US 11,146,379 B1Granted

Credential chaining for shared compute environments

AssigneeAmazon Technologies, Inc.

InventorsChance Ackley-Smith, Dominic Corona

Life of this patent

Estimating the term…

Loading patent…

Abstract

A transform execution service obtains a first request from a client device of a customer to execute a set of instructions. In response to the request, the service provides the set of instructions and a first set of credentials to a cluster of computer nodes. The cluster submits, to the service, a second request to assume an identity of the customer, where the second request demonstrates access to the first set of credentials. In response to the second request, the service provides a second set of credentials to cause the cluster to use the second set of credentials to access an identity management service to obtain a third set of credentials to exercise a set of permissions associated with the customer. The cluster uses the third set of credentials to exercise a subset of the set of permissions to access a set of resources to execute the set of instructions.

Claims20

Dependent claims

A computer-implemented method, comprising:

obtaining a first request to execute a set of instructions, the set of instructions being executable using at least a set of resources provided by a remote service;
in response to the first request and based on the set of instructions, selecting a cluster of compute nodes;
providing, to the cluster of compute nodes, the set of instructions and a first set of credentials corresponding to a pairing of an identifier corresponding to a requestor that submitted the first request to the set of instructions;
obtaining, from the cluster of compute nodes, a second request to assume a first identity of the requestor, the second request including an assertion that the cluster of compute nodes has access to the first set of credentials;
providing, to the cluster of compute nodes, a second set of credentials associated with the first identity of the requestor, the second set of credentials usable by the cluster of the compute nodes to assume the first identity of the requestor;
and
providing the second set of credentials to an identity management service associated with the set of resources to cause the identity management service to:
authenticate, using the second set of credentials, a third request from the cluster of compute nodes to assume a role associated with the requestor, the role corresponding to a set of permissions to access the set of resources by assumption of the role;
and
provide, to the cluster of compute nodes, a third set of credentials to cause the cluster of compute nodes to assume the role and access the set of resources to execute the set of instructions.

7 more elements

A system, comprising:

one or more processors;
and
memory storing computer-executable instructions that are executable by the one or more processors to cause the system to:
obtain a first request to execute a set of instructions associated with a client, the first request including a first set of credentials corresponding to a pairing of an identifier corresponding to the client;
identify a cluster of computer nodes to execute the set of instructions;
determine, based on the set of instructions, a set of resources provided by a remote service to execute the set of instructions;
obtain, from the cluster of compute nodes, a second request to assume a first identity of the client, the second request including an assertion that the cluster of compute nodes has access to the first set of credentials;
provide, to the cluster of compute nodes, a second set of credentials associated with the first identity of the client, the second set of credentials usable by the cluster of the compute nodes to assume the first identity of the client;
store a record of permissions granted to the cluster of compute nodes by an entity associated with the set of resources to allow the cluster of computer nodes to access the set of resources, the record of permissions providing access to the set of resources by assumption of a role associated with the client;
provide, to the cluster of compute nodes, a third set of credentials to cause the cluster of compute nodes to assume the role and access the set of resources to execute the set of instructions;
and
during execution of the set of instructions, confirm that the cluster of computer nodes has the permissions required to access the set of resources needed to execute the set of instructions.

9 more elements

A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:

provide, to a cluster of compute nodes, in response to a first request to execute a set of instructions, the set of instructions and a first set of credentials corresponding to a pairing of an identifier corresponding to an entity submitting the first request;
obtain a second request to assume an identity of the entity that submitted the first request, the second request demonstrating access to the first set of credentials;
determine, based on the first set of credentials, whether the second request is valid;
and
as a result of the second request being valid, provide a second set of credentials associated with the identity to cause the cluster of compute nodes to use the second set of credentials to:
obtain, from an identity management service, a third set of credentials to exercise a set of permissions associated with the entity;
and
use the third set of credentials to access a set of resources in accordance with at least a subset of the set of permissions.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/588,743Filed 30 Sep 2019
Granted: 12 Oct 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

H04L 9/006
Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols: involving public key…
G06F 21/335
Using certificates: for accessing specific resources, e.g. using Kerberos tickets
H04L 9/0825
Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely…: using…
H04L 9/0866
Generation of secret information including derivation or calculation of cryptographic keys or passwords: involving user or device identifiers,…