公开(公告)号：US12170666B1

公开(公告)日：2024-12-17

申请号：US16143307

申请日：2018-09-26

Applicant: Amazon Technologies, Inc.

Inventor： Jaimin Bhatt ,  Ken Chu ,  Jack A. Drooger ,  Frank Johnston

IPC: H04L9/40

Abstract: A system receives an authentication request from a requestor system for a token to access one or more computing resources associated with a computing resource service provider. The system analyzes information included with the authentication request and, based on the information included with the authentication request, selects an authentication provider from a plurality of authentication providers without additional input from the requestor system. The requestor system is redirected to the selected authentication provider such that the token is provided in response to the authentication request. The requestor system then presents the token to obtain an identity assertion that can be used to access the one or more computing resources.

公开(公告)号：US10992670B1

公开(公告)日：2021-04-27

申请号：US16186740

申请日：2018-11-12

Applicant: Amazon Technologies, Inc.

Inventor： Jack A. Drooger ,  Galen Caldwell ,  Jonathan Carl Lundstrom ,  Ken Chu ,  Jaimin Bhatt ,  Frank Johnston ,  Ali Kourosh Gharib

IPC: H04L29/06 ,  H04L9/32 ,  H04L12/46

Abstract: This disclosure describes techniques for utilizing strong authentication of device identities and/or user identities to establish secure network tunnels between client devices and a virtual private network (VPN) server of a service provider network. The service provider network may generate routes from the VPN server to services to establish a connection for the client device to access the services. The service provider network may receive posture data from the client device that indicates a state of the client device, and determine, using a security policy, with which services the client device is permitted to interact or utilize. Further, the techniques described herein include receiving requests from the services to provide cryptographic assertion(s) that were used by the VPN server to authenticate the device identities and/or user identities. In this way, the services may be able to perform strong authentication of the client devices that are attempting to utilize the services.