Amazon Technologies, Inc.

Other

Gregory Branchek Roth

Eric Jason Brandwine

Graeme David Baer

Brian Irl Pratt

Gregory Alan Rubin

Matthew James Wren

Bradley Jeffery Behm

Nathan R Fitch

Cristian Marius Ilac

Matthew John Campagna

Nicholas Alexander Allen

Jesper Mikael Johansson

Kevin Ross O'Neill

Darren Ernest Canavor

Anders Samuelsson

Aaron Douglas Dokey

Eric D Crahen

Nathan Bartholomew Thomas

Marc R Barbour

James E Scharf, Jr

Daniel Stephen Popick

Andrew Paul Mikulski

Benjamin Elias Seidenberg

Jon Arron McClintock

Nachiketh Rao Potlapally

Rajiv Ramachandran

Keith A Carlson

Nima Sharifi Mehr

Patrick James Ward

Bradley Jeffrey Behm

Nicholas Howard Brown

Khaled Salah Sedky

Elena Dykhno

Derek Avery Lyon

Ajith Harshana Ranabahu

Sandeep Kumar

John Michael Morkel

Jonathan Kozolchyk

Donald Lee Bailey, Jr

Rajendra Kumar Vippagunta

Mark Christopher Seigle

Darin Keith McAdams

Marcel Andrew Levy

William Frederick Kruse

Zachary Ganwise Fewtrell

Nicholas Andrew Gochenaur

Stefan Popoveniuc

Hassan Sultan

Benjamin Tillman Farley

Petr Praus

Gautam Shanbhag

John Schweitzer

Jacques Daniel Thomas

Pradeep Ramarao

Andrew Alphus Kimbrough

Kamran Tirdad

Christopher H Fant

Matthew Daniel DeMoss

Alexander Zissis Ginos

David Matthew Platz

Quynh Khac Nguyen

Daniel Wade Hitchcock

James Alfred Gordon Greenfield

Christopher Richard Jacques De Kadt

Peter Zachary Bowen

Reto Kramer

Derek Del Miller

Jonathan Matthew Miller

Robin Alan Golden

Adam K Loghry

James Leon Irving, Jr

Arjun Radhakrishnan

Jonathan Weiss

Randall Avery Shealey

Conor Patrick Cahill

Andrew Jay Roths

David John Ward, Jr

Matthew Ryan Jezorek

David James Kane-Parry

Dmitry Frenkel

Jamie Hunter

Christopher Brian Barclay

Matthew Allen Estes

David J Whitney

Jeffrey John Wierer

Brian Young Lee

Scott Donald Gregory

James Arthur Wilson

Eric Allan MacIntosh

Weixun Wang

Scott Kenneth Bishop

Ian Wesley-Smith

Bradford Taylor Lyman

Preyas Joshi

Nathan David Scherer

Brenda Renee' Campbell

Eric Michael Laird

Ido Mittelman

Christian M Ilac

A one-time password (OTP) based security scheme is described, where a provider pre-generates a number of verification codes (e.g., OTP codes) which will be valid for a predetermined interval. The provider then encodes the verification codes (e.g., by hashing each code with a time value), and stores the verification codes into a data structure. The data structure can be provided to a verification system that can use the set of pre-generated OTP codes to authenticate requests received from users having personal security tokens.

Token based one-time password security

Methods and apparatus for a client account versioning metadata manager for cloud computing environments are disclosed. A system includes a plurality of resources, a plurality of service managers coordinating respective multitenant network-accessible services, and a metadata manager. The metadata manager receives a multi-service account state view request. The metadata manager generates a representation of an administrative state of a client account indicated by the request with respect a plurality of services accessible by the client account, as of a time indicated in the request. The administrative state with respect to a particular service comprises an indication of an assignment to the client account of resources participating in implementation of the particular service.

Client account versioning metadata manager for cloud computing environments

A computing resource service provides flexible configuration of authorization rules. A set of authorization rules which define whether fulfillment of requests. The set of authorization rules are applied to a request of a first type which is mapped to a request of a second type. The request of the second type is used for fulfillment of the request of the first type when the authorization rules so allow.

Virtual service authorization

A system uses information submitted in connection with a request to determine if and how to process the request. The information may be electronically signed by a requestor using a key such that the system processing the request can verify that the requestor has the key and that the information is authentic. The information may include information that identifies a holder of a key needed for processing the request, where the holder of the key can be the system or another, possibly third party, system. Requests to decrypt data may be processed to ensure that a certain amount of time passes before access to the decrypted data is provided, thereby providing an opportunity to cancel such requests and/or otherwise mitigate potential security breaches.

Federated key management

A key rotation that results in a first key version associated with a key being replaced by a second key version associated with the same key, wherein the first key version remains associated with the key for decrypting a previously generated ciphertext but not for future encryption requests. The first key version may be associated with a first cryptographic key material and the second key version may be associated with a second cryptographic key material different from the first cryptographic key material.

Key rotation techniques

A system that provides responses to requests obtains a key that is used to digitally sign the request. The key is derived from information that is shared with a requestor to which the response is sent. The requestor derives, using the shared information, derives a key usable to verify the digital signature of the response, thereby enabling the requestor to operate in accordance with whether the digital signature of the response matches the response.

Dynamic response signing capability in a distributed system

Custom policies are definable for use in a system that enforces policies. A user, for example, may author a policy using a policy language and transmit the system through an application programming interface call. The custom policies may specify conditions for computing environment attestations that are provided with requests to the system. When a custom policy applies to a request, the system may determine whether information in the attestation is sufficient for the request to be fulfilled.

Trusted-code generated requests

A service provider manages access control to multiple services through an authentication system. One or more services are able to fulfill requests at least in part by submitting requests to other services of the service provider. Such a service is able to obtain, from the authentication system, information that can be passed on to one or more other services to enable the one or more other services to determine request validity without having to contact the authentication system. The information may include, for example, one or more responses that the one or more other services would have received had the one or more services contacted the authentication system themselves.

Complete forward access sessions

An encoding of a cryptographic key is obtained in a form of an encrypted key. Request is provided to a service provider including a fulfillment involving performing a cryptographic operation on data. Upon fulfillment of the request, a response is then received which indicates the fulfillment of the request.

Data security using request-supplied keys

In certain embodiments, a web services system receives a request to provision a device, such as a telephone, as an authentication device. The web services system initiates display of an image communicating a key to allow the telephone to capture the image and to send key information associated with the key. The web services system receives the key and determines that the key information is valid. In response to the determination, the web services system sends a seed to the telephone to provision the telephone to be an authentication device. The telephone can use the seed to generate one-time passcodes to access a service of the web services system.

Provisioning a device to be an authentication device

A system comprises a data storage service includes a web service interface operating as a proxy to the data storage service. Data obtained at the data storage service is analyzed by one or more criteria of a data loss prevention policy, the data is encrypted by a key that is inaccessible to a remote service, and then the encrypted data is transmitted to the remote service.

Data loss prevention techniques

A method and apparatus for testing and simulating an access control policy are disclosed. Evaluating an access control policy may be performed by utilizing a deny statement that causes the access request to be rejected despite actions indicated in the access request being authorized. Further, an independent simulation environment may be utilized for testing access control policy evaluation.

Access control policy simulation and testing

Requests are pre-generated to include a cryptographic key to be used in fulfilling the requests. The requests may be encoded in uniform resource locators and may include authentication information to enable a service provider to whom the requests are submitted to determine whether the requests are authorized. The requests may be passed to various entities who can then submit the requests to the service provider. The service provider, upon receipt of a request, can verify the authentication information and fulfill the request using a cryptographic key encoded in the request.

Presigned URLs and customer keying

Growing community of inventors

Seattle, WA, United States of America

Gregory Branchek Roth