Loading patent…
AssigneeAmazon Technologies, Inc.
InventorsGregory Branchek Roth, Daniel Stephen Popick, Bradley Jeffery Behm
Estimating the term…
Permissions can be delegated to enable access to resources associated with one or more different accounts, which might be associated with one or more different entities. Delegation profiles are established that are associated with at least one secured account of at least one customer. Each delegation profile includes information such as a name, a validation policy that specifies principals which may be external to the account and which are permitted to assume the delegation profile, and an authorization policy that indicates the permitted actions within the account for those principals which are acting within the delegation profile. Once a delegation profile is created, the profile can be available for external principals or services that provide a user credential delegated access under the account, where that credential is provided by a trusted identity service. Access can be provided across accounts using the user credential.
A computer-implemented method comprising:
A system comprising:
A non-transitory computer readable medium comprising computer-readable code, which when executed on a processor of a computing system, cause the computing system to:
Dependencies are inferred from the claim text.
Drawings are temporarily unavailable. Open the PDF at USPTO
From the US filing history. Foreign family members aren’t listed.
For controlling access to devices or network resources: multiple levels of security
Authentication, i.e. establishing the identity or authorisation of security principals: user authentication
Using certificates: for accessing specific resources, e.g. using Kerberos tickets
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…
About 6 years 3 months of term left · ends 6 Feb 2033 (estimated)
In recent years, an ever-increasing number of applications and services have been made available over networks such as cellular networks and the Internet. Due to this, an increasing number of content and service providers are turning to technologies such as remote resource sharing and cloud computing. Cloud computing, in general, is an approach to providing access to electronic resources through services, such as Web services, where the hardware and/or software used to support those services is dynamically scalable to meet the needs of the services at any given time. A user or customer of a service provider will typically rent, lease, or otherwise pay for access to resources through the cloud, and thus does not have to purchase and maintain the hardware and/or software to provide access to these resources.
In this context, a large number of security concerns are faced by service providers and by their customers. Typically, the service provider wants to ensure that the resource infrastructure is secure and that their customers' services and data are protected. Similarly, the customer of the service provider needs to ensure that the provider has taken the proper security measures to protect their information against unauthorized use or access from end users or various other parties. Furthermore, in some cases, the customer may wish to delegate or share security privileges between multiple heterogeneous services and resources that reside within the service provider or in external networks. It is thus desirable to enable the customer to achieve such sharing of privileges in a trusted and secure manner.
Various embodiments in accordance with the present disclosure will be described with reference to the drawings, in which:
FIG. 1 illustrates an example environment in which aspects of the various embodiments can be implemented;
FIG. 2 illustrates another example environment in which aspects of the various embodiments can be implemented;
In the following description, various embodiments will be illustrated by way of example and not by way of limitation in the figures of the accompanying drawings. References to various embodiments in this disclosure are not necessarily to the same embodiment, and such references mean at least one. While specific implementations and other details are discussed, it is to be understood that this is done for illustrative purposes only. A person skilled in the relevant art will recognize that other components and configurations may be used without departing from the scope and spirit of the claimed subject matter.
Systems and methods in accordance with the embodiments described herein overcome various deficiencies in existing approaches for delegating security rights and privileges for services and resources in an electronic and/or multi-tenant environment. In particular, the various embodiments provide approaches for using an internal and/or external entity to dynamically determine and authorize delegation of permissions to perform actions in, on, or against one or more secured accounts, where those accounts may be associated with a number of different entities and/or resource providers.
In accordance with various embodiments, a resource provider system can utilize a set of delegation profiles that can be created, selected, or applied for one or more accounts of at least one customer, where each customer has at least some level of access to one or more resources managed and/or offered by the system. In accordance with an embodiment, a delegation profile can include information such as (a) a name (or other identifier), (b) a validation policy that specifies one or more security principals (e.g., end users), or types of security principals, which may be external to the account and which are permitted to assume the delegation profile, and (c) an authorization policy specifying the permitted actions within the account for principals which are acting within the delegation profile. In some situations, a customer of the resource provider system might specify one or more policies, rules, or other criteria that can be evaluated to determine which delegation profile to apply to a specific principal, or to a request from that principal, etc.