Amazon Technologies, Inc.

Wesley Thomas Spears

Maciej Broda

David Ruysser Gabler

Yuk-Chung Eric Kam

Gavin Bailey

Nicholas George Kartsioukas

Anis Bishara

A device, having executed a single sign-on operation, may maintain a private device key in volatile memory. A client application may request an authentication artifact as part of obtaining authentication credentials for the device. Responsive to the request, an artifact may be signed with the private device key to generate the requested authentication artifact. The single sign-on operation may be authenticated using an authentication device and a wrap key generated and applied by a secure cryptographic processor using an identifier based on an attestation certificate obtained from the authentication device after successful authentication. The wrap key may be used to decrypt the private device key stored on a persistent device storage.

Authentication artifact generation using single sign-on

A privilege management system receives a manifest specifying a first set of privileges implemented on a client device. Based at least in part on a characteristic of the client device, the privilege management system identifies a second set of privileges that are to be implemented on the client device. The privilege management system processes the first set of privileges and the second set of privileges to identify a set of differences and transmits this set of differences to the client device. In response to receiving this set of differences, the client device implements the second set of privileges.

Privilege revocation for client devices

Growing community of inventors

Seattle, WA, United States of America

Wesley Thomas Spears