-
公开(公告)号：US11750642B1
公开(公告)日：2023-09-05
申请号：US17887803
申请日：2022-08-15
Applicant: Amazon Technologies, Inc.
Inventor： Michael Tautschnig , Neha Rungta , John Cook , Pauline Virginie Bolignano , Todd Granger MacDermid , Oksana Tkachuk
CPC classification number: H04L63/1433 , H04L63/10 , H04L63/1441 , H04L63/20
Abstract: This disclosure describes techniques for automating a system-level security review of a network-based service. The techniques may include generating and utilizing a machine-readable threat model to identify system-level security threats to the network-based service. The network-based service may be scanned upon being provisioned in a service-provider network, and the machine-readable threat model may be generated based on results of the scan. The machine-readable threat model may represent components of the network-based service, system-level security constraints configured to identify system-level security threats to the service, and mitigations to remedy violations to the system-level security constraints. The network-based service may be continuously, or periodically, scanned to identify changes in the network-based service. The techniques further include updating the machine-readable threat model to account for the detected changes to the network-based service, and analyzing the updated machine-readable threat model to determine whether the changes to the network-based service violate a system-level security constraint.
-
公开(公告)号：US11616800B2
公开(公告)日：2023-03-28
申请号：US16985954
申请日：2020-08-05
Applicant: Amazon Technologies, Inc.
Inventor： John Cook , Neha Rungta , Catherine Dodge , Jeff Puchalski , Carsten Varming
IPC: H04L9/40 , H04L41/0869 , H04L41/22 , G06F21/55 , G06F21/57 , G06F21/60 , H04L41/0893
Abstract: Security policies may be utilized to grant or deny permissions related to the access of computing resources. Two or more security policies may be compared to determine whether the policies are equivalent, whether one security is more permissive than another, and more. In some cases, it may be possible to identify whether there exists a security permission that is sufficient to determine two security policies lack equivalency. Propositional logics may be utilized in the evaluation of security policies.
-
公开(公告)号：US11165783B1
公开(公告)日：2021-11-02
申请号：US16714079
申请日：2019-12-13
Applicant: Amazon Technologies, Inc.
Inventor： William Joel Eiers , Liana Sorina Hadarean , Kasper Soe Luckow , Neha Rungta
Abstract: Systems and methods for quantifying permissiveness of access control policies using model counting techniques and automated policy downscaling are disclosed. A policy service receives an initial access policy and transforms the access policy into an access constraint compatible with a constraint solver. The policy service determines a degree of permissiveness of the policy based on a number of distinct solutions to the access constraint identified by the constraint solver. Using data associated with access requests precisely allowed by the initial access policy and the initial access policy, the policy service generates a modified policy by adding additional constraints to the access policy and determining that the modified policy is less permissive than the initial access policy.
-
公开(公告)号：US11093641B1
公开(公告)日：2021-08-17
申请号：US16219742
申请日：2018-12-13
Applicant: Amazon Technologies, Inc.
Inventor： Michael William Whalen , Carsten Varming , Neha Rungta , Andrew Judge Gacek , Murphy Berzish
IPC: G06F21/62 , G06N5/00 , G06F16/903 , G06K9/00 , H04L29/06 , G06F16/906
Abstract: A document anonymization system transforms structured documents, such as security policies, that contain user-specific and other sensitive data, producing encoded logic problems in the format or language of one or more constraint solvers; the logic problems do not contain any of the sensitive data. The system may perform a one- or two-stage anonymization process: in a first stage, the electronic document is analyzed according to its document type to identify parameters likely to contain sensitive data, and the associated values are replaced with arbitrary values; in a second stage, after the anonymized electronic document is converted into logic formulae representing the data, the system performs replacements of string constants in the logic formulae with arbitrary strings to further anonymize the sensitive data. The system may confirm that anonymization preserves the document structure, difficulty level, and satisfiability of the original document by executing the constraint solver against the anonymized logic problem.
-
公开(公告)号：US11017107B2
公开(公告)日：2021-05-25
申请号：US15913741
申请日：2018-03-06
Applicant: Amazon Technologies, Inc.
Inventor： Neha Rungta , Pauline Virginie Bolignano , Catherine Dodge , Carsten Varming , John Cook , Rajesh Viswanathan , Daryl Stephen Cooke , Santosh Kalyankrishnan
Abstract: A security assessment system of a computing resource service provider performs security analyses of virtual resource instances, such as virtual machine instances and virtual data store instances, to verify that certain invariable security requirements are satisfied by the instances' corresponding configurations; these analyses are performed before the instances are provisioned and deployed. If the security checks, which can be selected by the administrator of the resources, fail, the requested resources are denied deployment. Notifications identifying the faulty configuration(s) may be send to the administrative user. A template for launching virtual resource instances may be transformed into an optimized template for performing the pre-deployment security checks, such as by storing information needed to perform the checks within the optimized template itself.
-
Patent Agency Ranking
公开(公告)号：US10664379B2
公开(公告)日：2020-05-26
申请号：US16122676
申请日：2018-09-05
Applicant: Amazon Technologies, Inc.
Inventor： Juan Rodriguez Hortala , Neha Rungta , Mark R. Tuttle , Serdar Tasiran , Michael Tautschnig , Andrea Nedic , Carsten Varming , John Byron Cook , Sean McLaughlin
Abstract: A method for verifying source code for a program includes determining that a new version of the source code is available. One or more verification tools are determined to use for verification of the new version of the source code from a verification specification associated with the source code. A plurality of verification tasks to perform for the verification of the new version of the source code are automatically determined from the verification specification associated with the source code. The plurality of verification tasks for the new version of the source code are automatically performed using the one or more verification tools. A determination is then made as to whether the new version of the source code is verified.
-
公开(公告)号：US11921616B1
公开(公告)日：2024-03-05
申请号：US17707861
申请日：2022-03-29
Applicant: Amazon Technologies, Inc.
Inventor： Tongtong Xiang , Sean Mclaughlin , Marianna Rapoport , Neha Rungta , Matthias Schlaipfer , Florian Rabe
CPC classification number: G06F11/3628 , G06F8/35 , G06F8/447 , G06F9/44589
Abstract: Disclosed are systems and methods that determine specification portions of Dafny code and transform those specifications into one or more annotations, expressions, comments, and/or assertions that are included in a destination code written in a destination language as part of a compilation of the Dafny code into the destination code. The annotations, expressions, comments, and/or assertions in the destination code may be utilized by a verification component, such as a Checker Framework, to detect errors that are introduced into the destination code by the compiler as part of the compilation or to verify the absence of errors in the destination code.
-
公开(公告)号：US11736525B1
公开(公告)日：2023-08-22
申请号：US16904467
申请日：2020-06-17
Applicant: Amazon Technologies, Inc.
Inventor： Neha Rungta , Willem Conradie Visser , Daniel George Peebles
IPC: H04L9/40 , G06F21/57 , G06F21/62 , H04L41/0893
CPC classification number: H04L63/20 , G06F21/577 , G06F21/6218 , H04L41/0893 , H04L63/10
Abstract: Methods, systems, and computer-readable media for generating access control policies using static analysis are disclosed. An access control policy generator performs static analysis of program code of a software product. The static analysis identifies one or more calls to one or more external components in the program code. The access control policy generator determines a mapping of the one or more calls to one or more actions. The one or more actions are selected from a plurality of known actions supported by an access control policy manager. The access control policy generator generates an access control policy associated with the software product. The access control policy comprises one or more permissions with respect to the one or more external components. The access control policy permits the software product to access the plurality of external components using the access control policy manager during execution of the software product.
-
公开(公告)号：US11677789B2
公开(公告)日：2023-06-13
申请号：US17119663
申请日：2020-12-11
Applicant: Amazon Technologies, Inc.
Inventor： Neha Rungta , Daniel George Peebles , Andrew Jude Gacek , Marvin Theimer , Rebecca Claire Weiss , Brigid Ann Johnson
IPC: G06F15/16 , H04L9/40 , H04L41/5051 , H04L41/50
CPC classification number: H04L63/205 , H04L41/5051 , H04L41/5096 , H04L63/102
Abstract: Techniques for intent-based access control are described. A method of intent-based access control may include receiving, via a user interface of an intent-based governance service, one or more intent statements associated with user resources in a provider network, the one or more intent statements expressing at least one type of action allowed to be performed on the user resources, compiling the one or more intent statements into at least one access control policy, and associating the at least one access control policy with the user resources.
-
公开(公告)号：US20220201043A1
公开(公告)日：2022-06-23
申请号：US17567318
申请日：2022-01-03
Applicant: Amazon Technologies, Inc.
Inventor： Ujjwal Rajkumar Pugalia , Sean McLaughlin , Neha Rungta , Andrew Jude Gacek , Matthias Schlaipfer , John Michael Renner , Jihong Chen , Alex Li , Erin Westfall , Daniel George Peebles , Himanshu Gupta
IPC: H04L9/40
Abstract: Resource state validation may be performed for access management policies by an identity and access management system. An access management policy associated with an account for network-based services may be received and validated according to resource state obtained for resources associated with the account. A correction for a portion of the access management policy may be identified according to the validation and provided via an interface for the identity and access management system.
-
-
-
-
-
-
-
-
-
Search Results
38
records
(took 0.018 seconds)
