Amazon Technologies, Inc.

Johns Hopkins University

Broadcom Corporation

Duke University

Case Western Reserve University

Meng Li

Eric Alan Breitbard

Robert Steven Murdock

Michael Douglas McQueen

Julien George Beguin

Gregory Michael Hart

Scott Ian Blanksteen

Bert Vogelstein

Kenneth W Kinzler

Alazel Acheson

Mahendra Manshi Chheda

Srikanth Mandadi

Colin Watson

David A Limp

Slavka Praus

Christopher Ryan Baker

James Robert Englert

Frank Diehl

Oksana Tkachuk

Stephan Josef Andrizzi

Zhixing Xu

Niloofar Razavi

Sumant Ranganathan

Nickolas Papadopoulos

Darell D Bigner

Carlos Alejandro Arguelles

Victor E Velculescu

Sanford D Markowitz

Hai Yan

Jasmeet Chhabra

Luis Diaz

Daniel Stephen Popick

William Tunstall-Pedoe

Aimee Piercy

Gregory J Riggins

Mark Edward Rafn

Robert Vaughan Williams

Sian Jones

Arnaud Jean-Louis Charton

Petra Elisabeth Holmes

Rebecca J Leary

Ankit Kumar

David Spike Palfrey

Robert Warren Sjoberg

Xiaosong Zhang

Luke Edward Kennedy

Catherine Michelle Loo

Dan Popick

David M Hulme

Andrew Graham Fenn

Sean Robert Ryan

Robert Peter Stacey

Andy Kohn

Duncan Joseph Reynolds

Aleksandr Movshovish

Sandesh Sanjeev

Miriam Karthika Daniel

Robert Franklin Burton

Donald Williams Parsons

Graham John French

Saeed Nejati

Vishal Gori

Techniques are described for analyzing privilege escalation risks within the accounts, roles, and policies that comprise an organization's cloud provider environment. Privilege escalation refers broadly to scenarios in which a principal (e.g., a person or application) is able to gain access to resources or actions in a cloud provider environment that exceed a level intended for that principal. In the context of cloud provider environments, for example, such privilege escalation risks can result from the misconfiguration of policies and permissions attached to identities (e.g., users, groups of users, or roles) within an organization's environment. A multi-layer reasoning framework is used to build an ontology model of an organization's identities and relations among the identities, including defined access relationships, permission mutation relationships, and credential mutation relationships. The framework is further used to query the ontology model to identify particular identities associated with one or more specific types of privilege escalation risks.

Analyzing privilege escalation risks using a multi-layer reasoning framework

Techniques are described for a domain-specific language and associated framework for implementing analyses of security, operational, or functional properties involving computing resources. The specification language enables users to readily define the semantics of a set of cross-resource relations of interest using a human-readable language. For example, the language enables users to express properties over computing resources based on a user-defined set of cross-resource relations. The specification language is human-readable, allowing users to easily add new cross-resource relations or to modify existing relations and properties, thereby enabling users to readily modify existing analyses or to create new ones entirely. The specification language is also machine-readable such that a compiler and other tools can automatically generate an ontology model based on local resource configurations, augment the graph with the cross-resource relations defined in the specifications, and perform graph reachability analyses based on defined properties of interest.

Specification language for generating graph reachability-based analyses for cloud-based system resources

Updates to a hierarchical data structure may be selectively replicated to other replicas of the hierarchical data structure. An update for a hierarchical data structure may be received and committed to the hierarchical data structure. A determination as to whether any other replicas of the hierarchical data structure have permission to receive the update may be made. For those replicas of the hierarchical data structure with permission to receive the update, the update may be provided to the replicas and committed to the replicas. Different types of replication techniques may be implemented, such as pull-based replication techniques or push-based replication techniques. Replication permissions for objects of the hierarchical data structure may be individually defined, in some embodiments.

Selectively replicating changes to hierarchial data structures

Techniques for incremental stream switching in a distributed system with flip events are described. A special-purpose flip event is inserted into an event stream that indicates, to recipients of the stream, whether they are to switch to use of an alternate event stream. The flip event may identify which other event stream to use, how to obtain events of that event stream, when to switch to the other event stream, and/or whether that particular recipient is to switch. The recipients may be selectively or iteratively migrated using flip events targeting different recipients, limiting the blast radius of a switch. Via use of a tracking data structure, event replay and event skips can be avoided.

Incremental stream switching in distributed systems

A video display hub is mounted in a common household area such as a kitchen or family room. The display hub is configured to display various types of information for users in the area, such as weather, traffic updates, schedules, notes, messages, lists, news, etc. When the user is at a distance from the display hub, information is presented at a relatively low density, with a low level of granularity and detail in conjunction with large fonts, graphics, and icons. When the user is close to the display hub, information is presented at a relatively high density, with a high level of granularity and detail in conjunction with small fonts, graphics, and icons.

Variable density content display

A consistent view of associations between independently replicated data objects may be provided. Data objects may be stored in separate data stores. Copies of the data stores may also store the data objects. The copies of the data stores may independently receive the data objects to be stored as part of independently replicating data stores to one or more copies of the data stores. An association can be created between objects in the different data store. If when the association is created it is determined that a referenced object is not yet stored in a copy of a data store, then both the association and the referenced object may be stored in the same data store so that the association and the referenced object are replicated together to a copy of the same data store.

Providing a consistent view of associations between independently replicated data objects

Improvements on the basic method used for BEAMing increase sensitivity and increase the signal-to-noise ratio. The improvements have permitted the determination of intrinsic error rates of various DNA polymerases and have permitted the detection of rare and subtle mutations in DNA isolated from plasma of cancer patients.

Methods for beaming

A speech-processing system capable of receiving spoken commands from a public or semi-public voice controlled device and determine a user who spoke the command for purposes of both command execution and output data routing. Identity of the user may be determined by various techniques such as facial identification, voice identification and the like. Identification techniques may be biased in view of users nearby to a voice controlled device. Private data resulting from the spoken command may be routed to a personal device of the user where non-private data may be output by the public voice controlled device.

Speech processing for public devices

A synchronous video communication session may be established between two devices having corresponding device profiles that are symmetrically or asymmetrically whitelisted with respect to each other. A first device located in a first environment may receive user input indicating a request to whitelist a second device located in a second environment. Whitelisting of the second device by the first device may cause a continuous live video stream to be presented on the second device. The continuous video stream may depict at least a portion of the first environment in which the first device is located. The continuous video stream may be initially at least partially obscured. Upon initiation of a video communication session between the first device and the second device, an audio stream may begin to be delivered between the devices and the video stream may no longer be obscured and a clear video image may be presented.

Video communication sessions between whitelisted devices

A video display hub is mounted in a common household area such as a kitchen or family room. During times that have been designated as being available for communications, devices in first and second households exchange and display blurred video, allowing users in each household to see vague shapes and movements of the other household. Upon noticing activity, a user in the first household may initiate a video conversation, causing the video from the first household to be unblurred and causing unobscured voice to be transmitted to the second household. A user in the second household may respond by allowing the video conversation to be fully enabled, allowing the video from the second household to be unblurred and unobscured voice to be transmitted back to the first household.

Automatically staged video conversations

A speech interface device may be configured to act as a remote speaker peripheral for multiple audio sources such as media players and phones. Upon receiving a request from a user to connect to an audio device, the speech interface device determines which of the multiple audio devices are currently available, selects one of the audio devices based on information about or received from the user, establishes an audio connection with the selected one of the audio devices, and begins acting as a remote speaker or speakerphone for the selected audio device.

Peripheral-based selection of audio sources

Growing community of inventors

San Francisco, CA, United States of America

Meng Li