Amazon Technologies, Inc.

Fugue, Inc.

Rally Health, Inc.

Alexander Edward Schoof

Andrew J Doane

Robert Eric Fitzgerald

Todd Lawrence Cignetti

Peter Zachary Bowen

Matthew Allen Estes

Stefan Popoveniuc

Christopher Steven Helma

Rui Min

Anand Mishra

Stefan Popuveniuc

Josha Stella

Dominic Zippilli

Matthew Brinkman

Nicholas Evancich

Tyler Drombosky

Jasper Van Der Jeugt

Maciej Wos

Christopher Kaminski

Jared Tobin

Denison Wright

Daniel Kerrigan

Nathan McCourtney

Wayne Crissman

Emily Dresner-Thornber

Andrew Jeffrey Doane

A vendor of virtual machine images accesses a virtual computer system service to upload a digitally signed virtual machine image to a data store usable by customers of the virtual computer system service to select an image for creating a virtual machine instance. If a digital certificate is uploaded along with the virtual machine image, the virtual computer system service may determine whether the digital certificate has been trusted for use. If the digital certificate has been trusted for use, the virtual computer system service may use a public cryptographic key to decrypt a hash signature included with the image to obtain a first hash value. The service may additionally apply a hash function to the image itself to obtain a second hash value. If the two hash values match, then the virtual machine image may be deemed to be authentic.

Authentication of virtual machine images using digital certificates

A method and apparatus for distributing cryptographic material are disclosed. In the method and apparatus, cryptographic material is obtained and it is determined that the cryptographic material is to be made available for use by one or more computing resources. The cryptographic material is then sent to one or more secure modules, whereby a secure module of the one or more secure modules is programmatically accessible to a computing resource of the one or more computing resources and programmatic access enables the computing resource to request performance of one or more cryptographic operations using the cryptographic material while exporting the cryptographic material to the computing resource is denied.

Cryptographic material distribution and management

Techniques are disclosed for mitigating against registering a domain name that is confusingly similar to a pre-existing domain name, possibly for the purpose of fooling users. In embodiments, a domain name is presented for registration. The domain name is rendered as an image, and optical character recognition is performed on the image to extract the rendered text. This extracted text is compared against a list of domain names for which confusingly similar domain names cannot be registered, and when the extracted text matches a domain name in this list of domain names, registration of the domain name is denied.

Identifying visually similar text

Devices, such as hardware security modules, are provided as a service. A customer of a computing resource provider is able to request the addition of a device to a network of the customer hosted by the computing resource provider. The computing resource provider reconfigures a set of computing resources so that the devices of the customer are able to communicate with the device as if the device was in the customer's own network.

Providing devices as a service

A method for building, optimizing, and maintaining a computing infrastructure on a cloud computing environment is provided. A user provides a high-level declaration to a cloud environment operating system, specifying the details of the infrastructure that is intended to be built on the cloud. A cloud environment operating system converts the high level declaration to a lower level declaration and then to a series of instructions that can be executed by the cloud to build the desired infrastructure. The cloud environment operating system can also continuously monitor the infrastructure once it is built on the cloud. If the cloud environment operating system notices any discrepancies between the user's original specification and the infrastructure as built on the cloud, the operating system can work to modify the existing infrastructure on the cloud to conform to the infrastructure specified by a user.

System and method for building, optimizing, and enforcing infrastructure on a cloud based computing environment

In some embodiments, a method includes receiving encrypted information associated with a user, and calculating a first portion of a shared secret based on the encrypted information associated with the user. The method also includes defining a completed portion of the shared secret based on the first portion of the shared secret and a second portion of the shared secret and storing the completed portion of the shared secret in a memory for a pre-defined period of time. The method includes defining a ticket based on the completed portion of the shared secret, and sending the ticket to a device associated with the user such that data associated with the ticket is accessible based on the ticket within the pre-defined period of time, and not accessible without the ticket or after the pre-defined period of time.

Methods and apparatus for protecting sensitive data in distributed applications

A method and apparatus for renewing cryptographic material are disclosed. In the method and apparatus a cryptographic material renewal entity of a computing resource service provider detects that cryptographic material stored by a secure module is to be renewed. Renewing the cryptographic material may include rekeying a private key associated with a certificate. Further, a digital certificate may be renewed, and the renewed certificate may be provided for use by the computing resource. The cryptographic material is used to fulfill requests made by a computing resource provisioned by the computing resource service provider for a customer. The renewed cryptographic material is provided to the secure module, whereby the renewed cryptographic material is used by the secure module to fulfill further requests made by the computing resource.

Cryptographic material renewal

A compute instance of a virtual computing service (VCS) is assigned first and second cryptographically verifiable identities (CVIs) within respective namespaces. A cryptographic key pair associated with the first CVI includes a non-transferable private key managed by a secure key store which does not permit the private key to be copied. The VCS enables the instance to use the private key for asserting the CVIs. In response to a first identity query, the instance indicates the first CVI. In response to a second identity query, the instance indicates the second CVI.

Multi-faceted compute instance identity

Growing community of inventors

Herndon, VA, United States of America

Alexander Edward Schoof