Trusted-code generated requests

Patent metadata

Field	Value
Publication number	US-9680872-B1
Application number	US-201414225249-A
Country	US
Kind code	B1
Filing date	Mar 25, 2014
Priority date	Mar 25, 2014
Publication date	Jun 13, 2017
Grant date	Jun 13, 2017

Abstract

Custom policies are definable for use in a system that enforces policies. A user, for example, may author a policy using a policy language and transmit the system through an application programming interface call. The custom policies may specify conditions for computing environment attestations that are provided with requests to the system. When a custom policy applies to a request, the system may determine whether information in the attestation is sufficient for the request to be fulfilled.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
under the control of one or more computer systems of a system of a service provider, the one or more computer systems configured with executable instructions,
receiving, from a customer of the service provider, a first application programming interface request for a policy to be enforced by the service provider for control of access to one or more computing resources hosted by the service provider for the customer, the policy specifying a set of conditions for computing environment attestations;
fulfilling the application programming interface request by at least storing the policy in a data store accessible to a policy enforcement component of the system;
receiving a second application programming interface request with an attestation of a computing environment from which the second application programming request was generated;
as a result of the policy applying to the second application programming interface request:
cryptographically verifying authenticity of the attestation; and
determining whether the attestation satisfies the set of conditions; and

processing the second application programming interface request in a manner dependent on whether the attestation is cryptographically verified and whether the attestation satisfies the set of conditions.

2. The computer-implemented method of claim 1 , wherein the first application programming request is a web service request.

3. The computer-implemented method of claim 1 , wherein:
the second application programming interface request further comprises a certificate with a public cryptographic key and a digital signature of the certificate;
the method further comprises verifying the digital signature of the certificate; and
the manner in which the second application programming interface request is processed is further dependent on the digital signature being valid.

4. The computer-implemented method of claim 1 , wherein:
the set of conditions for computing environment attestations specify at least one condition on a specified trusted platform module platform configuration register value; and
the at least one condition on the specified platform configuration requires the platform configuration register value to match a hash value of executable code of an application.

5. The computer-implemented method of claim 1 , wherein:
the method further comprises providing a graphical user interface with interface elements usable by a user to specify the set of conditions for the policy; and
the first application programming interface request is received as a result of user interaction with the provided graphical user interface.

6. The computer-implemented method of claim 1 , wherein:
the set of conditions for the policy is authored by the customer using a policy language; and
the first application programming interface request includes the set of conditions encoded using the policy language.

7. A system, comprising a collection of computing devices collectively configured to implement one or more services, the one or more services being configured to:
obtain, over a network, an encoding of a policy, the policy specifying one or more conditions on computing environment attestations; and
as a result of receipt of the encoding of the policy, cause the policy to be enforced such that, when the policy applies to a received request, fulfillment of the request is dependent at least in part on a computing environment attestation being provided in connection with the request and the computing environment attestation satisfying the specified one or more conditions.

8. The system of claim 7 , wherein the one or more services are further configured to:
receive a first request with a first computing environment attestation; and
process the request in accordance with at least whether the first computing environment attestation satisfies the policy.

9. The system of claim 7 , wherein the one or more services are further configured to generate computing environment attestations against which the policy is evaluated.

10. The system of claim 7 , wherein:
the system is operated by a service provider with multiple customers; and
the computing environment attestation is based at least in part on an identifier of a customer of the multiple customers.

11. The system of claim 7 , wherein:
the system is a component of a computing resource service provider system that hosts computing resources on behalf of multiple customers and that enforces policies authored by multiple customers of the computing resource service provider;
obtaining the encoding of the policy comprises receiving the encoding of the policy through an interface through which application programming interface calls are submittable to cause the system to enforce customer-defined policies; and
the one or more conditions are specified through the interface.

12. The system of claim 7 , wherein the one or more conditions specify output of a one-way function applied to an application required to be in computing environment attestations.

13. The system of claim 7 , wherein the one or more conditions require that, for each first request to which the policy applies, the first request is provided with a first computing environment attestation that indicates that the request was submitted by a computing device operating in accordance with an application specified as trusted and that the attestation include proof that the application specified as trusted is unmodified.

14. The system of claim 7 , wherein the one or more conditions are based at least in part on executable code of at least one of firmware, an operating system, or an application.

15. The system of claim 7 , wherein the one or more conditions for the policy are specified through a web-service interface of the system.

16. A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:
receive information generated based at least in part on user input defining a policy, the policy having a computing environment attestation condition such that, evaluation of the policy in with respect to a first computing environment attestation causes a different result than evaluation of the policy with respect to a second computing environment attestation different from the first computing environment attestation; and
cause the policy to be enforced such that, when the policy applies to a received request, fulfillment of the request is dependent on a computing environment attestation provided in connection with the request.

17. The non-transitory computer-readable storage medium of claim 16 , wherein fulfillment of the request is further dependent at least in part on cryptographic verification of authenticity of the computing environment attestation.

18. The non-transitory computer-readable storage medium of claim 16 , wherein causing the instructions that cause the policy to be enforced cause the computer system to submit application programming interface request to another system to cause the other system to enforce the policy.

19. The non-transitory computer-readable storage medium of claim 16 , wherein:
the information is received in an application programming interface request; and
causing fulfillment of the application programming interface request includes processing the application programming interface request.

20. The non-transitory computer-readable

Assignees

• Amazon Tech Inc

Inventors

• Roth Gregory Branchek
• Brandwine Eric Jason

Classifications

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L9/0897

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title