Secure enclosure systems in a provider network
원문보기
IPC분류정보
국가/구분
United States(US) Patent
등록
국제특허분류(IPC7판)
G06F-021/70
H05K-007/14
출원번호
US-0986051
(2015-12-31)
등록번호
US-10121026
(2018-11-06)
발명자
/ 주소
Ryland, Mark
출원인 / 주소
Amazon Technologies, Inc.
대리인 / 주소
Blank Rome LLP
인용정보
피인용 횟수 :
0인용 특허 :
7
초록▼
A secure containment enclosure such as an equipment rack is disclosed that includes an electronic locking system. The electronic locking system locks and, upon receipt of a valid credential to a credential input device, unlocks an access door to the secure containment enclosure. The electronic locki
A secure containment enclosure such as an equipment rack is disclosed that includes an electronic locking system. The electronic locking system locks and, upon receipt of a valid credential to a credential input device, unlocks an access door to the secure containment enclosure. The electronic locking system locks the access door during normal operation, and is prevented from unlocking the access door during normal operation and for a predetermined period of time after the secure containment enclosure is powered off to ensure that all data on electronic devices in the secure containment enclosure is erased. Other security features include storage encryption, network encryption, preventing administrative logon access to customers' compute nodes, and dedicated instances in which only virtual machines from specified customer accounts can be located on the same electronic device.
대표청구항▼
1. A system, comprising: a plurality of equipment racks, each equipment rack including enclosures to receive server computers, and each equipment rack including an access door, and each access door including an electronic locking system configured to selectively lock and, based at least in part on r
1. A system, comprising: a plurality of equipment racks, each equipment rack including enclosures to receive server computers, and each equipment rack including an access door, and each access door including an electronic locking system configured to selectively lock and, based at least in part on receipt of a valid credential, unlock the corresponding access door;a computing device operable to execute an access controller configured to cause each electronic locking system to prevent unlocking its rack's respective access door even upon receipt by the electronic locking system of a valid credential while a server computer in the rack is powered on as well as for a predetermined period of time following powering off of all server computers in the rack and to permit the electronic locking system to unlock the access door upon receipt of a valid credential upon expiration of the predetermined period of time. 2. The system of claim 1, wherein the access controller is configured to start a timer upon receipt of an indication that all server computers in the rack have been powered down. 3. The system of claim 1, wherein the predetermined period of time is greater than or equal to 5 minutes. 4. The system of claim 1, wherein: each server computer is configured to execute a virtualization system, the virtualization system configured to send a signal to the access controller that at least a portion of the virtualization system is shutting down;each equipment rack includes a power sensor; andthe access controller is configured to start a timer for the predetermined period of time upon determining from a rack's power sensor that power to the rack is turned off and that a signal indicating at least a portion of the virtualization system is shutting down has been received. 5. A system, comprising: a plurality of secure containment enclosures, each secure containment enclosure configured to receive computing devices, and each secure containment enclosure including an access door and an electronic locking system to lock and unlock the access door;a computing device operable to execute an access controller configured to enable and disable the electronic locking systems of the rack access doors; andwherein the access controller is configured to prevent the electronic locking systems from opening while a computing device within the secure containment enclosure is powered on, as well as for a threshold period of time following powering off of all computing devices in the rack. 6. The system of claim 5, wherein each electronic locking system includes a credential input device and a lock mechanism, wherein the credential input device, when presented with a valid credential, causes the lock mechanism to unlock the access door, and wherein the access controller is configured to prevent an electronic locking system of a secure containment enclosure from opening by causing a signal to be sent to the electronic locking system to cause the electronic locking system to fail to unlock the lock mechanism even when a valid credential is provided to the credential input device. 7. The system of claim 5, wherein each electronic locking system includes a credential input device and a lock mechanism, wherein the credential input device, when presented with a valid credential, causes the lock mechanism to submit a request to the access controller for permission to open the electronic locking system, and wherein the access controller is configured to deny the request before expiration of the threshold period of time. 8. The system of claim 5, wherein the secure containment enclosure further includes: a power supply configured to provide power to the computing devices of the secure containment enclosure; anda power sensor configured to detect whether any electrical power is being provided to the computing devices of the secure containment enclosure; andwherein the access controller is configured to start a timer upon receipt of a signal from a secure containment enclosure that the power sensor detects all electrical power is off to the computing devices of that secure containment enclosure. 9. The system of claim 8, wherein the access controller sends a signal to the electronic locking system of a secure containment enclosure upon the timer for that secure containment enclosure reaching a terminal count value to cause the electronic locking system to unlock the access door upon receipt by the electronic lock of a valid credential. 10. The system of claim 5, further comprising a computing device operable to execute a provisioning system configured to dedicate a server computer to execute virtual machine instances of multiple provider network accounts in response to a request to have such virtual machine instances dedicated to a common server computer. 11. The system of claim 5, a computing device includes an operating system configured to execute a virtual machine, and wherein the operating system includes an agent configured to provide a third party audited software interface and wherein the operating system does not include an active logon for administrator access. 12. The system of claim 5, further comprising a storage subsystem that is configured to provide block storage for virtual machine instances executed on a computing device, wherein the storage subsystem provides a boot drive and data volumes to be mounted by particular virtual machine instances, and wherein all data on the boot drive and data volumes mounted by the virtual machine instances are encrypted. 13. The system of claim 5, further comprising computing devices configured to implement a mapping service and a key management service, wherein the mapping service is configured to provide mappings between virtual machine instances and corresponding virtual overlay networks and to request encryption keys corresponding to a virtual overlay network to be provided from the key management service to computing devices that execute the virtual machine instances of the virtual overlay network for encryption and decryption of packets routed across a network between the virtual machine instances of the virtual overlay network. 14. A method, comprising: causing an electronic locking system of a secure containment enclosure to lock an access door of the secure containment enclosure containing at least one electronic device;disabling the electronic locking system from unlocking the access door;based on a signal from a power sensor in a secure containment enclosure, determining that all electronic devices in the secure containment enclosure are in a low power state;starting a timer to count for a predetermined period of time;upon reaching the predetermined period of time, enabling the electronic locking system to be unlocked. 15. The method of claim 14, wherein after enabling the electronic locking system to be unlocked, receiving a valid credential to a credential input device and unlocking the electronic locking system. 16. The method of claim 14, wherein disabling the electronic locking system includes verifying a credential and submitting a lock-open request by the electronic locking system across a network to a computing device. 17. The method of claim 16, further comprising: upon receiving a lock-open grant message in response to the lock-open request, unlocking the electronic locking system;upon receiving a lock-open deny message in response to the lock-open request, maintaining the electronic locking system in a locked state; andupon failure to receive a response to the lock-open request, unlocking the electronic locking system. 18. The method of claim 14, wherein disabling the electronic locking system from being unlocked includes failing to unlock an electronic lock mechanism even upon receipt by a credential input device of the electronic locking system of a valid credential. 19. The method of claim 14, further comprising executing a virtual machine on an electronic device in the secure containment enclosure, and monitoring the power sensor upon receipt by a hypervisor on the electronic device is shutting down. 20. The method of claim 14, further comprising migrating a virtual machine instance executing on the electronic device and then shutting off power to the electronic device before starting the timer.
연구과제 타임라인
LOADING...
LOADING...
LOADING...
LOADING...
LOADING...
이 특허에 인용된 특허 (7)
Kishi, Nobuya, Authentication-capable apparatus and security system.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.