Amazon Technologies, Inc.

Microsoft Technology Licensing, LLC

William Alexander Stevenson

Timothy Andrew Rath

Wei Xiao

Calvin Yue-Ren Kuo

Akshat Vig

Shyam Krishnamoorthy

Rama Krishna Sandeep Pokkunuri

Rajaprabhu Thiruchi Loganathan

Mark Edward Rafn

Srivaths Badrinath Copparam

Clarence Wing Yin Ng

Maximiliano Maccanti

James Christopher Sorenson

Jonathan I Turow

Rameez Loladia

Ashutosh Thakur

Ramkishore Bhattacharyya

Alan Conrad Rawcliffe

Atulya S Beheray

Amit Jagannath Mhatre

Xin Yi Liu

Andrew John Kiggins

Dmytro Gayvoronskyy

Rodrigo Diaz Martin

Murli D Satagopan

Jeroen Vanturennout

Piyush Gupta

David Michael Sauntry

Kevin T Damour

Michael Richard Yagley

Aditya Bhalla

Peter Gregg Miller

Oleksii Zakharenko

Maximliano Maccanti

Nanda Kishore Enagalur

Xinning Le

Cheryl Harris

Atul Sharma

Amirtha Raman

Shusha Li

Brian Kai-Yan Luong

James Christopher Iii Sorenson

Methods, systems, apparatuses, and computer-readable storage mediums are described for authorizing publishing of a message and/or a subscription from an Internet of Things (IoT) device. In an example system, a message broker receives a list of attributes from a claims provider. The message broker determines whether publishing of the message is authorized based at least on the list of attributes, and publishes the message if it is determined that the publishing is authorized. The message broker may also receive a subscription specifying a topic filter. The message broker determines whether the subscription is authorized for the IoT device based at least on the list of attributes, and transmits a subscription message to the IoT device if it is determined that the subscription is authorized.

Efficient attribute-based access control authorization for a message broker

A technology is described for resolving device credentials for a device. An example method may include receiving device credentials for management by a service provider. The device credentials may include authentication credentials and a device policy document that specifies permissions used to authorize resource actions requested by the device. In response to receiving a message requesting that a resource perform a resource action associated with the device, the device may be authenticated using the authentication credentials, and the resource action may be authorized using the permissions specified in the device policy document.

Device credentials management

Systems and methods are disclosed herein for enforcing digital signature on a token useable by a network-addressable device to invoke service calls on services of a service provider. A device platform service of the service provider may receive service calls from the network-addressable device and cause one or more operations to be performed by other services of the service provider in response to receiving a notification that the request is authentic. An authentication service analyses a fingerprint associated with a request submitted by the device and determines whether it is a match to a fingerprint generated from cryptographic authentication information provided by the user in connection with registering the network-addressable device.

Custom authorization of network connected devices using signed credentials

A system that implements a data storage service may store data for a database table in multiple replicated partitions on respective storage nodes. In response to a request to back up a table, the service may back up individual partitions of the table to a remote storage system independently and (in some cases) in parallel, and may update (or create) and store metadata about the table and its partitions on storage nodes of the data storage service and/or in the remote storage system. Backing up each partition may include exporting it from the database in which the table is stored, packaging and compressing the exported partition for upload, and uploading the exported, packaged, and compressed partition to the remote storage system. The remote storage system may be a key-value durable storage system in which each backed-up partition is accessible using its partition identifier as the key.

Backup of partitioned database tables

A system that implements a data storage service may store data for database tables in multiple replicated partitions on respective storage nodes. In response to a request to back up a table, the service may export individual partitions of the table from the database and package them to be independently uploaded (e.g., in parallel) to a remote storage system (e.g., a key-value durable storage system). Prior to uploading the exported and packaged partitions to the remote storage system, the service may verify that the exported and packaged partitions can be subsequently restored, which may include unpackaging and/or re-inflating the exported and packaged partitions to create additional unpackaged copies of the partitions, re-importing the additional unpackaged copies of the partitions into the database (e.g., as additional replicas), and/or comparing checksums generated for the exported partitions with checksums generated for the additional unpackaged copies of the partitions.

Verification of database table partitions during backup

A technology is described for managing dynamic groups of devices using device representations. An example method may include receiving a request for a dynamic group of device representations. In response to the request, a membership parameter used to identify member device representations included in the dynamic group of device representations may be obtained. Device representations may be queried using the membership parameter to identify member device representations that have a state that corresponds to the membership parameter, and the dynamic group of device representations may be generated to include identifiers for the member device representations.

Dynamic grouping of device representations

A technology is described for operating a device shadowing service that calculates an aggregated group state for a group of device representations. An example method may include receiving device states for devices represented using a group of device representations, where the devices connect over a network to a device shadowing service configured to manage the device states. In response to an event, device representations included in the group of device representations may be identified. Device states indicated by the device representations may be obtained and an aggregated group state for the group of device representations may be calculated using the device states indicated by the device representations.

Aggregated group state for a group of device representations

Technology is described for generating a search index. Device information associated with a customer may be identified. A device attribute included in the device information may be identified. The device attribute may include an attribute name and an attribute value. Key-value pairs may be formed for device attribute included in the device information. The key-value pairs may include a first key-value pair for the attribute name and a second key-value pair for the attribute value. The search index may be generated to include the key-value pairs for the device attribute included in the device information.

Generation of search indexes for disparate device information

A system that implements a data storage service may store data for database tables in multiple replicated partitions on respective storage nodes. In response to a request to restore a given table that was backed up in a remote storage system (e.g., key-value durable storage system), the service may create a new table, and may import a copy of each of the partitions of the given table from the remote storage system into the new table. The request to restore the table may specify a modified value for a configuration parameter for the table or for one of its partitions. The service may apply the new configuration parameter value to the table or its partitions during the restore operation. The new configuration parameter value may indicate an increase or decrease in storage capacity or throughput capacity, and its application may automatically trigger a partition split or move operation.

Restoring partitioned database tables from backup

Technologies are disclosed for providing a device registry service for devices that communicate over a network. The devices are configured as Internet of Things (IoT) devices. The devices are registered and classified as various types. Based upon the classification, interfaces are provided for the registered devices by the registry service if the devices do not already include them to allow for interaction and control of the devices. New interfaces can be provided to the service by various parties including manufacturers and system integrators to expose additional capabilities of the devices and create additional functionalities. The new interfaces are generally made available to all users of the registry service.

Device registry service

A technology is described for operating a device shadowing service that manages commands associated with groups of device representations. An example method may include receiving a group command associated with a group of device representations managed by a device shadowing service. Device representations included in the group of device representations represent physical devices that connect to the device shadowing service over one or more computer networks. In response to the group command, the device representations included in the group of device representations may be identified and an instruction to perform an action indicated by the group command may be sent to the physical devices represented by the device representations. Thereafter, indications may be received that at least a portion of the physical devices performed the action.

Group command management for device groups

A communication system and method for the utilization of a job management system to provide computing devices operational information. The job management system obtains a job definition from a user via a user device. The job management system processes the job definition to create job task workflow to be implemented by one or more identified client devices. The job management system can then monitor the implementation of the job task workflow.

Distributed execution of tasks on client devices

A technology is described for operating a device shadowing service that manages device representations for physical devices that are network addressable. An example method may include associating a device representation with a representation type, where the device representation represents a copy of a state of a physical device in network communication with a device shadowing service that maintains the device representation, and the representation type may define a command that can be invoked through the device representation. After the device representation has been associated with the representation type, the command may be invoked through the device representation. Invoking the command may involve identifying the representation type associated with the device representation and determining that the command is supported by the representation type. Thereafter, the command may be executed.

Device representation management using representation types

Growing community of inventors

Seattle, WA, United States of America

William Alexander Stevenson