US 10,771,468 B1Granted

Request filtering and data redaction for access control

AssigneeAmazon Technologies, Inc.

InventorsDavid Walker, Bertram Dorn

Life of this patent

Estimating the term…

Loading patent…

Abstract

Approaches provide for mandatory access controls and account identification masking controls in an electronic environment. For example, a customer can configure a client device to access an API gateway which acts as a proxy for a resource in a resource provider environment. Requests for resources or services can be redirected to the API gateway. A registered function may be triggered when the request is received and may filter the request. After filtering, the request can be forwarded on to the actual API endpoint to access the requested resource. From the client's perspective, the resource is being accessed directly, and from the resource's perspective, it is being accessed by the proxy. This layer of indirection enables data to be protected preemptively, rather than waiting for an undesirable condition to exist and then reactively attending to the issue. Additionally, log data may be redacted and/or masked automatically as it is created, protecting sensitive data before it is accessible to administrators or other users.

Claims20

Dependent claims

A system, comprising:

at least one processor;
and
memory storing instructions that, when executed by the at least one processor, cause the system to:
receive a request at a gateway serving as a proxy to at least one resource in a resource provider environment, the request received from a client device and intended for an endpoint associated with the at least one resource;
determine a role for a first registered function comprising code for execution in the resource provider environment, the role having a set of permissions for limiting the first registered function and for granting access to the at least one resource in the resource provider environment, the gateway and the first registered function associated with a first account, the at least one resource associated with a second account and accessible via the endpoint by the first registered function;
determine, by the first registered function using an access control list, to provide the request to the endpoint;
provide the request to the endpoint to access to the at least one resource;
store log data associated with the request in a first data store;
execute a second registered function on the log data, the second registered function triggered by the storing of the log data in the first data store;
redact the log data by the second registered function to generate redacted log data;
and
store the redacted log data in a second data store accessible to the client device.

9 more elements

A non-transitory computer readable storage medium storing instructions that, when executed by at least one processor of a computing system, causes the computing system to:

receive a request at a first interface, the request received from a client device and intended for a second interface;
determine a registered function comprising code for execution against at least one resource in a provider environment and corresponding to the request, the registered function limited by a set of permissions, the first interface and the registered function associated with a first account, the at least one resource associated with a second account;
and
provide the request to the second interface to access the at least one resource, the second interface configured to accept requests associated with the first account by the registered function and enable access to the at least one resource.

1 more element

Dependencies are inferred from the claim text.

Facts

Application: 15/384,044Filed 19 Dec 2016 · us provisional application
Priority: 29 Nov 2016
Granted: 8 Sep 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

H04L 63/101
For controlling access to devices or network resources: access control lists [ACL]
G06F 21/604
Protecting data: tools and structures for managing or administering access control systems
G06F 21/62
Protecting data: protecting access to data via a platform, e.g. using keys or access control rules
H04L 63/0245
Filtering policies: filtering by information in the payload

Family

Application62/427,725Us provisional application · filed 29 Nov 2016
US 10,771,468 B1This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key