Amazon Technologies, Inc.

Bertram U Dorn

David Walker

A system intercepts, at an application programming interface (API) gateway, a request for access to a computing resource and obfuscates metadata associated with the request. The metadata is obfuscated by at least encrypting the metadata to generate encrypted metadata. The API gateway further generates a second request to include the encrypted metadata. The second request is then used to access the computing resource in response to the first request such that when the computing resource is accessed, the metadata associated with the computing resource is encrypted.

Dynamic metadata encryption

Approaches provide for mandatory access controls and account identification masking controls in an electronic environment. For example, a customer can configure a client device to access an API gateway which acts as a proxy for a resource in a resource provider environment. Requests for resources or services can be redirected to the API gateway. A registered function may be triggered when the request is received and may filter the request. After filtering, the request can be forwarded on to the actual API endpoint to access the requested resource. From the client's perspective, the resource is being accessed directly, and from the resource's perspective, it is being accessed by the proxy. This layer of indirection enables data to be protected preemptively, rather than waiting for an undesirable condition to exist and then reactively attending to the issue. Additionally, log data may be redacted and/or masked automatically as it is created, protecting sensitive data before it is accessible to administrators or other users.

Growing community of inventors

Fürstenfeldbruck, Germany

Bertram U Dorn