Amazon Technologies, Inc.

Rameez Loladia

Ashutosh Thakur

Ramkishore Bhattacharyya

Atulya S Beheray

Amit Jagannath Mhatre

Shyam Krishnamoorthy

William Alexander Stevenson

Richard David Young

Nihal Chand Jain

Mark Edward Rafn

Xin Yi Liu

Andrew John Kiggins

Rodrigo Diaz Martin

James Christopher Sorenson

David Craig Yanacek

Christoph Saalfeld

Julian Embry Herwitz

A technology is described for device communication with computing regions. An example method may include receiving at a first computing region a request for a computing resource. In response to receiving the request, a device associated with the request may be authenticated using authentication credentials for the device. An identity token that indicates permission for the device to access the computing resource in a second computing region may be generated and the identity token and instructions to connect to the second computing region may be provided to the device. The device may present the identity token to the second computing region in order to access the computing resource in the second computing region.

Identity token for accessing computing resources

A technology is described for resolving device credentials for a device. An example method may include receiving device credentials for management by a service provider. The device credentials may include authentication credentials and a device policy document that specifies permissions used to authorize resource actions requested by the device. In response to receiving a message requesting that a resource perform a resource action associated with the device, the device may be authenticated using the authentication credentials, and the resource action may be authorized using the permissions specified in the device policy document.

Device credentials management

Systems and methods are disclosed herein for enforcing digital signature on a token useable by a network-addressable device to invoke service calls on services of a service provider. A device platform service of the service provider may receive service calls from the network-addressable device and cause one or more operations to be performed by other services of the service provider in response to receiving a notification that the request is authentic. An authentication service analyses a fingerprint associated with a request submitted by the device and determines whether it is a match to a fingerprint generated from cryptographic authentication information provided by the user in connection with registering the network-addressable device.

Custom authorization of network connected devices using signed credentials

A technology is provided for delivering a data object to a device. Data delivery instructions to distribute a data object to a device may be received at a delivery service and indicate a storage location of the data object, a messaging topic, and a size of data receivable by the device. The data object is then divided into blocks corresponding to the size of data receivable by the device. A messaging topic is identified to which the device is subscribed via a messaging service. The blocks are sent to the device using the messaging topic and a network protocol available to the device.

Receiving a data object at a device

A network protocol provides mutual authentication of network-connected devices that are parties to a communication channel in environments where the amount of memory and processing power available to the network-connected devices is constrained. When a new device is added to a network, the device contacts a registration service and provides authentication information that proves the authenticity of the device. After verifying the authenticity of the device, the registration service generates a token that can be used to by the device to authenticate with other network entities, and provides the token to the device. The registration service publishes the token using a directory service. When the device connects to another network entity, the device provides the token to the other network entity, and the other network entity authenticates the device by verifying the token using the directory service.

Lightweight authentication protocol using device tokens

A communication system and method for the utilization of messaging protocols to provide computing devices executable code. An administrative component can include executable code or instructions within the publication of content. Computing devices registered to receive this content can receive and execute the code (or instructions) and utilize the same messaging protocol to publish a result of the processing to be delivered to the admin device.

Executing remote commands

A technology is described for device communication with computing regions. An example method may include receiving a request for an identity token at a first computing region, where the identity token enables a device to communicate with a second computing region. In receiving the request, the device associated with the request may be authenticated using authentication credentials for the device. A determination may be made that the device is authorized to communicate with the second computing region and an identity token may be generated to indicate that the device is authorized to communicate with the second computing region. The identity token may be provided to the device and the device may present the identity token to the second computing region, allowing the device to communicate with the second computing region.

Device communication with computing regions

Techniques are disclosed for provisioning device-specific credentials to an Internet of Things device that accesses a cloud-based IoT service. The IoT service receives, from the IoT device, a request for device-specific credentials. The request comprises a provisioning certificate including information identifying a group of devices associated with the IoT device. The provisioning certificate is authenticated by evaluating the information with expected information. The device-specific credentials are generated based, at least in part, on the information provided in the provisioning certificate. The device-specific credentials are sent to the IoT device, and the IoT device installs and activates the device-specific credentials. The device-specific credentials are associated with the IoT device in a registry of the IoT service.

Zero-touch provisioning of IoT devices with multi factor authentication

A technology is provided for delivering a data object to device. Data delivery instructions to distribute a data object to a device may be received at a delivery service and include a storage location of the data object, a messaging topic, and a size of data receivable by the device. The data object is then divided into blocks corresponding to the size of data receivable by the device. A messaging topic is identified to which the device is subscribed via a messaging service. The blocks are sent to the device using the messaging topic and a network protocol installed on the device.

A communication system and method for the utilization of authentication protocols to authenticate computing devices. An authentication service provider can authenticate a computing device after a first authentication by an authentication protocol. Computing devices can use the authentication to receive additional credential to access one or more service providers.

Multi-service and multi-protocol credential provider

Delivering a data object to a device

A lightweight network protocol provides mutual authentication and encryption of a communication channel in environments where the amount of computing resources available to the networked devices is constrained. When a new device is added to a network, the device contacts a registration service and provides information that is published via a device directory. The network entity locates the device via information provided by the device directory, and establishes an encrypted network connection with the device. A shared secret is established between the device and the network entity using a key-exchange protocol. Consecutive messages that are sent or received are encrypted or decrypted with a sequence of cryptographic keys generated based at least in part on the shared secret. Key-exchange parameters are added to message exchanges between the device and the network entity to facilitate regenerating the shared secret.

Growing community of inventors

Seattle, WA, United States of America

Rameez Loladia