Amazon Technologies, Inc.

Benjamin Elias Seidenberg

Gregory Branchek Roth

Graeme David Baer

Matthew John Campagna

David M Hulme

Justin Jon Derby

Benjamin Tillman Farley

Peter Da-Ming Zieske

Rajkumar Copparapu

Gregory Alan Rubin

A computer-implemented method for providing cryptographic services, including providing key pairs. A key management service receives a web service application programming interface or other such request to generate a key pair. To respond to the request, the key management service obtains a pregenerated key pair that is securely stored and provides the key pair in response to the request.

Application programming interface to generate data key pairs

A request to perform a cryptographic operation is received, the request including a first identifier assigned to a key group, the key group comprising a plurality of second identifiers, with the plurality of second identifiers corresponding to a plurality of cryptographic keys. A second identifier is determined, according to a distribution scheme, from the plurality of second identifiers, and the cryptographic operation is performed using a cryptographic key of the plurality of cryptographic keys that corresponds to the second identifier that was determined.

Supporting a fixed transaction rate with a variably-backed logical cryptographic key

Electronically signed data is persistently stored in data storage. After the passage of time, the data may be accessed and presented to a trusted entity for verification of the data. The trusted entity may have access to secret information used to sign the data. The trusted entity may use the secret information to verify an electronic signature of the data. One or more actions may be taken based at least in part on a response provided by the verification system.

Trusted data verification

A material set, such as an asymmetric keypair, is processed using an associated workflow to prepare the material set for activation and/or use. In one embodiment, a material set is generated and information about the material set is communicated to a workflow manager. Based at least on the information, the workflow manager generates a workflow that when accomplished will allow the material set to be activated and/or used. In another embodiment, a service provider provides a key manager, workflow manager and destination for the key, such as a load balancer that terminates SSL connections. A key can be generated by the key manager, sent through the workflow manager for processing (potentially communicated to third parties such as a certificate authority, if needed) and installed at a destination.

Key rotation with external workflows

A service includes an associated service request throttling system. The throttling system constrains the rate at which service requests are fulfilled by the service, and also provides throttling information to the service. The throttling system controls service throughput by implementing a throttling bucket. The throttling bucket has an associated bucket level which indicates, to the service, an amount of service requests that can be satisfied before throughput limitations are imposed by the throttling system. The bucket level may be modified in response to service requests, service request characteristics, or environmental parameters. In some examples, operational parameters of the throttling system may be configured by users of the service to constrain data exfiltration. The bucket level itself may be used by the service to expand or constrain access privileges granted to particular users.

Data exfiltration control

A request a request to perform a cryptographic operation is received, the request including a first identifier assigned to a key group, the key group comprising a plurality of second identifiers, with the plurality of second identifiers corresponding to a plurality of cryptographic keys. A second identifier is determined, according to a distribution scheme, from the plurality of second identifiers, and the cryptographic operation is performed using a cryptographic key of the plurality of cryptographic keys that corresponds to the second identifier that was determined.

Techniques are disclosed for a device that presents a mass storage device to a computing environment, and which stores data written to the device by the computer in a network storage service. The device also presents files stored in the network storage service to the computer as though those files were stored on a mass storage device.

Network-backed mass storage device

A system and method for receiving requests for performing cryptographic operations with a virtual key having a plurality of actual keys associated with the virtual key, determining which actual key of the plurality of actual keys to use for the cryptographic operation, performing the cryptographic operation using the actual key, and providing the result of performing the cryptographic operation.

Customers accessing resources or services in a multi-tenant environment can obtain assurance that a provider of that environment will honor only requests associated with the customer and will reject any requests that might have been tampered with or otherwise falsely generated. Various endpoints or interfaces can be used, which can be located in the multi-tenant environment, in a customer environment, or in a separate location. These endpoints or interfaces can sign unsigned requests, or otherwise increase the credentials of a signed request, on behalf of a customer. In some embodiments, additional metadata can be added that can increase the authentication level of the requests. Such an approach can enable a customer to provide or delegate access to the resources without exposing the credentials outside a secure environment.

Growing community of inventors

Seattle, WA, United States of America

Benjamin Elias Seidenberg