Secure delivery and storage of content

1. A computer-implemented method, comprising:

obtaining an instance of content from an encrypted instance of the content received for a content item;

transforming the instance of content to obtain transformed content;

encrypting the transformed instance of the content using a first cryptographic key;

generating an identifier of the encrypted transformed instance of the content based at least in part on a value derived by applying a cryptographic hash function on a network address at which the encrypted transformed instance of the content is stored;

obtaining an encrypted version of the first cryptographic key;

storing the encrypted transformed instance of the content and the encrypted version of the first cryptographic key in association with the generated identifier; and

providing, to a receiver device, a token comprising encrypted information that is used to determine the identifier and obtain access to the instance of the content.

2. The computer-implemented method of claim 1 , further comprising:

generating a pre-signed uniform resource identifier; and

providing the pre-signed uniform resource identifier to a giver device to enable the giver device to upload the instance of the content to the system.

3. The computer-implemented method of claim 1 , wherein the value includes a hash-based message authentication code.

4. The computer-implemented method of claim 1 , wherein the network address is an Internet Protocol (IP) address associated with a data storage service.

5. The computer-implemented method of claim 1 , wherein the cryptographic hash function includes a key derivation function.

6. The computer-implemented method of claim 1 , wherein the content includes an image content.

7. The computer-implemented method of claim 1 , wherein the cryptographic hash function is a one-way function.

8. A system, comprising at least one computing device, including at least one processor, configured to implement one or more services, wherein the one or more services:

obtain an instance of content from an encrypted instance of the content received for a content item;

transform the instance of content to obtain transformed content;

encrypt the transformed instance of the content using a first cryptographic key;

generate an identifier of the encrypted transformed instance of the content based at least in part on output generated at least in part by applying a cryptographic hash function on information indicative of a user associated with the content item;

obtain an encrypted version of the first cryptographic key;

store the encrypted transformed instance of the content and the encrypted version of the first cryptographic key in association with the generated identifier; and

provide, to a receiver device, a token comprising encrypted information that is used to determine the identifier and obtain access to the instance of the content.

9. The system of claim 8 , wherein the one or more services are further configured to generate a pre-signed uniform resource identifier and provide the pre-signed uniform resource identifier to a giver device to enable the giver device to upload the instance of the content to the system.

10. The system of claim 9 , wherein:

the pre-signed uniform resource identifier encodes a request to upload data; and

the one or more services receive the request to upload the data from the giver, wherein the request encodes the instance of the content as the data to upload.

11. The system of claim 8 , wherein the content is audio content or video content.

12. The system of claim 8 , wherein the one or more services transform the instance of content asynchronously relative to a request to create the content item.

13. The system of claim 8 , wherein the one or more services:

receive a request to redeem the content item, the request comprising a token;

decrypt the token;

determine input data based at least in part on the decrypted token;

use at least the input data and the pre-image-resistant function to determine the identifier;

use the determined identifier to obtain the encrypted transformed instance of the content; and

provide the transformed instance of the content in response to the request.

14. A set of non-transitory computer-readable storage media having collectively stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:

obtain an instance of content from an encrypted instance of the content received for a content item;

transform the instance of content to obtain transformed content;

encrypt the transformed instance of the content using a first cryptographic key;

generate an identifier of the encrypted transformed instance of the content based at least in part on a cryptographic key derived by applying a key derivation function on information indicative of a location within a data storage service in which the encrypted transformed instance of the content is stored;

obtain an encrypted version of the first cryptographic key;

store the encrypted transformed instance of the content and the encrypted version of the first cryptographic key in association with the generated identifier; and

provide, to a receiver device, a token comprising encrypted information that is used to determine the identifier and obtain access to the instance of the content.

15. The set of non-transitory computer-readable storage media of claim 14 , wherein the instructions further include instructions that, when executed by the one or more processors, cause the computer system to generate a pre-signed uniform resource identifier and provide the pre-signed uniform resource identifier to a giver device to enable the giver device to upload the instance of the content to the system.

16. The set of non-transitory computer-readable storage media of claim 14 , wherein the identifier is further based on a value computed from a hash-based message authentication code of the cryptographic key.

17. The set of non-transitory computer-readable storage media of claim 14 , wherein the content is audio content or video content.

18. The set of non-transitory computer-readable storage media of claim 14 , wherein:

the pre-signed uniform resource identifier encodes a request to upload data; and

the instructions further include instructions that, when executed by the one or more processors, cause the computer system to receive the request to upload the data from the giver, wherein the request encodes the instance of the content as the data to upload.

19. The set of non-transitory computer-readable storage media of claim 14 , wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to transform the instance of content asynchronously relative to a request to create the content item.

20. The set of non-transitory computer-readable storage media of claim 14 , wherein the instructions further include instructions that, when executed by the one or more processors, cause the computer system to:

receive a request to redeem the content item, the request comprising a token;

decrypt the token;

determine the identifier based at least in part on the decrypted token;

use the determined identifier to obtain the encrypted transformed instance of the content; and

provide the transformed instance of the content in response to the request.