Amazon Technologies, Inc.

Emina Torlak

Neha Rungta

Michael W Hicks

Akhilesh Mritunjai

Richard Matthew Mccutchen

Christopher Richard Jacques De Kadt

Kyle Headley

Andrew Marshall Wells

John Holman Kastner

Aaron Joseph Eline

Mark Edward Stalzer

Darin Keith McAdams

Anwar Mamat

Joseph Wallace Cutler

Darin Mcadams

Julian Lovelock

Shaobo He

Kesha Hanne Hietala

Craig Ryan Disselkoen

Eleftherios Ioannidis

Techniques include using a verified access control policy compiler to compile a first access control policy into a compiled form. This compiled policy is then indexed. When an access request is received, the method retrieves the compiled policy from the index using attributes of the access request. The access request is evaluated against the compiled policy to determine authorization, and the resulting decision is returned. This process streamlines the evaluation and authorization decision-making process, making it more efficient.

Verified access control policy compilation for access management

Techniques include optimizing a base access control policy, resulting in a residual access control policy, which is then indexed. Upon receiving an access request, the system retrieves the residual access control policy from the index using the request's attributes. The access request is then evaluated against the residual policy to make an authorization decision, which is promptly returned. This streamlined process efficiently evaluates and determines authorization, enhancing the speed and accuracy of access control decisions.

Access control policy optimization

A system and method for authorization policy evaluation. Authorization policies are authored in a general-purpose authorization language. An evaluation engine is used in a provider network by application developers to manage access within their applications based on fine-grained permissions. The policy language combines elements of role-based and attributed-based access control within an intuitive syntax and efficient evaluation strategy. The policy syntax separates role-based expressions of a policy from attribute-based expressions of the policy.

Authorization policy evaluation

A system and method for authorization policy analysis. A policy analyzer answers first-order questions about authorization policies by reducing the policies to Satisfiability modulo theories (SMT). Input to the analyzer includes a policy to be analyzed and a schema for that policy. If the policy passes strict validation against the schema, then the analyzer symbolically evaluates the policy to encode its semantics as an SMT expression. The SMT expression is used for formulate a desired query about policy behavior such as, for example, if there is any input on which two policies both evaluate to true. The reduction to SMT produces a quantifier-free formula in a combination of decidable theories to support large scale deployments. This reduction is achieved by focusing the analysis on policies that pass strict validation, rather than attempting to analyze arbitrary policies.

Authorization policy analysis

A system and method for authorization policy validation. A validator takes as input an authorization policy to be analyzed and a schema that specifies entity types and their attributes, types of entity parents in an entity hierarchy, and which entity types can be used with which actions. The validator checks that the policy conforms to the schema. If the check passes, then the policy is guaranteed to be free of both type errors and attribute access errors for any input that conforms to the schema.

Authorization policy validation

Growing community of inventors

Seattle, WA, United States of America

Emina Torlak