-
公开(公告)号：US09367697B1
公开(公告)日：2016-06-14
申请号：US13765020
申请日：2013-02-12
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Matthew James Wren , Eric Jason Brandwine , Brian Irl Pratt
CPC classification number: G06F21/602 , H04L9/0897 , H04L63/1416 , H04L2209/76
Abstract: A security module securely manages keys. The security module is usable to implement a cryptography service that includes a request processing component. The request processing component responds to requests by causing the security module to perform cryptographic operations that the request processing component cannot perform due to a lack of access to appropriate keys. The security module may be a member of a group of security modules that securely manage keys. Techniques for passing secret information from one security module to the other prevent unauthorized access to secret information.
Abstract translation: 一个安全模块可以安全地管理密钥。 安全模块可用于实现包括请求处理组件的加密服务。 请求处理组件通过使安全模块执行密码操作来响应请求，请求处理组件由于缺乏对适当的密钥的访问而无法执行。 安全模块可以是安全管理密钥的一组安全模块的成员。 将秘密信息从一个安全模块传递到另一个安全模块的技术防止未经授权的访问秘密信息。
-
公开(公告)号：US20140229732A1
公开(公告)日：2014-08-14
申请号：US13765265
申请日：2013-02-12
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Matthew James Wren , Eric Jason Brandwine , Brian Irl Pratt
IPC: G06F21/62
CPC classification number: G06F21/602 , G06F2221/2135 , G06F2221/2143 , G06F2221/2151 , H04L63/0428 , H04L63/062
Abstract: A distributed computing environment utilizes a cryptography service. The cryptography service manages keys securely on behalf of one or more entities. The cryptography service is configured to receive and respond to requests to perform cryptographic operations, such as encryption and decryption. The requests may originate from entities using the distributed computing environment and/or subsystems of the distributed computing environment.
-
公开(公告)号：US10911428B1
公开(公告)日：2021-02-02
申请号：US14634513
申请日：2015-02-27
Applicant: Amazon Technologies, Inc.
Inventor： Gregory B. Roth , Kevin Ross O'Neill , Eric Jason Brandwine , Brian Irl Pratt , Bradley Jeffery Behm , Nathan R. Fitch
Abstract: Systems and methods for controlling access to one or more computing resources relate to generating session credentials that can be used to access the one or more computing resources. Access to the computing resources may be governed by a set of policies and requests for access made using the session credentials may be fulfilled depending on whether they are allowed by the set of policies. The session credentials themselves may include metadata that may be used in determining whether to fulfill requests to access the one or more computing resources. The metadata may include permissions for a user of the session credential, claims related to one or more users, and other information.
-
公开(公告)号：US10771456B2
公开(公告)日：2020-09-08
申请号：US15958655
申请日：2018-04-20
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Graeme David Baer , Brian Irl Pratt
Abstract: A one-time password (OTP) based security scheme is described, where a provider pre-generates a number of verification codes (e.g., OTP codes) which will be valid for a predetermined interval. The provider then encodes the verification codes (e.g., by hashing each code with a time value), and stores the verification codes into a data structure. The data structure can be provided to a verification system that can use the set of pre-generated OTP codes to authenticate requests received from users having personal security tokens.
-
公开(公告)号：US10673906B2
公开(公告)日：2020-06-02
申请号：US15900465
申请日：2018-02-20
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Matthew James Wren , Brian Irl Pratt
Abstract: A first service submits a request to a second service on behalf of a customer of a service provider. The request may have been triggered by a request of the customer to the first service. To process the request, the second service evaluates one or more policies to determine whether fulfillment of the request is allowed by policy associated with the customer. The one or more policies may state one or more conditions on one or more services that played a role in submission of the request. If determined that the policy allows fulfillment of the request, the second service fulfills the request.
-
Patent Agency Ranking
公开(公告)号：US10666436B2
公开(公告)日：2020-05-26
申请号：US15376451
申请日：2016-12-12
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Matthew James Wren , Eric Jason Brandwine , Brian Irl Pratt
Abstract: A system uses information submitted in connection with a request to determine if and how to process the request. The information may be electronically signed by a requestor using a key such that the system processing the request can verify that the requestor has the key and that the information is authentic. The information may include information that identifies a holder of a key needed for processing the request, where the holder of the key can be the system or another, possibly third party, system. Requests to decrypt data may be processed to ensure that a certain amount of time passes before access to the decrypted data is provided, thereby providing an opportunity to cancel such requests and/or otherwise mitigate potential security breaches.
-
公开(公告)号：US20200082110A1
公开(公告)日：2020-03-12
申请号：US16673753
申请日：2019-11-04
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Matthew James Wren , Eric Jason Brandwine , Brian Irl Pratt
IPC: G06F21/62
Abstract: Requests submitted to a computer system are evaluated for compliance with policy to ensure data security. Plaintext and associated data are used as inputs into a cipher to produce ciphertext. Whether a result of decrypting the ciphertext can be provided in response to a request is determined based at least in part on evaluation of a policy that itself is based at least in part on the associated data. Other policies include automatic rotation of keys to prevent keys from being used in enough operations to enable cryptographic attacks intended to determine the keys.
-
公开(公告)号：US10467422B1
公开(公告)日：2019-11-05
申请号：US13764944
申请日：2013-02-12
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Matthew James Wren , Eric Jason Brandwine , Brian Irl Pratt
Abstract: Requests submitted to a computer system are evaluated for compliance with policy to ensure data security. Plaintext and associated data are used as inputs into a cipher to produce ciphertext. Whether a result of decrypting the ciphertext can be provided in response to a request is determined based at least in part on evaluation of a policy that itself is based at least in part on the associated data. Other policies include automatic rotation of keys to prevent keys from being used in enough operations to enable cryptographic attacks intended to determine the keys.
-
公开(公告)号：US10211977B1
公开(公告)日：2019-02-19
申请号：US13765283
申请日：2013-02-12
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Matthew James Wren , Eric Jason Brandwine , Brian Irl Pratt
Abstract: A security module securely manages keys. The security module is usable to implement a cryptography service that includes a request processing component. The request processing component responds to requests by causing the security module to perform cryptographic operations that the request processing component cannot perform due to a lack of access to appropriate keys. The security module may be a member of a group of security modules that securely manage keys. Techniques for passing secret information from one security module to the other prevent unauthorized access to secret information.
-
公开(公告)号：US09954856B2
公开(公告)日：2018-04-24
申请号：US14976398
申请日：2015-12-21
Applicant: Amazon Technologies, Inc.
Inventor： Gregory Branchek Roth , Graeme David Baer , Brian Irl Pratt
CPC classification number: H04L63/0838 , G06F21/34
Abstract: A one-time password (OTP) based security scheme is described, where a provider pre-generates a number of verification codes (e.g., OTP codes) which will be valid for a predetermined interval. The provider then encodes the verification codes (e.g., by hashing each code with a time value), and stores the verification codes into a data structure. The data structure can be provided to a verification system that can use the set of pre-generated OTP codes to authenticate requests received from users having personal security tokens.
-
-
-
-
-
-
-
-
-
Search Results
65
records
(took 0.025 seconds)
