait-based technique to perform reads, in some embodiments, a read request can be performed by appending a read-request log record, which does not change the value of the item but does have a time-based condition so that the read value is only returned if the time-based condition succeeds.

[0064] FIG. 5 is a logical block diagram illustrating replication of a table append-only log across different regions, according to some embodiments. Different regions of a provider network, 502a, 502b, and 502c, may host respective instantiations of multi-region replication journal 258 (discussed above with regard to FIG. 2), as depicted at 510a, 510b, and 510c. For a table, copies of an append-only log, such as 520a, 520b, and 520c, may be maintained and used to perform replication of writes to the table in synchronous fashion, as discussed above with regard to FIGS. 3 and 4. Each multi-region replication journal 510 may implement an internal replication, durability and consensus technique (not illustrated). For example, chain replication techniques may be implemented to maintain a highly durable and highly available copy of the append-only log 520 when writes are sent to be appended to table append-only log 520 by a cross-region synchronous request handling node (as discussed above with regard to FIGS. 2-3). In chain replication, a sequence of nodes maintaining the local copy of the append-only log receives and performs an update (e.g., the appended log records). A head node stores a copy of the log, which then propagates the update (e.g., log record to be appended back through each node in the sequence of nodes until a last node, a tail node appends the log. The append-only log is read from the tail node.

[0065] Once submitted to the local table append-only log (e.g., at 520a), consensus protocol 530 may be implemented in order to ensure that the write is durably replicated to other copies of the table append-only log (e.g., at 520b and 520c). Different consensus protocol techniques 530 can be implemented. For example, a Paxos-based technique or other consensus protocol that can survive failures of individual participants (e.g., failures of individual regions), with different regions acting in different roles (e.g., proposer, acceptor, and learner) for each write to append. Other consensus protocols, such as a two-phase commit, may be implemented.

[0066] FIG. 6 is a logical block diagram illustrating the generation of public-private shard key pairs, according to some embodiments. As discussed above with regard to FIG. 1, a region encryption hierarchy may use a data set key to generate a public-private key pair, which may then be used to encrypt and share payload keys across regions. For example, in region 602 an instantiation of a key management service, key management service 612, may generate a table key for a table hosted in database service 210 that is replicated across regions, including region 604. A table key 613 may, in some embodiments, be derived or generated on the basis of another key (e.g., a region key, not illustrated). A table key 613 may be in, some embodiments, a key used as part of a symmetric encryption scheme, which can be used to both encrypt and decrypt data using a corresponding encryption algorithm. Key management service 612 may provide a table key 613, to be stored as part of table metadata 642, as indicated at 652, and to control plane 622.

[0067] In some embodiments, control plane 622 may generate a shard key pair, which is a public-private key pair that corresponds to a particular shard (e.g., a partition of a table) that is replicated across regions. For example, RSA (Rivest-Shamir-Adleman) is a public-private key encryption technique that can be used to generate the public-private key pair in one embodiment, though other public-private key pair techniques may be used in other embodiments. Control plane 622 provides the shard key pairs, as indicated at 623, to be stored as part of table metadata 642, as indicated at 662 and to cross-region synchronous request handling 632. In some embodiments, table key 652 may be used to envelope encrypt the private key of the shard key pair when stored as part of table metadata 642. Public keys of the shard key pairs may be exchanged, as indicated at 670, between control planes 622 and 624. For example, a communication protocol separate from the multi-region append-only log may be used to exchange shard public keys of key pairs.

[0068] As illustrated, region 604 includes an instantiation of a key management service, key management service 614, may generate a table key for a table hosted in database service 210 that is replicated across regions, including region 602. Key management service 614 may provide a table key 615, to be stored as part of table metadata 644, as indicated at 654, and to control plane 624. Control plane 624 may provide the shard key pairs, as indicated at 625, stored as part of table metadata 644, as indicated at 644 and to cross-region synchronous request handling 634.

[0069] In some embodiments, shard key pairs may be created and public keys shared as illustrated in FIG. 6 when new shards are created or existing shards are split. For example, as discussed above table management 222 may detect partition (e.g., shard splits) when a current partition becomes overutilized in storage or request processing capacity. As part of creating thenew partition(s), new shard key pairs may be generated and provided as discussed above. Providing new shard key pairs may be considered one form of a shard key pair rotation event. Other shard key pair rotation events may occur periodically (e.g., every month or six months) in order to continuously change encryption to avoid security breaches.

[0070] FIG. 7 is a logical block diagram illustrating encryption and decryption using payload keys, according to some embodiments. For example, in region 702, a request to update an item is received, and the updated item 762 may be provided to cross-region synchronous request handling 712. Table metadata 740 may provide the payload key 742 to cross-region synchronous request handling 712 in order to encrypt the updated item, provided as encrypted item 764 and payload key ID 768 as a record to be appended to multi-region replication journal 730 at the table append-only log 732.

[0071] At region 704, cross-region synchronous request handling 714 may obtain the record with encrypted item 764 and payload key ID 768. Payload key ID 768 may be used to access payload key cache 750 in order to obtain the corresponding source region payload key 752. Cross-region synchronous request handling 714 may then decrypt the record using the source region payload key and provide the updated item 762 for replication in region 704.

[0072] The encryption techniques illustrated in FIG. 7 may be combined with the write performance techniques illustrated in FIG. 3, which may generated the updated item 762, in order to apply independent cross region encryption as part of the performance of perform a write request received for a synchronously replicated table across regions. Such techniques may also be applied for asynchronous write replication techniques.

[0073] FIG. 8 is a logical block diagram illustrating sharing new payload keys, according to some embodiments. For example, in region 802, a new payload key is received, and the updated item 862 may be provided to cross-region synchronous request handling 812. New payload keys may be generated periodically (e.g., hourly) using various key generation techniques. Payload keys may be generated using a symmetric encryption scheme, in some embodiments.

[0074] Table metadata 840 may provide the destination region shard public key 842 to crossregion synchronous request handling 812 in order to encrypt the updated item, provided as encrypted new payload key 863, payload key ID 864, and shard key ID 866 as a record to be appended to multi-region replication journal 830 at the table append-only log 832. At region 804, cross-region synchronous request handling 814 may obtain the record with encrypted new payload key 863, payload key ID 864, and shard key ID 866 and access shard key cache 850 to obtain the destination region private shard key 852. Cross-region synchronous request handling814 to decrypt the record and provide the new payload key 862 to be included in payload key cache 870.

[0075] The examples of a database that implements independent encryption for cross-region data set replication as discussed in FIGS. 2 - 8 above have been given in regard to a database service (e.g., a relational database, a document database, a non-relational database, etc.). However, various other types of database systems or storage systems can advantageously implement independent encryption for cross-region data set replication, in other embodiments. FIG. 9 is a high-level flowchart illustrating various methods and techniques to implement independent encryption for cross-region data set replication, according to some embodiments. These techniques, as well as the techniques discussed with regard to FIG. 10, may be implemented using components or systems as described above with regard to FIGS. 2 - 8, as well as other types of databases or storage systems, and thus the following discussion is not intended to be limiting as to the other types of systems that may implement the described techniques.

[0076] As indicated at 910, a write may be performed to a data set replicated across different regions of a provider network, in some embodiments. The update may be received at a first region of the different regions. The data set may be writeable via requests received at individual ones of the different regions.

[0077] As indicated at 920, the write may be replicated to the table to the different regions of the provider network, in some embodiments. For example as depicted in FIG. 3, synchronous write replication techniques may be implemented. In other embodiments, asynchronous write replication techniques may be implemented. As indicated at 930, the write may be performed on an item of the data set in the first region, in some embodiments. As indicated at 940, the item of the data set may be encrypted in the first region with a payload key for the first region, in some embodiments. As indicated at 950, the encrypted item of the data set may be appended to a multi-region append only log, in some embodiments. For example, the encrypted item may be stored in a record along with an identifier for the payload key, in one embodiment, that may allow the second region to lookup the payload key in a cache of previously received payload keys. In other embodiments, the payload key may, itself, be provided as part of the record, encrypted using the public key of the target destination (e.g., the second region).

[0078] As indicated at 960, the encrypted item may be obtained from the multi-region append-only log at a second region of the different regions, in some embodiments. The encrypted item may be decrypted in the second region using the payload key for the first region. The payload key for the first region may have been decrypted in the second region using aprivate key of a public-private key pair for the second region to decrypt the payload key. The payload key may have been previously encrypted using a public key of the public-private key pair at the first region. As indicated at 970, the data set may be updated in the second region using the decrypted item.

[0079] FIG. 10 is a high-level flowchart illustrating various methods and techniques to implement providing payload keys for independent encryption for cross-region data set replication, according to some embodiments. As indicated at 1010, public-private key pairs for individual ones of regions of a distributed data store that replicates a data set across the regions may be generated, in some embodiments. As discussed above with regard to FIG. 6, in at least some embodiments, respective data set keys for different ones of the regions may be used to generate the public-private key pairs or may be used to encrypt the private keys of the publicprivate key pairs and store them locally in respective regions as part of .

[0080] As indicated at 1020, public keys of the public-private key pairs may be shared amongst the regions, in some embodiments. For example, a cross region communication between components (e.g., control planes as depicted in FIG. 6) may be performed in order to share the different public keys. As indicated at 1030, payload keys for individual ones of the regions may be obtained, in some embodiments. As indicated at 1040, the payload keys may be encrypted using the public keys of the public-private key pairs of the regions, in some embodiments. As indicated at 1050, the encrypted payload keys may be appended at the regions to a multi-region journal, in some embodiments.

[0081] As indicated at 1060, the encrypted payload keys may be obtained from the multiregion journal at the regions, in some embodiments. As indicated at 1070, the encrypted payload keys may be decrypted using the private keys of the public-private key pairs at the regions, in some embodiments. The decrypted payload keys may be stored in a cache and accessed for different source regions when other updates are obtained from the multi-region append-only log having been appended to the log by the different source regions and identified using a payload key identifier.

[0082] The methods described herein may in various embodiments be implemented by any combination of hardware and software. For example, in some embodiments, the methods may be implemented by a computer system (e.g., a computer system as in FIG. 11) that includes one or more processors executing program instructions stored on a computer-readable storage medium coupled to the processors. The program instructions may implement the functionality described herein (e.g., the functionality of various servers and other components that implement the distributed systems described herein). The various methods as illustrated in the figures anddescribed herein represent example embodiments of methods. The order of any method may be changed, and various elements may be added, reordered, combined, omitted, modified, etc.

[0083] Embodiments to implement independent encryption for cross-region data set replication as described herein may be executed on one or more computer systems, which may interact with various other devices. One such computer system is illustrated by FIG. 11. In different embodiments, computer system 2000 may be any of various types of devices, including, but not limited to, a personal computer system, desktop computer, laptop, notebook, or netbook computer, mainframe computer system, handheld computer, workstation, network computer, a camera, a set top box, a mobile device, a consumer device, video game console, handheld video game device, application server, storage device, a peripheral device such as a switch, modem, router, or in general any type of computing or compute node, computing device or electronic device.

[0084] In the illustrated embodiment, computer system 2000 includes one or more processors 2010 coupled to a system memory 2020 via an input / output (VO) interface 2030. Computer system 2000 further includes a network interface 2040 coupled to I / O interface 2030, and one or more inpuVoutput devices 2050, such as cursor control device, keyboard, and display(s). Display(s) may include standard computer monitor(s) and / or other display systems, technologies or devices, in some embodiments. In some embodiments, it is contemplated that embodiments may be implemented using a single instance of computer system 2000, while in other embodiments multiple such systems, or multiple nodes making up computer system 2000, may host different portions or instances of embodiments. For example, in some embodiments some elements may be implemented via one or more nodes of computer system 2000 that are distinct from those nodes implementing other elements.

[0085] In various embodiments, computer system 2000 may be a uniprocessor system including one processor 2010, or a multiprocessor system including several processors 2010 (e.g., two, four, eight, or another suitable number). Processors 2010 may be any suitable processor capable of executing instructions, in some embodiments. For example, in various embodiments, processors 2010 may be general-purpose or embedded processors implementing any of a variety of instruction set architectures (ISAs), such as the x86, PowerPC, SPARC, or MIPS ISAs, or any other suitable ISA. In multiprocessor systems, each of processors 2010 may commonly, but not necessarily, implement the same ISA.

[0086] In some embodiments, at least one processor 2010 may be a graphics processing unit. A graphics processing unit or GPU may be considered a dedicated graphics-rendering device for a personal computer, workstation, game console or other computing or electronic device, insome embodiments. Modern GPUs may be very efficient at manipulating and displaying computer graphics, and their highly parallel structure may make them more effective than typical CPUs for a range of complex graphical algorithms. For example, a graphics processor may implement a number of graphics primitive operations in a way that makes executing them much faster than drawing directly to the screen with a host central processing unit (CPU). In various embodiments, graphics rendering may, at least in part, be implemented by program instructions for execution on one of, or parallel execution on two or more of, such GPUs. The GPU(s) may implement one or more application programmer interfaces (APIs) that permit programmers to invoke the functionality of the GPU(s) , in some embodiments.

[0087] System memory 2020 may store program instructions 2025 and / or data accessible by processor 2010 to implement a lightweight filesystem for remote storage caching, in some embodiments. In various embodiments, system memory 2020 may be implemented using any suitable memory technology, such as static random access memory (SRAM), synchronous dynamic RAM (SDRAM), nonvolatile / Flash-type memory, or any other type of memory. In the illustrated embodiment, program instructions and data implementing desired functions, such as those described above to perform offline builds for projected data subsets are shown stored within system memory 2020 as program instructions 2025 and data storage 2035, respectively. In other embodiments, program instructions and / or data may be received, sent or stored upon different types of computer-accessible media or on similar media separate from system memory 2020 or computer system 2000. A computer-accessible medium may include non-transitory storage media or memory media such as magnetic or optical media, e.g., disk or CD / DVD-ROM coupled to computer system 2000 via I / O interface 2030. Program instructions and data stored via a computer-accessible medium may be transmitted by transmission media or signals such as electrical, electromagnetic, or digital signals, which may be conveyed via a communication medium such as a network and / or a wireless link, such as may be implemented via network interface 2040, in some embodiments.

[0088] In some embodiments, I / O interface 2030 may be coordinate I / O traffic between processor 2010, system memory 2020, and any peripheral devices in the device, including network interface 2040 or other peripheral interfaces, such as input / output devices 2050. In some embodiments, I / O interface 2030 may perform any necessary protocol, timing or other data transformations to convert data signals from one component (e.g., system memory 2020) into a format suitable for use by another component (e.g., processor 2010). In some embodiments, I / O interface 2030 may include support for devices attached through various types of peripheral buses, such as a variant of the Peripheral Component Interconnect (PCI) bus standard or theUniversal Serial Bus (USB) standard, for example. In some embodiments, the function of I / O interface 2030 may be split into two or more separate components, such as a north bridge and a south bridge, for example. In addition, in some embodiments some or all of the functionality of I / O interface 2030, such as an interface to system memory 2020, may be incorporated directly into processor 2010.

[0089] Network interface 2040 may allow data to be exchanged between computer system 2000 and other devices attached to a network, such as other computer systems, or between nodes of computer system 2000, in some embodiments. In various embodiments, network interface 2040 may support communication via wired or wireless general data networks, such as any suitable type of Ethernet network, for example; via telecommunications / tel ephony networks such as analog voice networks or digital fiber communications networks; via storage area networks such as Fibre Channel SANs, or via any other suitable type of network and / or protocol.

[0090] Input / output devices 2050 may, in some embodiments, include one or more display terminals, keyboards, keypads, touchpads, scanning devices, voice or optical recognition devices, or any other devices suitable for entering or retrieving data by one or more computer system 2000, in some embodiments. Multiple input / output devices 2050 may be present in computer system 2000 or may be distributed on various nodes of computer system 2000, in some embodiments. In some embodiments, similar input / output devices may be separate from computer system 2000 and may interact with one or more nodes of computer system 2000 through a wired or wireless connection, such as over network interface 2040.

[0091] As shown in FIG. 11, memory 2020 may include program instructions 2025, that implement the various embodiments of the systems as described herein, and data store 2035, comprising various data accessible by program instructions 2025, in some embodiments. In some embodiments, program instructions 2025 may include software elements of embodiments as described herein and as illustrated in the Figures. Data storage 2035 may include data that may be used in embodiments. In other embodiments, other or different software elements and data may be included.

[0092] Those skilled in the art will appreciate that computer system 2000 is merely illustrative and is not intended to limit the scope of the embodiments as described herein. In particular, the computer system and devices may include any combination of hardware or software that can perform the indicated functions, including a computer, personal computer system, desktop computer, laptop, notebook, or netbook computer, mainframe computer system, handheld computer, workstation, network computer, a camera, a set top box, a mobile device, network device, internet appliance, PDA, wireless phones, pagers, a consumer device, videogame console, handheld video game device, application server, storage device, a peripheral device such as a switch, modem, router, or in general any type of computing or electronic device. Computer system 2000 may also be connected to other devices that are not illustrated, or instead may operate as a stand-alone system. In addition, the functionality provided by the illustrated components may in some embodiments be combined in fewer components or distributed in additional components. Similarly, in some embodiments, the functionality of some of the illustrated components may not be provided and / or other additional functionality may be available.

[0093] Those skilled in the art will also appreciate that, while various items are illustrated as being stored in memory or on storage while being used, these items or portions of them may be transferred between memory and other storage devices for purposes of memory management and data integrity. Alternatively, in other embodiments some or all of the software components may execute in memory on another device and communicate with the illustrated computer system via inter-computer communication. Some or all of the system components or data structures may also be stored (e.g., as instructions or structured data) on a computer-accessible medium or a portable article to be read by an appropriate drive, various examples of which are described above. In some embodiments, instructions stored on a computer-readable medium separate from computer system 2000 may be transmitted to computer system 2000 via transmission media or signals such as electrical, electromagnetic, or digital signals, conveyed via a communication medium such as a network and / or a wireless link. This computer readable storage medium may be non-transitory. Various embodiments may further include receiving, sending or storing instructions and / or data implemented in accordance with the foregoing description upon a computer-accessible medium. Accordingly, the present invention may be practiced with other computer system configurations.

[0094] Embodiments of the present disclosure can be described in view of the following clauses:Clause 1. A system, comprising: a plurality of computing devices, respectively comprising at least one processor and a memory, that implement a database service of a provider network; wherein the database service is configured to: perform a write to a table replicated across different regions of the provider network, the write being received at a first region of the different regions, and the table being writeable via requests received at individual ones of the different regions;replicate the write to the table to the different regions of the provider network, wherein to replicate the write the database service is configured to: perform the write on an item of the table in the first region; encrypt, in the first region, the item of the table with a payload key for the first region; append the encrypted item of the table to a multi-region append-only log; decrypt, in a second region of the different regions, the encrypted item obtained from the multi-region append-only log, using the payload key for the first region, wherein the payload key for the first region was decrypted in the second region using a private key of a publicprivate key pair for the second region to decrypt the payload key, the payload key having been previously encrypted using a public key of the public-private key pair at the first region; and update the table in the second region using the decrypted item.Clause 2. The system of clause 1, wherein the public key is shared by the second region with the first region after generating the public-private key pair at the second region.Clause 3. The system of clause 2, wherein the public-private key pair is for a shard of the table generated based on a table key.Clause d. The system of any one of clauses 1-3, wherein the database service is further configured to: receive, at the second region, the payload key from a record appended to the multi-region append-only log; and decrypt, the payload key using the private key of the public-private key pair; and store the decrypted payload key in a cache, wherein the payload key is obtained from the cache according to an identifier for the payload key included with the encrypted item of the data set append to the multi-region append-only log.Clause 5. A method, comprising: performing a write to a data set replicated across different regions of a provider network, the update being received at a first region of the different regions, and the data set being writeable via requests received at individual ones of the different regions; replicating the write to the data set to the different regions of the provider network, comprising: performing the write on an item of the data set in the first region;encrypting, in the first region, the item of the data set with a payload key for the first region; appending the encrypted item of the data set to a multi-region append-only log; decrypting, in a second region of the different regions, the encrypted item obtained from the multi-region append-only log, using the payload key for the first region, wherein the payload key for the first region was decrypted in the second region using a private key of a public-private key pair for the second region to decrypt the payload key, the payload key having been previously encrypted using a public key of the public-private key pair at the first region; and updating the data set in the second region using the decrypted item.Clause 6. The method of clause 5, wherein the public key is shared by the second region with the first region after generating the public-private key pair at the second region.Clause 7. The method of clause 6, wherein the public-private key pair is for a shard of the data set.Clause 8. The method of clause 6, wherein the public key is shared using control plane communications of the provider network that cross the different regions.Clause 9. The method of any one of clauses 5-8, further comprising: receiving, at the second region, the payload key from a record appended to the multiregion append-only log; and decrypting, the payload key using the private key of the public-private key pair; and storing the decrypted payload key in a cache, wherein the payload key is obtained from the cache according to an identifier for the payload key included with the encrypted item of the data set append to the multi-region append-only log.Clause 10. The method of clause 9, wherein the payload key is generated after a payload key rotation event.Clause 11. The method of any one of clauses 5-10, wherein the public key is received at the first region after a key pair rotation event.Clause 12. The method of any one of clauses 5-11, wherein the key pair rotation event is caused by a shard split for the data set.Clause 13. The method of any one of clauses 5-12, wherein the payload key is obtained as part of record that includes the encrypted item in the multi-region append only log.Clause 14. One or more non-transitory, computer-readable storage media, storing program instructions that when executed on or across one or more computing devices cause the one or more computing devices to implement: performing a write to a data set replicated across different regions of a provider network, the update being received at a first region of the different regions, and the data set being writeable via requests received at individual ones of the different regions; replicating the write to the data set to the different regions of the provider network, comprising: performing the write on an item of the data set in the first region; encrypting, in the first region, the item of the data set with a payload key for the first region; appending the encrypted item of the data set to a multi-region append-only log; decrypting, in a second region of the different regions, the encrypted item obtained from the multi-region append-only log, using the payload key for the first region, wherein the payload key for the first region was decrypted in the second region using a private key of a public-private key pair for the second region to decrypt the payload key, the payload key having been previously encrypted using a public key of the public-private key pair at the first region; and updating the data set in the second region using the decrypted item.Clause 15. The one or more non-transitory, computer-readable storage media of clause 14, wherein the public key is shared by the second region with the first region after generating the public-private key pair at the second region.Clause 16. The one or more non-transitory, computer-readable storage media of clause 14, wherein the public-private key pair is for a portion of the data set.Clause 17. The one or more non-transitory, computer-readable storage media of clause 14, wherein the public key is shared using control plane communications of the provider network that cross the different regions.Clause 18. The one or more non-transitory, computer-readable storage media of any one of clauses 14-17, storing further program instructions that when executed by the one or more computing devices, cause the one or more computing devices to further implement: receiving, at the second region, the payload key from a record appended to the multiregion append-only log; and decrypting, the payload key using the private key of the public-private key pair; andstoring the decrypted payload key in a cache, wherein the payload key is obtained from the cache according to an identifier for the payload key included with the encrypted item of the data set append to the multi-region append-only log.Clause 19. The one or more non-transitory, computer-readable storage media of any one of clauses 14-18, wherein the payload key is generated after a payload key rotation event.Clause 20. The one or more non-transitory, computer-readable storage media of any one of clauses 14-19, wherein the data set is hosted as part of a non-relational database service implemented as part of the provider network.

[0095] Various embodiments may further include receiving, sending or storing instructions and / or data implemented in accordance with the foregoing description upon a computer- accessible medium. Generally speaking, a computer-accessible medium may include storage media or memory media such as magnetic or optical media, e.g., disk or DVD / CD-ROM, nonvolatile media such as RAM (e g. SDRAM, DDR, RDRAM, SRAM, etc ), ROM, etc., as well as transmission media or signals such as electrical, electromagnetic, or digital signals, conveyed via a communication medium such as network and / or a wireless link.

[0096] The various methods as illustrated in the Figures and described herein represent example embodiments of methods. The methods may be implemented in software, hardware, or a combination thereof. The order of method may be changed, and various elements may be added, reordered, combined, omitted, modified, etc.

[0097] Various modifications and changes may be made as would be obvious to a person skilled in the art having the benefit of this disclosure. It is intended that the invention embrace all such modifications and changes and, accordingly, the above description to be regarded in an illustrative rather than a restrictive sense.

Claims

CLAIMSWHAT IS CLAIMED IS:

1. A system, comprising: a plurality of computing devices, respectively comprising at least one processor and a memory, that implement a database service of a provider network; wherein the database service is configured to: perform a write to a table replicated across different regions of the provider network, the write being received at a first region of the different regions, and the table being writeable via requests received at individual ones of the different regions; replicate the write to the table to the different regions of the provider network, wherein to replicate the write the database service is configured to: perform the write on an item of the table in the first region; encrypt, in the first region, the item of the table with a payload key for the first region; append the encrypted item of the table to a multi-region append-only log; decrypt, in a second region of the different regions, the encrypted item obtained from the multi-region append-only log, using the payload key for the first region, wherein the payload key for the first region was decrypted in the second region using a private key of a publicprivate key pair for the second region to decrypt the payload key, the payload key having been previously encrypted using a public key of the public-private key pair at the first region; and update the table in the second region using the decrypted item.

2. The system of claim 1, wherein the public key is shared by the second region with the first region after generating the public-private key pair at the second region.

3. The system of claim 2, wherein the public-private key pair is for a shard of the table generated based on a table key.

4. The system of any one of claims 1-3, wherein the database service is further configured to: receive, at the second region, the payload key from a record appended to the multi-region append-only log; and decrypt, the payload key using the private key of the public-private key pair; and store the decrypted payload key in a cache, wherein the payload key is obtained from the cache according to an identifier for the payload key included with the encrypted item of the data set append to the multi-region append-only log.

5. A method, comprising: performing a write to a data set replicated across different regions of a provider network, the update being received at a first region of the different regions, and the data set being writeable via requests received at individual ones of the different regions; replicating the write to the data set to the different regions of the provider network, comprising: performing the write on an item of the data set in the first region; encrypting, in the first region, the item of the data set with a payload key for the first region; appending the encrypted item of the data set to a multi-region append-only log; decrypting, in a second region of the different regions, the encrypted item obtained from the multi-region append-only log, using the payload key for the first region, wherein the payload key for the first region was decrypted in the second region using a private key of a public-private key pair for the second region to decrypt the payload key, the payload key having been previously encrypted using a public key of the public-private key pair at the first region; and updating the data set in the second region using the decrypted item.

6. The method of claim 5, wherein the public key is shared by the second region with the first region after generating the public-private key pair at the second region.

7. The method of claim 6, wherein the public-private key pair is for a shard of the data set.

8. The method of claim 6, wherein the public key is shared using control plane communications of the provider network that cross the different regions.

9. The method of any one of claims 5-8, further comprising: receiving, at the second region, the payload key from a record appended to the multiregion append-only log; and decrypting, the payload key using the private key of the public-private key pair; and storing the decrypted payload key in a cache, wherein the payload key is obtained from the cache according to an identifier for the payload key included with the encrypted item of the data set append to the multi-region append-only log.

10. The method of claim 9, wherein the payload key is generated after a payload key rotation event.

11. The method of any one of claims 5-10, wherein the public key is received at the first region after a key pair rotation event.

12. The method of any one of claims 5-11, wherein the key pair rotation event is caused by a shard split for the data set.

13. The method of any one of claims 5-12, wherein the payload key is obtained as part of record that includes the encrypted item in the multi-region append only log.

14. One or more non-transitory, computer-readable storage media, storing program instructions that when executed on or across one or more computing devices cause the one or more computing devices to implement: performing a write to a data set replicated across different regions of a provider network, the update being received at a first region of the different regions, and the data set being writeable via requests received at individual ones of the different regions; replicating the write to the data set to the different regions of the provider network, comprising: performing the write on an item of the data set in the first region; encrypting, in the first region, the item of the data set with a payload key for the first region; appending the encrypted item of the data set to a multi-region append-only log; decrypting, in a second region of the different regions, the encrypted item obtained from the multi-region append-only log, using the payload key for the first region, wherein the payload key for the first region was decrypted in the second region using a private key of a public-private key pair for the second region to decrypt the payload key, the payload key having been previously encrypted using a public key of the public-private key pair at the first region; and updating the data set in the second region using the decrypted item.

15. The one or more non-transitory, computer-readable storage media of claim 14, wherein the public key is shared by the second region with the first region after generating the public-private key pair at the second region.

Images