Amazon Technologies, Inc.

Other

Gregory Branchek Roth

Eric Jason Brandwine

Graeme David Baer

Gregory Alan Rubin

Brian Irl Pratt

Matthew James Wren

Bradley Jeffery Behm

Nathan R Fitch

Cristian Marius Ilac

Matthew John Campagna

Nicholas Alexander Allen

Jesper Mikael Johansson

Kevin Ross O'Neill

Darren Ernest Canavor

Aaron Douglas Dokey

Eric D Crahen

Nathan Bartholomew Thomas

Anders Samuelsson

Marc R Barbour

Daniel Stephen Popick

Andrew Paul Mikulski

Benjamin Elias Seidenberg

Jon Arron McClintock

James E Scharf, Jr

Nachiketh Rao Potlapally

Nima Sharifi Mehr

Rajiv Ramachandran

Keith A Carlson

Patrick James Ward

Nicholas Howard Brown

Bradley Jeffrey Behm

Khaled Salah Sedky

Elena Dykhno

Derek Avery Lyon

Ajith Harshana Ranabahu

Sandeep Kumar

John Michael Morkel

Jonathan Kozolchyk

Marcel Andrew Levy

Donald Lee Bailey, Jr

Rajendra Kumar Vippagunta

Darin Keith McAdams

Mark Christopher Seigle

William Frederick Kruse

Zachary Ganwise Fewtrell

Stefan Popoveniuc

Nicholas Andrew Gochenaur

Hassan Sultan

Petr Praus

Benjamin Tillman Farley

Jacques Daniel Thomas

Gautam Shanbhag

John Schweitzer

Pradeep Ramarao

Andrew Alphus Kimbrough

Kamran Tirdad

Matthew Daniel DeMoss

Quynh Khac Nguyen

Christopher H Fant

Alexander Zissis Ginos

David Matthew Platz

Daniel Wade Hitchcock

James Alfred Gordon Greenfield

Christopher Richard Jacques De Kadt

Peter Zachary Bowen

Reto Kramer

Derek Del Miller

Jonathan Matthew Miller

Robin Alan Golden

Adam K Loghry

James Leon Irving, Jr

Jonathan Weiss

Arjun Radhakrishnan

Randall Avery Shealey

Conor Patrick Cahill

Andrew Jay Roths

David John Ward, Jr

Matthew Ryan Jezorek

Dmitry Frenkel

David James Kane-Parry

Jamie Hunter

Christopher Brian Barclay

Matthew Allen Estes

David J Whitney

Jeffrey John Wierer

Brian Young Lee

Eric Allan MacIntosh

Scott Donald Gregory

James Arthur Wilson

Ian Wesley-Smith

Weixun Wang

Scott Kenneth Bishop

Bradford Taylor Lyman

Preyas Joshi

Brenda Renee' Campbell

Nathan David Scherer

Eric Michael Laird

Ido Mittelman

Kevin Ross O'neill

A key rotation that results in a first key version associated with a key being replaced by a second key version associated with the same key, wherein the first key version remains associated with the key for decrypting a previously generated ciphertext but not for future encryption requests. The first key version may be associated with a first cryptographic key material and the second key version may be associated with a second cryptographic key material different from the first cryptographic key material.

Key rotation techniques

A system that provides responses to requests obtains a key that is used to digitally sign the request. The key is derived from information that is shared with a requestor to which the response is sent. The requestor derives, using the shared information, derives a key usable to verify the digital signature of the response, thereby enabling the requestor to operate in accordance with whether the digital signature of the response matches the response.

Dynamic response signing capability in a distributed system

Custom policies are definable for use in a system that enforces policies. A user, for example, may author a policy using a policy language and transmit the system through an application programming interface call. The custom policies may specify conditions for computing environment attestations that are provided with requests to the system. When a custom policy applies to a request, the system may determine whether information in the attestation is sufficient for the request to be fulfilled.

Trusted-code generated requests

A service provider manages access control to multiple services through an authentication system. One or more services are able to fulfill requests at least in part by submitting requests to other services of the service provider. Such a service is able to obtain, from the authentication system, information that can be passed on to one or more other services to enable the one or more other services to determine request validity without having to contact the authentication system. The information may include, for example, one or more responses that the one or more other services would have received had the one or more services contacted the authentication system themselves.

Complete forward access sessions

An encoding of a cryptographic key is obtained in a form of an encrypted key. Request is provided to a service provider including a fulfillment involving performing a cryptographic operation on data. Upon fulfillment of the request, a response is then received which indicates the fulfillment of the request.

Data security using request-supplied keys

In certain embodiments, a web services system receives a request to provision a device, such as a telephone, as an authentication device. The web services system initiates display of an image communicating a key to allow the telephone to capture the image and to send key information associated with the key. The web services system receives the key and determines that the key information is valid. In response to the determination, the web services system sends a seed to the telephone to provision the telephone to be an authentication device. The telephone can use the seed to generate one-time passcodes to access a service of the web services system.

Provisioning a device to be an authentication device

A system comprises a data storage service includes a web service interface operating as a proxy to the data storage service. Data obtained at the data storage service is analyzed by one or more criteria of a data loss prevention policy, the data is encrypted by a key that is inaccessible to a remote service, and then the encrypted data is transmitted to the remote service.

Data loss prevention techniques

A method and apparatus for testing and simulating an access control policy are disclosed. Evaluating an access control policy may be performed by utilizing a deny statement that causes the access request to be rejected despite actions indicated in the access request being authorized. Further, an independent simulation environment may be utilized for testing access control policy evaluation.

Access control policy simulation and testing

Requests are pre-generated to include a cryptographic key to be used in fulfilling the requests. The requests may be encoded in uniform resource locators and may include authentication information to enable a service provider to whom the requests are submitted to determine whether the requests are authorized. The requests may be passed to various entities who can then submit the requests to the service provider. The service provider, upon receipt of a request, can verify the authentication information and fulfill the request using a cryptographic key encoded in the request.

Presigned URLs and customer keying

A support service application may process a request that contains a hyperlink. The hyperlink may be examined to determine a level of risk associated with accessing a resource referred to by the hyperlink. An execution environment for processing the hyperlink may be identified. The execution environment may comprise a virtual machine drawn from a pool of virtual machines. The resource may be retrieved by a browser process operating within the context of the virtual machine, and a safe version of the resource may be rendered and made available to customer support personnel using the support service application.

Inbound link handling

A system uses information submitted in connection with a request to determine if and how to process the request. The information may be electronically signed by a requestor using a key such that the system processing the request can verify that the requestor has the key and that the information is authentic. The information may include information that identifies a holder of a key needed for processing the request, where the holder of the key can be the system or another, possibly third party, system.

Federated key management

Customers of a service provider are able to provision compartments of the accounts. The both the accounts and the compartments, in some embodiments, may have associated computing resources and identities. One or more identities of the account may be authorized to perform administrative operations in the compartment. Identities of the compartment may lack the ability to perform any administrative actions outside of the compartment but inside of the account.

Compartments

A web of trust in a distributed system is established. A root of trust for at least two components in the distributed system validates information for the distributed system. The validated information is then used to create additional information for the distributed system. Versions of the information are usable to validate subsequent versions of the information such that validation of a version of the information can be performed by using one or more previous versions to verify that the version is a valid successor of a previously validated previous version.

Distributed system web of trust provisioning

Growing community of inventors

Seattle, WA, United States of America

Gregory Branchek Roth