Amazon Technologies, Inc.

Jeffrey J Fielding

Jonathan Kozolchyk

Darren Ernest Canavor

Darin Keith McAdams

Vaibhav Mallya

David Allen Cuthbert

Ting-You Wang

Sergei V Shinkarev

Blake Parker Hess

Alexandre Karpov

Peter S Ding

In some implementations, tokens that are representative of sensitive data may be used in place of the sensitive data to maintain the security of the sensitive data. For example, data may be separated into sensitive data and nonsensitive data, and at least the sensitive data is securely delivered to a data storage service. The data storage service generates a token that is representative of the sensitive data and stores the sensitive data as secure data. The data storage service may deliver the token to an entity that also receives the nonsensitive data, and the entity may use the token in place of the sensitive data. In some implementations, different tokens are generated each time the same piece of sensitive data is submitted for storage as secure data. Further, in some implementations, An expiration time may be assigned to sensitive data, and expired data and associated tokens may be deleted.

Token-based secure data management

A security service enables service providers to register available services. Prospective service consumers may register with the security service to access a particular registered service, and may specify conditions for access that are subject to approval by the corresponding service provider. Based on the registrations of the service provider and the service consumer, the security service can define access policies that may be enforced to control the conditions under which a service consumer accesses or utilizes the particular service. Additionally, changes to the access policies may be propagated to running services in near real time. Some implementations enable masking of information provided to particular service consumers based on determined needs of each service consumer for access to particular information. In some instances, the service providers may provide log information to the security service, which may be monitored to identify anomalies, security breaches or the like.

Securing services and intra-service communications

In some implementations, tokens that are representative of sensitive data may be used in place of the sensitive data to maintain the security of the sensitive data. For example, data may be separated into sensitive data and nonsensitive data, and at least the sensitive data is securely delivered to a data storage service. The data storage service generates a token that is representative of the sensitive data and stores the sensitive data as secure data. The data storage service may deliver the token to an entity that also receives the nonsensitive data, and the entity may use the token in place of the sensitive data. In some implementations, different tokens are generated each time the same piece of sensitive data is submitted for storage as secure data. Further, in some implementations, access policies define authorizations regarding which entities are able to resolve a token to access the actual sensitive data.

Disclosed are various embodiments for network monitoring. A processor circuit having a processor and a memory is employed. A listing of components of a network is stored in the memory, the listing including a plurality of endpoints and a plurality of nodes. One of the endpoints includes a processor circuit. A monitoring application is stored in the memory and executable by the processor circuit. The monitoring application is configured to maintain in the memory an indication of an operational status of each of the nodes derived from a plurality of status requests transmitted between respective pairs of the endpoints.

Operational status of network nodes

Disclosed are various embodiments for discovery of public points of interest. Data identifying points of interest is obtained. Each point of interest is associated with a respective user and specifies a respective name and a respective geographic location. A public point of interest is determined based at least in part on a similarity of the respective names of a subset of the points of interest, a proximity of the respective geographic locations of the subset of the points of interest, and a number of different users associated with the subset of the points of interest.

Discovery of public points of interest

Disclosed are various embodiments for network monitoring. A processor circuit having a processor and a memory is employed. A listing of components of a network is stored in the memory, the listing including a plurality of endpoints and a plurality of nodes. One of the endpoints includes the processor circuit. A monitoring application is stored in the memory and executable by the processor. The monitoring application is configured to maintain in the memory an indication of an operational status of each of the nodes derived from a plurality of status requests transmitted between respective pairs of the endpoints.

A monitoring service may receive, from a plurality of service providers, log information pertaining to access calls made by service consumers to services or APIs provided by the service providers. The monitoring service aggregates and analyzes the log information for use in monitoring performance of the services, identifying anomalies, and the like. In some instances, the monitoring service may identify multiple services that are behaviorally interrelated based on at least one performance metric, and may group these services together into service groups for monitoring purposes. A service relationship model may be generated for each of the service groups that predicts how each service will behave relative to the other services in the service group. The monitoring service may monitor performance and use of the services based, at least in part, on the one or more service groups and the service relationship model for each group.

Growing community of inventors

Seattle, WA, United States of America

Jeffrey J Fielding