Complete forward access sessions

Patent metadata

Field	Value
Publication number	US-12160519-B2
Application number	US-202117465481-A
Country	US
Kind code	B2
Filing date	Sep 2, 2021
Priority date	Jul 17, 2013
Publication date	Dec 3, 2024
Grant date	Dec 3, 2024

Abstract

A service provider manages access control to multiple services through an authentication system. One or more services are able to fulfill requests at least in part by submitting requests to other services of the service provider. Such a service is able to obtain, from the authentication system, information that can be passed on to one or more other services to enable the one or more other services to determine request validity without having to contact the authentication system. The information may include, for example, one or more responses that the one or more other services would have received had the one or more services contacted the authentication system themselves.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
transmitting an authentication request comprising first authentication information associated with a first request to access a service of an authentication system;
obtaining, from the authentication system, a response to the authentication request, the response comprising a signing key and second information verifying the first request, wherein:
the second information is based, at least in part, on secret information shared between the service and the authentication system; and
the second information comprises policy information indicating a set of policies applicable to an identity associated with the first request; and

providing a second request to the service to cause the service to perform one or more operations, wherein the second request comprises the second information and first authentication information generated based, at least in part, on the signing key obtained from the response to the authentication request, and wherein the service is a virtual computer system service.

2. The computer-implemented method of claim 1 , wherein:
the service performs the one or more operations as a result of verifying the second request; and
the service verifies the second request without communicating with the authentication system.

3. The computer-implemented method of claim 1 , wherein the response further comprises one or more indications of authenticity of the first request.

4. The computer-implemented method of claim 1 , wherein the second information is specific to the service and only decryptable by the service.

5. The computer-implemented method of claim 1 , wherein one or more systems that transmit the authentication request lack access to the secret information.

6. The computer-implemented method of claim 1 , wherein the second information includes metadata indicating data corresponding to the identity, and a first electronic signature of the metadata.

7. The computer-implemented method of claim 6 , wherein the service verifies the second request by at least generating a second electronic signature using the secret information and comparing the second electronic signature to the first electronic signature.

8. The computer-implemented method of claim 7 , wherein the service further verifies the second request by at least determining whether the second request complies with the set of policies.

9. A system, comprising:
one or more processors; and
memory including instructions executable by the one or more processors that cause the system to at least:
transmit an authentication request comprising first authentication information associated with a first request to access a service of an authentication system;
obtain, from the authentication system, a response to the authentication request, the response comprising a signing key and second information verifying the first request, wherein:
the second information is based, at least in part, on secret information shared between the service and the authentication system; and
the second information comprises policy information indicating a set of policies applicable to an identity associated with the first request; and

provide a second request to the service to cause the service to perform one or more operations, wherein the second request comprises the second information and first authentication information generated based, at least in part, on the signing key obtained from the response to the authentication request, and wherein the service is a virtual computer system service.

10. The system of claim 9 , wherein:
the second information comprises the first authentication information in encrypted form; and
a second authentication information is an electronic signature generated based at least in part on the signing key.

11. The system of claim 9 , wherein the secret information shared between the service and the authentication system is inaccessible by the authentication system.

12. The system of claim 9 , wherein the service stores the second information to process one or more subsequent requests from the system.

13. A non-transitory computer-readable storage medium comprising instructions that, when executed by one or more processors of a computer system, cause the computer system to:
transmit an authentication request comprising first authentication information associated with a first request to access a service of an authentication system;
obtain, from the authentication system, a response to the authentication request, the response comprising a signing key and second information verifying the first request, wherein:
the second information is based, at least in part, on secret information shared between the service and the authentication system; and
the second information comprises policy information indicating a set of policies applicable to an identity associated with the first request; and

provide a second request to the service to cause the service to perform one or more operations, wherein the second request comprises the second information and first authentication information generated based, at least in part, on the signing key obtained from the response to the authentication request, and wherein the service is a virtual computer system service.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, when executed by the one or more processors of the computer system, cause the computer system to:
obtain the first request and the first authentication information from one or more entities; and
transmit the first request and the first authentication information to the authentication system.

15. The non-transitory computer-readable storage medium of claim 13 , wherein the first authentication information is an electronic signature derived based at least in part a set of parameters each corresponding to a limitation on use of the signing key.

16. The non-transitory computer-readable storage medium of claim 13 , wherein the service verifies the second request by at least checking a cache for information usable to determine whether to fulfill the second request.

17. The non-transitory computer-readable storage medium of claim 13 , wherein the information shared secretly between the service and the authentication system is inaccessible to the computer system.

18. The non-transitory computer-readable storage medium of claim 13 , wherein the second information includes encrypted information that is usable to obtain the signing key to verify the authentication information.

19. The non-transitory computer-readable storage medium of claim 13 , wherein the service performs the set of operations as a result of a determination by the service that the second request is authentic.

20. The non-transitory computer-readable storage medium of claim 13 , wherein the service performs the set of operations by at least determining whether fulfillment of the second request is in accordance with the policy information.

Assignees

• Amazon Tech Inc

Inventors

• Roth Gregory Branchek
• Baer Graeme David

Classifications

• H04L2463/062

  applying encryption of the keys · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L9/3247 Primary

  involving digital signatures · CPC title