Amazon Technologies, Inc.

Matthew Allen Estes

Robert Eric Fitzgerald

Andrew J Doane

Alexander Edward Schoof

Stefan Popoveniuc

Peter Zachary Bowen

Todd Lawrence Cignetti

Anand Mishra

Christopher Steven Helma

Rui Min

Yuk-Chung Eric Kam

Mikhail Denisenko

Tyler Eckstein

David Ripton

Alexandr Ukrainchik

Eric Jason Brandwine

Gregory Branchek Roth

Bradley Jeffery Behm

Patrick James Ward

David Eugene Walter Koenig

Brent William Farrell

Digital certificates include pointers to remote certificate information stores that maintain usage information associated with digital certificates. The pointers provide a mechanism for enabling the remote certificate information stores to be queried for usage information associated with a particular digital certificate. The usage information can be used to determine a validity of the digital certificate.

Digital certificates with distributed usage information

A method and apparatus for distributing cryptographic material are disclosed. In the method and apparatus, cryptographic material is obtained and it is determined that the cryptographic material is to be made available for use by one or more computing resources. The cryptographic material is then sent to one or more secure modules, whereby a secure module of the one or more secure modules is programmatically accessible to a computing resource of the one or more computing resources and programmatic access enables the computing resource to request performance of one or more cryptographic operations using the cryptographic material while exporting the cryptographic material to the computing resource is denied.

Cryptographic material distribution and management

Devices, such as hardware security modules, are provided as a service. A customer of a computing resource provider is able to request the addition of a device to a network of the customer hosted by the computing resource provider. The computing resource provider reconfigures a set of computing resources so that the devices of the customer are able to communicate with the device as if the device was in the customer's own network.

Providing devices as a service

A technology is described for transferring a file from an unsecure network to a secure network. An example method may include identifying an unsecure account profile and determining that a file is to be transmitted from an unsecure network to a secure network using a one-way transfer device. In response, the file may be obtained from a file storage location and an unsecure account profile name for the unsecure account profile may be identified. A request may be made that the one-way transfer device to transmit the file and the unsecure account profile name to the secure network. The file and the unsecure account profile name may then be transmitted to the secure network, where a secure account profile corresponding to the unsecure account profile may be identified in the secure network and the file may be placed in a folder associated with the secure account profile.

Network file transfer

A method and apparatus for renewing cryptographic material are disclosed. In the method and apparatus a cryptographic material renewal entity of a computing resource service provider detects that cryptographic material stored by a secure module is to be renewed. Renewing the cryptographic material may include rekeying a private key associated with a certificate. Further, a digital certificate may be renewed, and the renewed certificate may be provided for use by the computing resource. The cryptographic material is used to fulfill requests made by a computing resource provisioned by the computing resource service provider for a customer. The renewed cryptographic material is provided to the secure module, whereby the renewed cryptographic material is used by the secure module to fulfill further requests made by the computing resource.

Cryptographic material renewal

Client impersonation is recognized by an access control service using servicer credentials to allow a servicer to impersonate a user's context while requesting actions be performed on a computing resource. A servicer may be requested to perform an action through impersonation, granting access to the context of a user related to the computing resource. The computing resource receives servicer credentials and impersonation information from the servicer. After verifying the servicer's authorization to perform actions under the context of the user, the servicer may attempt to perform the requested action. The action may be logged as performed by the servicer impersonating the user. The user may also be billed for any costs incurred.

Constrained credentialed impersonation

Growing community of inventors

Aldie, VA, United States of America

Matthew Allen Estes