Amazon Technologies, Inc.

Jack A Drooger

Justin Paul Yancey

Jaimin Bhatt

Frank Johnston

Ken Chu

Beau J Hunter

Harvir Singh

Jonathan Carl Lundstrom

Sanjay Dey

Galen Caldwell

Ali Kourosh Gharib

A device management service may enforce compliance of remote devices with device specifications by disabling or enabling use of client certificates by applications installed on the devices. The device management service receives configuration data from an agent installed on the remote device. If the device management service determines that the device is no longer compliant with specifications for the device, then the device management service may prevent subsequent use of client certificate(s) by applications on the device to establish certificate-based connections. For example, the device management service may disable or revoke a client certificate or may instruct the device to disable or remove the client certificate. If the device becomes compliant at a subsequent time, then the device management service may enable the client certificate or cause a new client certificate to be sent to the device.

Using a certificate-based protocol to enforce compliance of devices with specifications

A system receives an authentication request from a requestor system for a token to access one or more computing resources associated with a computing resource service provider. The system analyzes information included with the authentication request and, based on the information included with the authentication request, selects an authentication provider from a plurality of authentication providers without additional input from the requestor system. The requestor system is redirected to the selected authentication provider such that the token is provided in response to the authentication request. The requestor system then presents the token to obtain an identity assertion that can be used to access the one or more computing resources.

Authentication provider discovery

A service or load balancer may use the techniques herein to perform client authentication using a certificate-based identity provider. A client may send a request for access to a service of the provider network. In response, the service or a load balancer may redirect the request to a certificate-based identity provider in accordance with a standard identity protocol (e.g., a federated identity protocol such as the protocol for OpenID Connect (OIDC)). The certificate-based identity provider may obtain a client certificate and validate the client certificate. The identity provider may also obtain and verify other credentials. In response to validating the client certificate (and in some cases authenticating the credentials), the certificate-based identity provider may generate and sign an identity token and redirect the client back to the service in accordance with the identity protocol.

Client authentication using a client certificate-based identity provider

This disclosure describes techniques for utilizing strong authentication of device identities and/or user identities to establish secure network tunnels between client devices and a virtual private network (VPN) server of a service provider network. The service provider network may generate routes from the VPN server to services to establish a connection for the client device to access the services. The service provider network may receive posture data from the client device that indicates a state of the client device, and determine, using a security policy, with which services the client device is permitted to interact or utilize. Further, the techniques described herein include receiving requests from the services to provide cryptographic assertion(s) that were used by the VPN server to authenticate the device identities and/or user identities. In this way, the services may be able to perform strong authentication of the client devices that are attempting to utilize the services.

Authenticating identities for establishing secure network tunnels

Growing community of inventors

Seattle, WA, United States of America

Jack A Drooger