Amazon Technologies, Inc.

Eric D Crahen

Eric Jason Brandwine

Gregory Branchek Roth

Nathan R Fitch

Cristian Marius Ilac

Graeme David Baer

Kevin Ross O'Neill

Bradley Jeffery Behm

David Craig Yanacek

Matthew James Wren

Samuel John Young

David Andrew Killian

Krutarth Mukesh Gathani

Krishnan Narayanan

Sarath Geethakumar

Bruce Cooper

Christian M Ilac

During provisioning of a biometric device, a hardware root of trust is established between the biometric device and a server. The biometric device includes a cryptographic processor with a first encryption key stored in secure storage. The first encryption key is used to establish a mutually authenticated communication channel with the server. A set of additional encryption keys between the device and the server are established via the communication channel. Biometric data generated by the biometric device is encrypted using the additional keys and digitally signed. The server receives the encrypted and signed data via the communication channel and verifies the signature. Once the signature is verified, the biometric data is then decrypted. The server then processes the decrypted biometric data. Data that does not arrive via the communication channel, that fails the verification, or that fails decryption is deleted or disregarded.

Systems for determining authenticated transmissions of encrypted payloads

The load level on a server system is regulated by determining time-to-live (TTL) values to provide to requesting devices that request a content resource from the server system, thereby affecting the frequency of subsequent requests. This dynamic determination of TTL values may provide resilience to system load, for example by using longer TTL values when the system is under greater load to reduce the rate at which subsequent requests are received. A dynamic TTL service may calculate a TTL value based on one or more factors, such as overall system load, resource load, hardware load, and/or software load.

Load regulation using dynamically determined time to live values

A delegation request is submitted to a session-based authentication service, fulfillment of which involves granting an entity an access privilege to a computing resource. A session key is received from the session-based authentication service. The session key having been generated based at least in part on a restriction and a secret credential shared with the session-based authentication service and usable at least in part to prove possession of the access privilege to the computing resource. The session key is provided to the entity without providing the shared secret credential.

Parameter based key derivation

Cryptographic keys are generated for components of a distributed system in a decentralized manner. A root key is generated for a universe of components, including capturing data and components for processing the data. A cryptographic key for a processing component is derived from the root key and one or more attributes or identifiers of the processing component, which may be provided in a specific region or domain. Cryptographic keys for capturing components (e.g., cameras) within the region or domain are derived from the cryptographic keys of the processing component and one or more attributes or identifiers of the respective capturing components. The capturing components encrypt data using their respective cryptographic keys and transfer the encrypted data to the processing component, which re-derives the cryptographic keys for such capturing components and decrypts the encrypted data using the re-derived cryptographic keys.

Decentralized cryptographic key derivation

Client requests may be directed through a secret holding proxy system such that the secret holding proxy system may insert a secret into a client request before arriving at the destination. The insertion of a secret may include inserting a digital signature, token or other information that includes a secret or information based upon a secret, which may include secret exchange or authentication protocols. The secret holding proxy system may also remove secrets and/or transform incoming messages such that the client may transparently receive the underlying content of the message.

Authentication through a secret holding proxy

Time to live ('TTL') values are determined based on one or more factors. The TTL values may be included in responses to requests for resources, thereby affecting the frequency of subsequent requests. This dynamic determination of TTL values may provide resilience to system load, for example by using longer TTL values when the system is under greater load in order to reduce the rate at which subsequent requests are received. A dynamic TTL service may calculate a TTL value based on one or more factors, such as overall system load, resource load, hardware load, and/or software load. In various embodiments, a dynamic TTL service may act natively within a service, within a system framework, as a proxy, as a cluster, and/or as a broker.

A delegation request is submitted to a session-based authentication service, fulfilment of which involves granting an entity an access privilege to a computing resource. A session key is received from the session-based authentication service. The session key having been generated based at least in part on a restriction and a secret credential shared with the session-based authentication service and usable at least in part to prove possession of the access privilege to the computing resource. The session key is provided to the entity without providing the shared secret credential.

A support system negotiates secure connections on behalf of multiple guest systems using a set of credentials associated with the guest systems. The operation of the secure connection may be transparent to the guest system such that guest system may send and receive messages that are encrypted or decrypted by the support system, such as a hypervisor. As the support system is in between the guest system and a destination, the support system may act as a local endpoint to the secure connection. Messages may be altered by the support system to indicate to a guest system which communications were secured. The credentials may be managed by the support system such that the guest system does not require access to the credentials.

Implementation of secure communications in a support system

Systems and methods for authentication generate keys from secret credentials shared between authenticating parties and authenticators. Generation of the keys may involve utilizing specialized information that, as a result of being used to generate the keys, renders the generated keys usable for a smaller scope of uses than the secret credential. Further, key generation may involve multiple invocations of a function where each of at least a subset of the invocations of the function results in a key that has a smaller scope of permissible use than a key produced from a previous invocation of the function. Generated keys may be used as signing keys to sign messages. One or more actions may be taken depending on whether a message and/or the manner in which the message was submitted complies with restrictions of the a key's use.

Techniques for client constructed sessions

Key derivation techniques

A federated identity system is described. A federated identity broker registers a first customer as an identity provider and a second customer as an identity consumer. The federated identity broker acts as an intermediary between the first customer and the second customer, to broker an identity request from the first customer that is fulfilled by the second customer.

Growing community of inventors

Seattle, WA, United States of America

Eric D Crahen