Amazon Technologies, Inc.

Abebooks Inc.

Erik James Fuller

Kerry Michael Wright

Eric Jason Brandwine

David Everard Brown

Neil Andrew Eriksson

Francois Norman Daniels

Ali Mustafa Nassaje

Volker R A Tilgner

Julie Anne Margaret Sparrow

Marvin Michael Theimer

Peter Nicholas Desantis

James Alfred Gordon Greenfield

Eric Wayne Schultze

Arijit Ganguly

Marc J Brooker

Christopher J Lefelhocz

Timothy Peter Munro

Andrew Norimasa Nishigaya

Adam Blair Kelly

Kmr Mumit Khan

A background module in a multi-tiered encryption system verifies the integrity of keys used to encrypt and decrypt data. Each encryption tier in the system can include a node programmed to service encryption and/or decryption requests, a key store to store encryption keys, and an audit log to store key identifiers. Each computing node may include a background module that continuously or periodically verifies the integrity of keys. For example, the background module may retrieve an identifier in the audit log, retrieve the object stored at a location in the key data store identified by the identifier, decrypt the encrypted key in the object, and use the decrypted key to decrypt the encrypted identifier in the object. The identifier is compared with the decrypted identifier, and if the identifiers do not match, the background module generates an alert indicating that the key is not valid.

Verification of stored encryption keys in multi-tiered encryption system

A re-encryption service module in a multi-tiered encryption system that manages key rotation policies continuously or periodically re-encrypts data. Each encryption tier in the system can include a node programmed to service encryption, decryption, and/or re-encryption requests and a key store to store encryption keys. A computing node that interfaces with a requesting device may include the re-encryption service module. The re-encryption module may receive encrypted data and a key identifier identifying the key used to encrypt the data. The re-encryption module may decrypt the encrypted data using the identified key, retrieve a new key if the identified key is exhausted, and use the new key to encrypt the decrypted data. The key identifier may be updated to identify the new key and the re-encrypted data and the updated key identifier may be transmitted to the requesting device.

Automated data re-encryption process in multi-tiered encryption system

Multiple variants of an API can coexist through API management by using metadata in a pre-processing and post-processing system to weed out requests to which a client does not have permission and return parameters that do not belong with the API request variant. Metadata is added to request objects such that an instance of a request object may be examined to determine a request handler to properly inspect the request object and recommend further processing or rejection of the instance. Metadata may also be added to a response object created as a result of processing the request object such that a response handler may be identified to ensure the fields match the proper response to the request object. The API may be dynamically managed at the point of request and also at the point of return rather than a statically coded whitelist checked multiple times within the code itself.

Managing API authorization

A multi-tiered encryption system efficiently regulates the use of encryption keys to encrypt and decrypt data. The system can include one or more encryption tiers. Each encryption tier can include a computing node programmed to service encryption and/or decryption requests and a key store to store encryption keys. At a root encryption tier, an unencrypted root encryption key can be stored in the key store. Each subsequent encryption tier includes encryption keys that are encrypted by encryption keys stored at a lower encryption tier. The encryption tiers collectively implement an encryption policy in which keys are automatically created and rotated such that a requesting device can request encryption services from the multi-tiered encryption system and receive the encryption services independent of key creation or key rotation and without access to the unencrypted root encryption key.

Multi-tiered encryption system for efficiently regulating use of encryption keys

Methods and systems for allowing system administrators to effectively debug access control issues experience by users without comprising security. In some embodiment, when a user's request to access services provided by a service provider is denied, the user may be issued a token that encodes some of debugging information useful for determining the cause of the denial of access. The debugging information may be encoded such that it is inaccessible to the user. Subsequently, the user may give the token to an administrator. The administrator may submit the token to the service provider, which may decode the token and provide the administrator access to debugging information that is useful for debugging access control policies causing the denial of access.

Token-based debugging of access control policies

Methods and apparatus for provider-arbitrated mandatory access control policies in cloud computing environments are disclosed. A system includes an access manager, and a plurality of resources configurable to provide a plurality of distributed, web-accessible services. Each service has a respective service manager. The access manager determines whether a mandatory access control policy document specified by a service manager of a particular service applies to an administration request, wherein the policy indicates that a permission setting for a resource being used to implement at least a portion of the particular service cannot be modified by a client with administrative rights on the resource. In response to determining that the policy document applies, and that an evaluation of the policy document indicates that an administrative operation specified in the administration request is prohibited by the policy, the access manager rejects the administration request.

Provider-arbitrated mandatory access control policies in cloud computing environments

Embodiments of systems and methods are described for dynamically tagging metrics data by a provider of computing resources. In some implementations, a requesting user or application can request the provider of computing resources to tag the metrics based on configurations and/or settings specified by the requesting user or application. The tagged metrics data can then be processed by a processing user or application at a later time.

Method and system for dynamically tagging metrics data

Growing community of inventors

Cape Town, South Africa

Erik James Fuller