Amazon Technologies, Inc.

International Business Machines Corporation

Yogesh Vilas Golwalkar

Kristin Marie Hazlewood

Magesh Rajamani

Bharath Kumar Bhimanaik

Gary Dale Williams

Daniel Wade Hitchcock

Bharath Bhimanaik Kumar

Dharinee Gupta

Jon Arron McClintock

Tushaar Sethi

Darin Keith McAdams

Lorne Millwood

Anuj Joshi

Carl Lucian Poston, Iv

Rajalakshmi S Iyer

John Ryan McGarvey

Ujjwal Lanjewar

Shevaun-Ann M Fontenot

Chanda Sethia

Disclosed are various embodiments for an authentication service. A unique identifier is associated with a device access token for a client to be authenticated. An authentication identifier is sent to an authenticated client. The client to be authenticated communicates the authentication identifier and unique identifier to the authentication service to complete authentication.

Secure authentication of devices

Disclosed are various embodiments for determining authentication assurance from a combination of historical and runtime-provided inputs. An authentication request associated with an account is received. A composite measure of authentication assurance is determined from a combination of a historical measure of authentication assurance and a runtime measure of authentication assurance. A response to the authentication request is generated based at least in part on the composite measure of authentication assurance.

Determining authentication assurance from historical and runtime-provided inputs

Disclosed are various embodiments for determining authentication assurance using algorithmic decay. In an embodiment, an authentication request associated with an account is received. At least one historical authentication event associated with the account is determined. A measure of authentication assurance is determined based at least in part on applying an exponential time decay to at least one authentication assurance value individually corresponding to the historical authentication event(s). A response to the authentication request is generated based at least in part on the measure of authentication assurance.

Determination of authentication assurance via algorithmic decay

Disclosed are various embodiments for determining authentication assurance based on both user-level and account-level indicators. An authentication request associated with an account is received responsive to an input from a user via a user interface. A user-level measure of authentication assurance corresponding to the user is determined. An account-level measure of authentication assurance corresponding to the account is determined. A composite measure of authentication assurance is then determined from a combination of the user-level measure of authentication assurance and the account-level measure of authentication assurance. A response to the authentication request is generated based at least in part on comparing the composite measure of authentication assurance to a threshold.

Determining authentication assurance from user-level and account-level indicators

Disclosed are various embodiments for identity data migration from one organization to another. An authentication service operated by a first organization receives user login information from a client device. The authentication service identifies a second organization for which the authentication service authenticates users. The user login information is verified according to an identity data associated with the second organization. An authentication token is returned to the client device and used by the client device to access resources of a network site operated by the second organization.

Identity migration between organizations

Disclosed are various embodiments for a shopping cart component of an electronic commerce application. The shopping cart may be shared by one or more users of the electronic commerce application. In this respect, the shopping cart represents the aggregate purchase of items on behalf of multiple users of the electronic commerce application. Each user with access to the shopping cart may add to or remove items from the shopping cart or purchase some or all of the items within the shopping cart. Further, each user may share the shopping cart with other users of the electronic commerce application. Discounts or other promotional or marketing credits or benefits may also be added to and shared by all users with access to the shopping cart.

Shared aggregated e-commerce shopping cart

Disclosed are various embodiments for providing a native authentication experience with failover. A network service authenticates a first application executed in a computing device in a first instance using one or more authentication factors received via a platform-specific application programming interface that is native to the computing device. After a change to how authentication is performed by the network service, the network service authenticates the first application in a second instance via code-based linking with a second application that is authenticated.

Native authentication experience with failover

Methods and systems are provided to enable gradual expiration of credentials. Instead of depriving a user of all his access rights upon expiration of his credential (e.g., password), the user's access rights may be gradually restricted during a grace period after an expected or initial expiration time and/or before a final expiration time. The access right may be determined based on a duration from a time of the access request to the final expiration time or to the initial expiration time.

Methods and systems for gradual expiration of credentials

Methods and systems are provided to enable access control based on credential properties. Besides authenticating a credential, an authentication service can provide additional credential-related information with respect to a credential such as last updated time. An entity receiving such additional credential-related information can implement access control policies based on the credential-related information. For instance, a user's access rights may be gradually restricted after an initial expiration time and towards a final expiration time. In an example, such access control may be implemented by a client application or client website of the authentication service. Alternatively or additionally, such access control may be implemented by an authorization service used by the client application or client website.

Methods and systems for enabling access control based on credential properties

Disclosed are various embodiments for identity data migration from one organization to another. Identity data corresponding to user accounts of a first organization are copied from a first data store managed by the first organization to a second data store managed by a second organization. A sign-in process of a network site of the first organization is reconfigured to employ an authentication service operated by the second organization. The authentication service is configured to authenticate a user of the network site using the identity data stored in the second data store.

Disclosed are various embodiments for providing a native authentication experience with failover. If a particular authentication approach is supported by a network service, an application authenticates with the network service according to the authentication approach using an authentication factor received via a platform-specific interface. If the particular authentication approach is not supported, code-based linking may be employed to authenticate via another application that is authenticated with the network service.

A computer implemented method, apparatus, and computer program product for managing requests. Responsive to receiving a request from a client, a determination is made as to whether a connection within a pool of connections has a set of outstanding requests for the client to handle a previous request from the same client. Responsive to a determination that the connection has any outstanding request, a determination is made as to whether a set of requests queued for the connection is equal to or exceeds a threshold. Responsive to a determination that the set of outstanding requests is equal to or exceeds the threshold, subsequent requests from the client are unprocessed until the set of outstanding requests becomes less than the threshold.

Growing community of inventors

Hyderabad Telangana, India

Yogesh Vilas Golwalkar