Back to results
US 10,095,849 B1Granted
Tag-based programming interface authentication
AssigneeAmazon Technologies, Inc.
InventorsWilliam Frederick Hingle Kruse, Jeffrey Cicero Canton
Life of this patent
Estimating the term…
Abstract
Programming interfaces and other means of invoking operations on a hosted service may perform operations having similar semantic meaning, including cases where the operations act upon different objects. Tags may be associated with programming interfaces having similar semantic meaning. A user may be authorized to invoke programming interfaces associated with the tag. A user may be authorized to invoke new programming interfaces when they are deployed without additional authorization.
Claims20
A system comprising:
- a first one or more computing nodes that, when activated, operates a first service comprising a first programming interface, the first programming interface configured to perform a second operation associated with a first securable object;
- a second one or more computing nodes operating a second service comprising a second programming interface, the second programming interface configured to perform a second operation associated with a second securable object different than the first securable object;
- one or more memories having stored thereon computer-readable instructions that, upon execution by a computing device, cause the system at least to:
- store a first record indicative of an association between the first programming interface and an identifier;
- store a second record indicative of an association between the second programming interface and the identifier, wherein the identifier is associated with the second programming interface based at least in part on the first operation having at least a threshold amount of similarity to the second operation;
- authorize a first request to invoke the first programming interface on behalf of a security principal, based at least in part on comparing the identifier associated with the first programming interface to identifiers associated with the security principal that are indicative of operations for which the security principal is authorized;
- and
- authorize a second request to invoke the second programming interface on behalf of the security principal, based at least in part on comparing the identifier associated with the second programming interface to the identifiers associated with the security principal.
5 more elements
A computer-implemented method comprising:
- storing a security setting associating a second programming interface with an identifier associated with a first programming interface, based at least in part on a first operation performed by the first programming interface upon invocation having at least a threshold amount of similarity to a second operation performed by the second programming interface upon invocation, the first operation associated with a first securable object different than a second securable object associated with the second operation;
- authorizing an invocation of the second programming interface on behalf of a security principal, the authorizing based at least in part on determining that the security principal is authorized to invoke programming interfaces associated with the identifier;
- and
- performing the second operation based at least in part on the authorizing of the invocation on behalf of the security principal.
1 more element
A non-transitory computer-readable storage medium having stored thereon instructions that, upon execution by a computing device, cause the computing device at least to:
- store a security setting that associates a second programming interface with an identifier associated with a first programming interface, based at least in part on a first operation performed by the first programming interface upon invocation having at least a threshold amount of similarity to a second operation performed by the second programming interface upon invocation, the first operation associated with a first securable object different than a second securable object associated with the second programming interface;
- authorize an invocation of the second programming interface on behalf of a security principal, the authorizing based at least in part on determining that the security principal is authorized to invoke programming interfaces associated with the identifier;
- and
- perform the second operation based at least in part on the authorization of the invocation on behalf of the security principal.
1 more element
Dependencies are inferred from the claim text.