Amazon Technologies, Inc.

Richard D. Ruiz, LLC

Stephen Edward Schmidt

Eric Jason Brandwine

Andrew J Doane

Daniel Todd Cohn

Clarissa Loree Cook Brandwine

Carl Jay Moses

Richard Dean Ruiz

Troy Dean Ruiz

Scott Allen Ruiz

Luis Felipe Cabrera

Robert J McCann

Thomas R Knecht

Clarissa Loree Brandwine

Adi Habusha

Nachiketh Rao Potlapally

Donald Lee Bailey, Jr

Jonathan Matthew Miller

Joseph A Parise

Curtis Alan Gentile

Carl J Moses

Robert Joseph Mccann

Robert J Mccann

Cryptographically verifiable data share traces are maintained for services of a provider network. Different data share traces for parameters submitted in requests via different interfaces of different services are obtained and stored as part of a cryptographically verifiable data structure. Requests to obtain the data share traces may be received and returned with the requested data share traces in a cryptographically verifiable form.

Maintaining cryptographically verifiable data share traces for services of a provider network

Techniques are described for providing users with access to computer networks, such as to enable users to interact with a remote configurable network service in order to create and configure computer networks that are provided by the configurable network service for use by the users. Computer networks provided by the configurable network service may be configured to be private computer networks that are accessible only by the users who create them, and may each be created and configured by a client of the configurable network service to be an extension to an existing computer network of the client, such as a private computer network extension to an existing private computer network of the client. If so, secure private access between an existing computer network and new computer network extension that is being provided may be enabled using one or more VPN connections or other private access mechanisms.

Providing access to configurable private computer networks

A request to access a computing resource of a computing resource service provider is determined to be associated with specious data previously generated by the computing resource service provider. Information about an entity associated with the request is determined from the request. The information is provided to a breach detection system as notification of a potential attack against the computing resource service provider.

Service defense techniques

Systems and method for the management of virtual machine instances are provided. A network data transmission analysis system can use contextual information in the execution of virtual machine instances to isolate and migrate virtual machine instances onto physical computing devices. The contextual information may include information obtained in observing the execution of virtual machines instances, information obtained from requests submitted by users, such as system administrators. Still further, the network data transmission analysis system can also include information collection and retention for identified virtual machine instances.

Managing virtual computing nodes using isolation and migration techniques

A computing resource service provider may operate one or more services configured to provide customers with access to computing resources. Attackers may attempt to exfiltrate customer data from the one or more services. In order to prevent attackers from obtaining customer data the one or more services may provide specious data in response to an attack. The attack may be detected based at least in part on a set of triggers that indicate a likelihood of attack. The specious data may be configured to appear to the attacker as authentic customer data and/or that the attack is successful. Additionally, the specious data may be detectable by the one or more service, enabling the one or more service to collect additional data corresponding to the attack and/or attacker.

Systems and methods are provided for configuring and monitoring computing resources of an entity for compliance with one or more standards. In one implementation, a server receives one or more identifiers of one or more standards and determines a plurality of configuration settings for the computing resources of the entity, based on the received one or more identifiers. The plurality of configuration settings comply with the one or more standards. The computing resources of the entity are configured according to the plurality of configuration settings. The server detects an event related to the computing resources. The detected event and the plurality of configuration settings are evaluated for compliance with the one or more standards. A determination is made whether the entity is compliant with the one or more standards, based on the evaluation, and an action is taken, based on the determination.

Managing computing resource usage for standards compliance

Provided are methods and peripheral devices for examining local hardware and configuring a location-aware peripheral device accordingly. In some implementations, a peripheral device may be configured to examine, using a bus interface, another device connected to the bus. Examining may include determining characteristics of the other device. In some implementations, the peripheral device may further compare the determined characteristics against information derived from data stored in a memory of the peripheral device. The information may describe acceptable operating parameters for the computing system. In some implementations, the peripheral device may further determine, based on a result of the comparison, a status for the computing system. The status may indicate whether the computing system is operating within acceptable operating parameters. The status may direct an action by the peripheral device.

Examining local hardware using a location-aware peripheral device

Standards compliance for computing data

A computer-implemented method includes restricting access to customer data to certain geographic regions authorized by the customer. The restriction can be managed by associating policy information with the customer data that identifies the geographic regions authorized by the customer. Resources attempting to access the customer data can evaluate the policy information associated with the customer data with respect to the geographic location in which the resource is located to determine whether the resource is permitted to access the customer data. The restriction can also be managed by encrypting the customer data with a cryptographic key that corresponds to the customer and/or the authorized geographic regions.

Approaches for restricting access to data

In certain embodiments, a computer-implemented method includes receiving intercepted data associated with a first entity. The intercepted data may be intercepted in response to a request for information from a second entity. The method may include converting the intercepted data from a first format to a second format, the second format compliant with a standard for providing intercepted data to the second entity. The method may include storing, in one or more memory units, the intercepted communication data in the second format. The one or more memory units may be part of a subset of a plurality of computing resources designated for use by the first entity. The method may include storing audit data providing a record of a chain of custody of the intercepted communication data. The method may include providing access to a portion of the stored intercepted communication data in the second format to the second entity.

Growing community of inventors

Herndon, VA, United States of America

Stephen Edward Schmidt