知搜-全球专利检索

  1. Login
  2. Sign Up

Search Results

38 records (took 0.019 seconds)

    Analyzing web service frontends to extract security-relevant behavior information
    31.
    发明授权
    Analyzing web service frontends to extract security-relevant behavior information 有权

    公开(公告)号：US11509730B1

    公开(公告)日：2022-11-22

    申请号：US17119238

    申请日：2020-12-11

    Applicant: Amazon Technologies, Inc.

    Inventor： Daniel George Peebles ,  Carsten Varming ,  Neha Rungta ,  Zhen Zhang

    IPC: H04L67/51 ,  H04L9/40 ,  H04L67/133

    Abstract: Techniques are described for generating a specification of security-relevant behavior associated with web services of a cloud provider network. Source code or software development artifacts associated with an implementation of a web service is obtained, where the source code of software development artifacts include an implementation of a request handler for an action of the service. The request handler includes a request authorization component, e.g., which may involve interaction with an identity and access management service of the cloud provider network to authenticate and authorize requests and may further rely upon one or more authorization contexts included in the requests received by the request handler. An interprocedural data flow analyzer is used to analyze a model representation of the bytecode to identify and generate specifications of authorization patterns associated with the request handler.

    Generating access management policies from example requests
    32.
    发明授权
    Generating access management policies from example requests 有权

    公开(公告)号：US11483353B1

    公开(公告)日：2022-10-25

    申请号：US17112849

    申请日：2020-12-04

    Applicant: Amazon Technologies, Inc.

    Inventor： Jiasi Shen ,  Homer Strong ,  Daniel George Peebles ,  Neha Rungta

    IPC: G06F15/173 ,  H04L9/40

    Abstract: Access management policies may be generated from example requests. An access management policy may be received. One or more example requests that have expected results when evaluated with respect to the access management policy may be received. Updates to the access management policy may be determined that cause the expected results to occur when a new version of the access management policy based on the updates is enforced. The new version of the access management policy may be generated based on the updates.

    ANALYSIS OF ROLE REACHABILITY WITH TRANSITIVE TAGS
    33.
    发明申请
    ANALYSIS OF ROLE REACHABILITY WITH TRANSITIVE TAGS 有权

    公开(公告)号：US20220191205A1

    公开(公告)日：2022-06-16

    申请号：US17119855

    申请日：2020-12-11

    Applicant: Amazon Technologies, Inc.

    Inventor： John Byron Cook ,  Neha Rungta ,  Carsten Varming ,  Daniel George Peebles ,  Daniel Kroening ,  Alejandro Naser Pastoriza

    IPC: H04L29/06 ,  H04L12/24

    Abstract: Methods, systems, and computer-readable media for analysis of role reachability with transitive tags are disclosed. An access control analyzer determines a graph comprising a plurality of nodes and one or more edges. The nodes represent roles in a provider network hosting resources. The roles are associated with access control policies granting or denying access to individual resources. One or more of the access control policies grant or deny access based (at least in part) on one or more key-value attributes. The access control analyzer determines, based (at least in part) on a role reachability analysis of the graph, whether a first role can assume a second role using one or more role assumption steps for a particular state of the one or more attributes. The one or more attributes may comprise one or more transitive attributes that persist during the one or more role assumption steps.

    Automated threat modeling using machine-readable threat models
    38.
    发明授权
    Automated threat modeling using machine-readable threat models 有权

    公开(公告)号：US10652266B1

    公开(公告)日：2020-05-12

    申请号：US15907870

    申请日：2018-02-28

    Applicant: Amazon Technologies, Inc.

    Inventor： Michael Tautschnig ,  Neha Rungta ,  John Cook ,  Pauline Virginie Bolignano ,  Todd Granger MacDermid ,  Oksana Tkachuk

    IPC: H04L29/06

    Abstract: This disclosure describes techniques for automating a system-level security review of a network-based service. The techniques may include generating and utilizing a machine-readable threat model to identify system-level security threats to the network-based service. The network-based service may be scanned upon being provisioned in a service-provider network, and the machine-readable threat model may be generated based on results of the scan. The machine-readable threat model may represent components of the network-based service, system-level security constraints configured to identify system-level security threats to the service, and mitigations to remedy violations to the system-level security constraints. The network-based service may be continuously, or periodically, scanned to identify changes in the network-based service. The techniques further include updating the machine-readable threat model to account for the detected changes to the network-based service, and analyzing the updated machine-readable threat model to determine whether the changes to the network-based service violate a system-level security constraint.

Patent Agency Ranking