Device authorizations using certificates and service access policy templates
AssigneeAmazon Technologies, Inc.
InventorsCalvin Yue-Ren Kuo, Robert P. Cochran
Life of this patent
Estimating the term…
Abstract
Technology is described for a device registration service for a local computing environment. The device registration service may provide one or more computing hubs within the local computing environment with robust means to authenticate or verify the authority of a computing device (e.g., a computer, a server, a mobile device, smart phone, a tablet), and/or other devices requesting to access to the local computing environment. The device registration service provided by the one or more computing hubs may be used in addition to, in place of, or as a backup to a device management and provisioning services provided remotely from the local computing environment using a service provider environment.
Claims20
A system, comprising:
- at least one processor;
- and
- at least one memory device including instructions that, when executed by the at least one processor, cause the system to:
- receive, at a computing hub, a device certificate in response to a request by a device to join a set of connected devices, wherein the computing hub is included in a local network having the set of connected devices which connect to the computing hub to access services provided by the computing hub;
- determine that the device certificate includes a trust anchor in common with a computing hub certificate associated with the computing hub;
- determine that device identification information included in the device certificate is usable with a set of service access policy templates;
- determine service access for the device based at least in part on substituting the device identification information included in the device certificate for a variable in a first service access policy template in the set of service access policy templates;
- and
- authorize the device to access, via the computing hub, one or more services identified in the first service access policy template in the set of service access policy templates.
A method, comprising:
- authenticating, by a computing hub, a device requesting access to a local environment using a certificate received from the device to determine whether the certificate authorizes the device to access the local environment;
- determining that a portion of the certificate is usable with a set of service access policy templates in the computing hub;
- determining a first set of authorizations having a first scope of authorized communication for the device within the local environment based at least in part on the portion of the certificate used to modify a first service access policy template in the set of service access policy templates;
- and
- authorizing the device to access a resource identified in the first service access policy template.
A non-transitory computer-readable medium including instructions that, as a result of execution by one or more processors, cause the one or more processors to perform processing, comprising:
- receiving, at a first device, a certificate from a second device requesting to access within a local environment to the first device, wherein the first device is included in the local environment to provide one or more services;
- authenticating the second device to the first device by determining that the certificate authorizes the second device to access the local environment;
- determining that device identification information in the certificate is mapped to a set of authorizations that authorize the second device to communicate within the local environment with the first device using a set of service access policy templates;
- substituting a device identifier from the device identification information into a device identifier variable in a service access policy template of the set of service access policy templates;
- determining a first set of authorizations having a first scope of authorized service access using the device identification information in the certificate and the set of service access policy templates;
- and
- authorizing the second device with the first set of authorizations to access one or more of the services provided by the first device identified in the set of service access policy templates.
Dependencies are inferred from the claim text.