知搜-全球专利检索

  1. Login
  2. Sign Up

Search Results

19 records (took 0.024 seconds)

    ANALYSIS OF ROLE REACHABILITY USING POLICY COMPLEMENTS
    1.
    发明申请
    ANALYSIS OF ROLE REACHABILITY USING POLICY COMPLEMENTS 有权

    公开(公告)号：US20220191206A1

    公开(公告)日：2022-06-16

    申请号：US17119868

    申请日：2020-12-11

    Applicant: Amazon Technologies, Inc.

    Inventor： John Byron Cook ,  Neha Rungta ,  Carsten Varming ,  Daniel George Peebles ,  Daniel Kroening ,  Alejandro Naser Pastoriza

    IPC: H04L29/06 ,  H04L12/24

    Abstract: Methods, systems, and computer-readable media for analysis of role reachability using policy complements are disclosed. An access control analyzer determines two nodes in a graph that potentially have a common edge. The nodes correspond to roles in a provider network, and the roles are associated with first and second access control policies that grant or deny access to resources. The access control analyzer performs a role reachability analysis that determines whether the first role can assume the second role for a particular state of one or more key-value tags. The role reachability analysis determines a third access control policy authorizing a negation of a role assumption request for the second role. The role reachability analysis performs analysis of the third access control policy with respect to a role assumption policy for the second role for the particular state of the one or more key-value tags.

    SECURITY POLICY MONITORING SERVICE
    4.
    发明申请
    SECURITY POLICY MONITORING SERVICE 审中-公开

    公开(公告)号：US20190007418A1

    公开(公告)日：2019-01-03

    申请号：US15637238

    申请日：2017-06-29

    Applicant: Amazon Technologies, Inc.

    Inventor： John Cook ,  Neha Rungta ,  Catherine Dodge ,  Jeff Puchalski ,  Carsten Varming

    IPC: H04L29/06

    Abstract: Requests of a computing system may be monitored. A request associated with the application of a policy may be identified and a policy verification routine may be invoked. The policy verification routine may detect whether the policy of the request is more permissive than a reference policy and perform a mitigation routine in response to determining that the policy of the request is more permissive than the reference policy. Propositional logics may be utilized in the evaluation of policies.

    Anonymizing sensitive data in logic problems for input to a constraint solver
    6.
    发明授权
    Anonymizing sensitive data in logic problems for input to a constraint solver 有权

    公开(公告)号：US11093641B1

    公开(公告)日：2021-08-17

    申请号：US16219742

    申请日：2018-12-13

    Applicant: Amazon Technologies, Inc.

    Inventor： Michael William Whalen ,  Carsten Varming ,  Neha Rungta ,  Andrew Judge Gacek ,  Murphy Berzish

    IPC: G06F21/62 ,  G06N5/00 ,  G06F16/903 ,  G06K9/00 ,  H04L29/06 ,  G06F16/906

    Abstract: A document anonymization system transforms structured documents, such as security policies, that contain user-specific and other sensitive data, producing encoded logic problems in the format or language of one or more constraint solvers; the logic problems do not contain any of the sensitive data. The system may perform a one- or two-stage anonymization process: in a first stage, the electronic document is analyzed according to its document type to identify parameters likely to contain sensitive data, and the associated values are replaced with arbitrary values; in a second stage, after the anonymized electronic document is converted into logic formulae representing the data, the system performs replacements of string constants in the logic formulae with arbitrary strings to further anonymize the sensitive data. The system may confirm that anonymization preserves the document structure, difficulty level, and satisfiability of the original document by executing the constraint solver against the anonymized logic problem.

    Request context generator for security policy validation service
    10.
    发明授权
    Request context generator for security policy validation service 有权

    公开(公告)号：US10922423B1

    公开(公告)日：2021-02-16

    申请号：US16015114

    申请日：2018-06-21

    Applicant: Amazon Technologies, Inc.

    Inventor： Neha Rungta ,  Kasper Søe Luckow ,  Andrew Jude Gacek ,  Carsten Varming ,  John Cook

    IPC: G06F21/60 ,  G06F21/44

    Abstract: A security policy analyzer service of a computing resource service provider performs evaluations of security policies provided by the service provider's users, to determine whether the security policies are valid, satisfiable, accurate, and/or sufficiently secure. The service may compare the user-provided policy to a stored or best-practices policy to begin the evaluation, translating encoded security permissions into propositional logic formulae that can be compared to determine which policy is more permissive. The service determines values of the parameters in a request for access to a computing resource based on the policy comparison, and generates request contexts using the values. The service uses the request contexts to generate one or more comparative policies that are then used iteratively as the second policy in the comparison to the user-provided policy, in order to produce additional request contexts that represent allow/deny “edge cases” along the borders of policy permission statements.

Patent Agency Ranking