Amazon Technologies, Inc.

Eric Jason Brandwine

Gregory Branchek Roth

Andrew J Doane

Kevin Christopher Miller

Marvin Michael Theimer

Bradley E Marshall

Swaminathan Sivasubramanian

Daniel Todd Cohn

Matthew James Wren

Tate Andrew Certain

Brian Irl Pratt

Cristian Marius Ilac

Matthew Shawn Wilson

Graeme David Baer

Andrew Bruce Dickinson

Nathan R Fitch

Stephen Edward Schmidt

Bradley Jeffery Behm

Robert Eric Fitzgerald

David Everard Brown

Ian Roger Searle

Aaron Douglas Dokey

Matthew John Campagna

Gregory Alan Rubin

Nathan Bartholomew Thomas

Benjamin Warren Mercier

Christopher Richard Jacques De Kadt

Kevin Ross O'Neill

Joseph E Fitzgerald

Nachiketh Rao Potlapally

Luis Felipe Cabrera

Anthony Nicholas Liguori

Donald Lee Bailey, Jr

Eric D Crahen

Don Johnson

Mahendra Manshi Chheda

Marc R Barbour

Marc J Brooker

Jonathan A Jenkins

Peter Nicholas Desantis

Todd Lawrence Cignetti

Nicholas Alexander Allen

David R Richardson

Marc John Brooker

Adi Habusha

Mark Joseph Cavage

Aaron Craig Thompson

Arijit Ganguly

Christopher J Lefelhocz

Carl Jay Moses

Thomas Charles Stickle

Ian Paul Nowland

Brian William Barrett

Abhinav Agrawal

James Robert Hamilton

Pradeep Vincent

Matthew David Klein

James Alfred Gordon Greenfield

Peter John Hill

Andrew James Lusk

Michael David Marr

Nafea Bshara

Diwakar Gupta

Calvin Yue-Ren Kuo

Matthew Scott Garman

Alan Michael Judge

Rebecca Claire Weiss

Leah Shalev

Mark Bradley Davis

Jacob Adam Gabrielson

Georgy Machulsky

Deepak Suryanarayanan

Reto Kramer

Matthew T Corddry

Jacob Carr

Eugene Michael Farrell

Eric Wayne Schultze

Deepak Singh

Ajith Jayamohan

Jesper Mikael Johansson

James Christopher Sorenson

Jon Arron McClintock

Ethan Zane Evans

Conor Patrick Cahill

Korwin Jon Smith

Thomas Bradley Scholl

Douglas Stewart Laurence

Peter Zachary Bowen

Andrew Kent Warfield

Martin Thomas Pohlack

Ameet Nirmal Vaswani

John Byron Cook

Eric Paul Wei

Yaniv Shapira

Colin Harrison Brace

Andrew Paul Mikulski

Vivek Lakshmanan

Rahul Gautam Patel

David Samuel Zipkin

Derek Del Miller

A key rotation that results in a first key version associated with a key being replaced by a second key version associated with the same key, wherein the first key version remains associated with the key for decrypting a previously generated ciphertext but not for future encryption requests. The first key version may be associated with a first cryptographic key material and the second key version may be associated with a second cryptographic key material different from the first cryptographic key material.

Key rotation techniques

Systems and methods directed to a service that analyzes media and outputs a confidence score of the media based on inconsistencies within media and differences between source media and the media, are described herein. In one aspect, a media file may be obtained at a computing resource service provider. The media file may be analyzed using at least one of a plurality of functions to generate media results that indicate inconsistencies within the media file, and/or differences between the media file and corresponding media registered with the computing resource service provider or contextual media that contains similar content to the media file, where individual functions of the plurality of functions are executed in parallel by at least one compute unit. A confidence score, which indicates a significance of the inconsistencies within the media file and/or differences from the registered or contextual media, may be generated based on the media results.

Evaluation criteria for media authenticity analysis service

Techniques are described for providing managed virtual computer networks that have a configured logical network topology with virtual networking devices, such as by a network-accessible configurable network service, with corresponding networking functionality provided for communications between multiple computing nodes of the virtual computer network by emulating functionality that would be provided by the virtual networking devices if they were physically present. In some situations, the networking functionality provided for a managed computer network of a client includes receiving routing communications directed to the virtual networking devices and using included routing information to update the configuration of the managed computer network, such as to allow at least some computing nodes of a managed computer network to dynamically signal particular types of uses of one or more indicated target network addresses and/or to dynamically signal use of particular external public network addresses based on such routing information.

Network configuration system for configuring telecomunications infrastructure networks

Techniques are described for providing logical networking functionality for managed computer networks, such as for virtual computer networks provided on behalf of users or other entities. In some situations, a user may configure or otherwise specify a network topology for a virtual computer network, such as a logical network topology that separates multiple computing nodes of the virtual computer network into multiple logical sub-networks and/or that specifies one or more logical networking devices for the virtual computer network. After a network topology is specified for a virtual computer network, logical networking functionality corresponding to the network topology may be provided in various manners, such as without physically implementing the network topology for the virtual computer network. In some situations, the computing nodes may include virtual machine nodes hosted on one or more physical computing machines or systems, such as by or on behalf of one or more users.

Networking device that bridges virtual and physical computer networks

Systems and techniques are described for tracking and providing access reports for individual pieces of data managed by a data storage service. A service may generate and store a record of operations performed on a piece of data, such that may be classified as containing sensitive or important data, in a data store. The record may link representations of users and the operations performed by those users to instances of the piece of data, as it is found in one or more data objects within the data store. The data store may link other instances of the piece of data and other operations performed on the piece of data to the first instance of the piece of data. The service may access the data store to produce a history record of the various instances of the piece of data and operations performed on those instances of the piece of data.

Data access tracking service

A system that provides responses to requests obtains a key that is used to digitally sign the request. The key is derived from information that is shared with a requestor to which the response is sent. The requestor derives, using the shared information, derives a key usable to verify the digital signature of the response, thereby enabling the requestor to operate in accordance with whether the digital signature of the response matches the response.

Dynamic response signing capability in a distributed system

Techniques are described for providing managed computer networks, such as for managed virtual computer networks overlaid on one or more other underlying computer networks. In some situations, the techniques include facilitating replication of a primary computing node that is actively participating in a managed computer network, such as by maintaining one or more other computing nodes in the managed computer network as replicas, and using such replica computing nodes in various manners. For example, a particular managed virtual computer network may span multiple broadcast domains of an underlying computer network, and a particular primary computing node and a corresponding remote replica computing node of the managed virtual computer network may be implemented in distinct broadcast domains of the underlying computer network, with the replica computing node being used to transparently replace the primary computing node in the virtual computer network if the primary computing node becomes unavailable.

Automated configuration change of virtual machines in a computing node group

Custom policies are definable for use in a system that enforces policies. A user, for example, may author a policy using a policy language and transmit the system through an application programming interface call. The custom policies may specify conditions for computing environment attestations that are provided with requests to the system. When a custom policy applies to a request, the system may determine whether information in the attestation is sufficient for the request to be fulfilled.

Trusted-code generated requests

Techniques are described for enabling users to create and configure request-based policies used by a data storage system to generate custom responses to particular types of requests for users' stored data objects. The request-based policies include rules used to identify types of requests for data objects and corresponding types of responses to be generated responsive to detecting such requests. The types of responses that can be specified in such policies include responses other than simply returning a requested data object or denying a request. For example, a rule for certain types of responses can instruct the data storage system to return a dynamically generated data object, another rule can instruct the system to return a different data object than the one requested, and so forth.

User-configurable request-based policies for a data storage system

Techniques are described for monitoring and analyzing input/output (I/O) messages for patterns indicative of ransomware attacks affecting computer systems of a cloud provider, and for performing various remediation actions to mitigate data loss once a potential ransomware attack is detected. The monitoring of I/O activity for such patterns is performed at least in part by I/O proxy devices coupled to computer systems of a cloud provider network, where an I/O proxy device is interposed in the I/O path between guest operating systems running on a computer system and storage devices to which I/O messages are destined. An I/O proxy device can analyze I/O messages for patterns indicative of potential ransomware attacks by monitoring for anomalous I/O patterns which may, e.g., be indicative of a malicious process attempting to encrypt or otherwise render in accessible a significant portion of one or more storage volumes as part of a ransomware attack.

Automated virtualized storage snapshotting responsive to ransomware detection

Virtual resources may be provisioned in a manner that is aware of, and respects, underlying implementation resource boundaries. A customer of the virtual resource provider may specify that particular virtual resources are to be implemented with implementation resources that are dedicated to the customer. Dedicating an implementation resource to a particular customer of a virtual resource provider may establish one or more information barriers between the particular customer and other customers of the virtual resource provider. Implementation resources may require transition procedures, including custom transition procedures, to enter and exit dedicated implementation resource pools. Costs corresponding to active and inactive implementation resources in a dedicated pools associated with a particular customer may be accounted for, and presented to, the customer in a variety of ways including explicit, adjusted per customer and adjusted per type of virtual resource and/or implementation resource.

Virtual provisioning with implementation resource boundary awareness

An encoding of a cryptographic key is obtained in a form of an encrypted key. Request is provided to a service provider including a fulfillment involving performing a cryptographic operation on data. Upon fulfillment of the request, a response is then received which indicates the fulfillment of the request.

Data security using request-supplied keys

Techniques are described for providing a web cookie firewall application capable of monitoring and controlling the use of web cookies at computing devices. The web cookie firewall application uses web cookie security policies to selectively allow or prohibit the storage or use of individual web cookies or types of web cookies. For example, web cookie security permissions can be defined by such policies to permit or deny the storage or use of web cookies associated with certain website domains, to permit or deny the storage or use of defined types of cookies, or to control access to web cookies based on other attributes. The web cookie firewall application can be implemented as a standalone application, as a web browser plugin or extension, or as any other type of software application that it is capable of monitoring and controlling the use web cookies on a computing device.

Web cookie firewall

A system comprises a data storage service includes a web service interface operating as a proxy to the data storage service. Data obtained at the data storage service is analyzed by one or more criteria of a data loss prevention policy, the data is encrypted by a key that is inaccessible to a remote service, and then the encrypted data is transmitted to the remote service.

Data loss prevention techniques

Detecting anomalous I/O patterns indicative of ransomware attacks

Growing community of inventors

Haymarket, VA, United States of America

Eric Jason Brandwine