-
公开(公告)号：US10771456B2
公开(公告)日：2020-09-08
申请号：US15958655
申请日：2018-04-20
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Graeme David Baer , Brian Irl Pratt
Abstract: A one-time password (OTP) based security scheme is described, where a provider pre-generates a number of verification codes (e.g., OTP codes) which will be valid for a predetermined interval. The provider then encodes the verification codes (e.g., by hashing each code with a time value), and stores the verification codes into a data structure. The data structure can be provided to a verification system that can use the set of pre-generated OTP codes to authenticate requests received from users having personal security tokens.
-
公开(公告)号：US10769287B2
公开(公告)日：2020-09-08
申请号：US16450646
申请日：2019-06-24
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Eric Jason Brandwine
Abstract: Logical data containers of a data storage system are associated with policies that require data transformation of data to be stored in the logical data containers. When a data object is received to be stored in a logical data container, the data object is transformed in accordance with a policy on the logical data container. Transformation of the data object may include encryption. The logical data container may also be associated with a cryptographic key used to perform a required transformation.
-
公开(公告)号：US10728031B2
公开(公告)日：2020-07-28
申请号：US16167377
申请日：2018-10-22
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Gregory Alan Rubin
Abstract: Cryptographic keys are durably stored for an amount of time. A cryptographic key is encrypted so as to be decryptable using another cryptographic key that has a limited lifetime. The other cryptographic key can be used to decrypt the encrypted cryptographic key to restore the cryptographic key during the lifetime of the other cryptographic key. After the lifetime of the other cryptographic key, if a copy of the cryptographic key is lost (e.g., inadvertently and unrecoverably deleted from memory), the cryptographic key becomes irrecoverable.
-
公开(公告)号：US10673906B2
公开(公告)日：2020-06-02
申请号：US15900465
申请日：2018-02-20
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Matthew James Wren , Brian Irl Pratt
Abstract: A first service submits a request to a second service on behalf of a customer of a service provider. The request may have been triggered by a request of the customer to the first service. To process the request, the second service evaluates one or more policies to determine whether fulfillment of the request is allowed by policy associated with the customer. The one or more policies may state one or more conditions on one or more services that played a role in submission of the request. If determined that the policy allows fulfillment of the request, the second service fulfills the request.
-
公开(公告)号：US10666436B2
公开(公告)日：2020-05-26
申请号：US15376451
申请日：2016-12-12
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Matthew James Wren , Eric Jason Brandwine , Brian Irl Pratt
Abstract: A system uses information submitted in connection with a request to determine if and how to process the request. The information may be electronically signed by a requestor using a key such that the system processing the request can verify that the requestor has the key and that the information is authentic. The information may include information that identifies a holder of a key needed for processing the request, where the holder of the key can be the system or another, possibly third party, system. Requests to decrypt data may be processed to ensure that a certain amount of time passes before access to the decrypted data is provided, thereby providing an opportunity to cancel such requests and/or otherwise mitigate potential security breaches.
-
Patent Agency Ranking
公开(公告)号：US20200082110A1
公开(公告)日：2020-03-12
申请号：US16673753
申请日：2019-11-04
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Matthew James Wren , Eric Jason Brandwine , Brian Irl Pratt
IPC: G06F21/62
Abstract: Requests submitted to a computer system are evaluated for compliance with policy to ensure data security. Plaintext and associated data are used as inputs into a cipher to produce ciphertext. Whether a result of decrypting the ciphertext can be provided in response to a request is determined based at least in part on evaluation of a policy that itself is based at least in part on the associated data. Other policies include automatic rotation of keys to prevent keys from being used in enough operations to enable cryptographic attacks intended to determine the keys.
-
公开(公告)号：US10521595B2
公开(公告)日：2019-12-31
申请号：US15989493
申请日：2018-05-25
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Eric Jason Brandwine
Abstract: A storage device can include processing and cryptographic capability enabling the device to function as a hardware security module (HSM). This includes the ability to encrypt and decrypt data using a cryptographic key, as well as to perform processing using such a key, independent of whether that processing involves data stored on the device. An internal key can be provided to the drive, whether provided before customer software access or received wrapped in another key, etc. That key enables the device to perform secure processing on behalf of a user or entity, where that key is not exposed to other components in the network or environment. A key may have specified tasks that can be performed using that key, and can be discarded after use. In some embodiments, firmware is provided that can cause a storage device to function as an HSM and/or processing device with cryptographic capability.
-
公开(公告)号：US10467422B1
公开(公告)日：2019-11-05
申请号：US13764944
申请日：2013-02-12
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Matthew James Wren , Eric Jason Brandwine , Brian Irl Pratt
Abstract: Requests submitted to a computer system are evaluated for compliance with policy to ensure data security. Plaintext and associated data are used as inputs into a cipher to produce ciphertext. Whether a result of decrypting the ciphertext can be provided in response to a request is determined based at least in part on evaluation of a policy that itself is based at least in part on the associated data. Other policies include automatic rotation of keys to prevent keys from being used in enough operations to enable cryptographic attacks intended to determine the keys.
-
公开(公告)号：US10454922B2
公开(公告)日：2019-10-22
申请号：US15052789
申请日：2016-02-24
Applicant: Amazon Technologies, Inc.
Inventor： Stefan Popoveniuc , Cristian Marius Ilac , Gregory Branchek Roth , Eric J. Brandwine
Abstract: A first identity claim and a first attempt to prove password possession are received. As a result of determining that the first attempt to prove password possession is a match to a password in a set of passwords, but that the first identity claim is a mismatch to an identity that corresponds to the password, an authentication process that includes incrementing a counter associated with the password is performed. A second identity claim and a second attempt to prove password possession is received. As a result of determining that the second attempt to prove password possession is a match to the password, an authentication process that includes incrementing the counter associated with the password only if the second identity claim is a mismatch to the first identity claim is performed.
-
公开(公告)号：US10387683B2
公开(公告)日：2019-08-20
申请号：US15261759
申请日：2016-09-09
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth
Abstract: A request to cancel a change to a policy is received. Based at least in part on delay information for the change, determine that the change is currently delayed, where the delay information is associated with a condition precedent for the change to become effective under a policy change policy. A determination is made regarding whether cancellation is allowed by a set of conditions for the changes, and the proposed policy change is caused to be cancelled prior to a time indicated by the delay information.
-
-
-
-
-
-
-
-
-
Search Results
385
records
(took 0.028 seconds)
