知搜-全球专利检索

  1. Login
  2. Sign Up

Search Results

38 records (took 0.02 seconds)

    ANALYSIS OF ROLE REACHABILITY USING POLICY COMPLEMENTS
    11.
    发明申请
    ANALYSIS OF ROLE REACHABILITY USING POLICY COMPLEMENTS 有权

    公开(公告)号：US20220191206A1

    公开(公告)日：2022-06-16

    申请号：US17119868

    申请日：2020-12-11

    Applicant: Amazon Technologies, Inc.

    Inventor： John Byron Cook ,  Neha Rungta ,  Carsten Varming ,  Daniel George Peebles ,  Daniel Kroening ,  Alejandro Naser Pastoriza

    IPC: H04L29/06 ,  H04L12/24

    Abstract: Methods, systems, and computer-readable media for analysis of role reachability using policy complements are disclosed. An access control analyzer determines two nodes in a graph that potentially have a common edge. The nodes correspond to roles in a provider network, and the roles are associated with first and second access control policies that grant or deny access to resources. The access control analyzer performs a role reachability analysis that determines whether the first role can assume the second role for a particular state of one or more key-value tags. The role reachability analysis determines a third access control policy authorizing a negation of a role assumption request for the second role. The role reachability analysis performs analysis of the third access control policy with respect to a role assumption policy for the second role for the particular state of the one or more key-value tags.

    Method to check application programming interface correctness in software
    12.
    发明授权
    Method to check application programming interface correctness in software 有权

    公开(公告)号：US11301357B1

    公开(公告)日：2022-04-12

    申请号：US16584611

    申请日：2019-09-26

    Applicant: Amazon Technologies, Inc.

    Inventor： Andrew Jude Gacek ,  Neha Rungta ,  Lee Pike

    IPC: G06F11/36 ,  G06F11/32

    Abstract: Techniques for performing compile-time checks of source code using static analysis are described herein. One or more application programming interface calls to a remote computing service provider are detected in a set of source code listings using static analysis, and properties of each call are checked against a user-defined model containing rules defining incorrect behavior. If incorrect behavior is detected, a visualization is presented containing information about the incorrect behavior.

    Distributed decomposition of string-automated reasoning using predicates
    13.
    发明授权
    Distributed decomposition of string-automated reasoning using predicates 有权

    公开(公告)号：US11861409B2

    公开(公告)日：2024-01-02

    申请号：US17218541

    申请日：2021-03-31

    Applicant: Amazon Technologies, Inc.

    Inventor： John Byron Cook ,  Andres Philipp Noetzli ,  Neha Rungta ,  Jingmei Hu

    IPC: G06F9/46 ,  G06F9/50 ,  G06F9/54

    CPC classification number: G06F9/505 ,  G06F9/5038 ,  G06F9/5072 ,  G06F9/541

    Abstract: Techniques are described for efficiently distributing across multiple computing resources satisfiability modulo theories (SMT) queries expressed in propositional logic with string variables. As part of the computing-related services provided by a cloud provider network, many cloud providers also offer identity and access management services, which generally help users to control access and permissions to the services and resources (e.g., compute instances, storage resources, etc.) obtained by users via a cloud provider network. By using resource policies, for example, users can granularly control which identities are able to access specific resources associated with the users' accounts and how those identities can use the resources. The ability to efficiently distribute the analysis of SMT queries expressed in propositional logic with string variables among any number of separate computing resources (e.g., among separate processes, compute instances, containers, etc.) enables the efficient analysis of such policies.

    Request context generator for security policy validation service
    16.
    发明授权
    Request context generator for security policy validation service 有权

    公开(公告)号：US10922423B1

    公开(公告)日：2021-02-16

    申请号：US16015114

    申请日：2018-06-21

    Applicant: Amazon Technologies, Inc.

    Inventor： Neha Rungta ,  Kasper Søe Luckow ,  Andrew Jude Gacek ,  Carsten Varming ,  John Cook

    IPC: G06F21/60 ,  G06F21/44

    Abstract: A security policy analyzer service of a computing resource service provider performs evaluations of security policies provided by the service provider's users, to determine whether the security policies are valid, satisfiable, accurate, and/or sufficiently secure. The service may compare the user-provided policy to a stored or best-practices policy to begin the evaluation, translating encoded security permissions into propositional logic formulae that can be compared to determine which policy is more permissive. The service determines values of the parameters in a request for access to a computing resource based on the policy comparison, and generates request contexts using the values. The service uses the request contexts to generate one or more comparative policies that are then used iteratively as the second policy in the comparison to the user-provided policy, in order to produce additional request contexts that represent allow/deny “edge cases” along the borders of policy permission statements.

    Policy scope management
    19.
    发明授权
    Policy scope management 有权

    公开(公告)号：US11863563B1

    公开(公告)日：2024-01-02

    申请号：US15923832

    申请日：2018-03-16

    Applicant: Amazon Technologies, Inc.

    Inventor： Neha Rungta ,  Tyler Stuart Bray ,  Kasper Søe Luckow ,  Alexander Watson ,  Jeff Puchalski ,  John Cook ,  Michael Gough

    IPC: H04L9/40

    CPC classification number: H04L63/105 ,  H04L63/20

    Abstract: The appropriate scoping of an access policy can be determined using the observed access and usage of various resources covered under that policy. Information about access requests received over a period of time can be logged, and actions represented in the log data can be mapped to the permissions of the access policy. A new access policy can be generated that includes grant permissions only for those actions that were received and/or granted during the monitored period of time. The new policy can be processed using policy logic to ensure that changes in permission comply with rules or policies for the target resources. The new policy can be at least partially implemented, or can be provided to an authorized user, who can choose to adopt or deny the new policy, or to accept some of the recommendations for modifying the current policy.

    POLICY SCOPE MANAGEMENT
    20.
    发明公开
    POLICY SCOPE MANAGEMENT 审中-公开

    公开(公告)号：US20230370473A1

    公开(公告)日：2023-11-16

    申请号：US18359456

    申请日：2023-07-26

    Applicant: Amazon Technologies, Inc.

    Inventor： Neha Rungta ,  Tyler Stuart Bray ,  Kasper Søe Luckow ,  Alexander Watson ,  Jeff Puchalski ,  John Cook ,  Michael Gough

    IPC: H04L9/40

    CPC classification number: H04L63/105 ,  H04L63/20

    Abstract: The appropriate scoping of an access policy can be determined using the observed access and usage of various resources covered under that policy. Information about access requests received over a period of time can be logged, and actions represented in the log data can be mapped to the permissions of the access policy. A new access policy can be generated that includes grant permissions only for those actions that were received and/or granted during the monitored period of time. The new policy can be processed using policy logic to ensure that changes in permission comply with rules or policies for the target resources. The new policy can be at least partially implemented, or can be provided to an authorized user, who can choose to adopt or deny the new policy, or to accept some of the recommendations for modifying the current policy.

Patent Agency Ranking