Resource locators with keys
AssigneeAmazon Technologies, Inc.
InventorsGregory Branchek Roth, Eric Jason Brandwine
Life of this patent
Estimating the term…
Abstract
Requests are pre-generated to include a cryptographic key to be used in fulfilling the requests. The requests may be encoded in uniform resource locators and may include authentication information to enable a service provider to whom the requests are submitted to determine whether the requests are authorized. The requests may be passed to various entities who can then submit the requests to the service provider. The service provider, upon receipt of a request, can verify the authentication information and fulfill the request using a cryptographic key encoded in the request.
Claims21
A non-transitory computer-readable storage medium storing instructions that are executable by one or more processors of a computer system to cause the computer system to:
- create a signed uniform resource locator (URL) to give time-limited read or write access to a resource, wherein creating the signed URL comprises:
- constructing a first portion of the URL to be signed, wherein the first portion of the URL to be signed comprises information indicating an operation to be performed, the operation comprising storing or retrieving data, expiration information to indicate when the signed URL expires to no longer be usable for submission to access the resource, and a path to the resource;
- signing the first portion of the URL with a private key to generate a signature of the first portion of the URL;
- constructing the URL to refer to the resource, wherein the URL comprises the expiration information, and the signature;
- and
- providing the signed URL to an entity;
- and
- wherein a customer-supplied encryption key from the entity is added to a second portion of the URL, the second portion of the URL is unsigned by the private key, and the customer-supplied encryption key is not specified in the first portion of the URL that is signed.
A system, comprising:
- one or more processors;
- and
- memory storing instructions that are executable by the one or more processors to cause the system to:
- obtain a request comprising a signed uniform resource locator (URL) with a customer-supplied encryption key, wherein the signed URL is created to give time-limited read or write access to a resource, and wherein the signed URL comprises:
- a first portion of the URL to be signed, wherein the portion of the URL to be signed comprises information indicating an operation to be performed, the operation comprising storing or retrieving data, expiration information to indicate when the signed URL expires to no longer be usable for submission to access the resource, and a path to the resource;
- a digital signature generated by signing the first portion of the URL with a private key to generate a signature of the first portion of the URL;
- and
- a reference to the resource, wherein the URL comprises the expiration information, and the signature;
- use a public key corresponding to the private key to verify the signature;
- and
- on a condition that the signature is verified, use the customer-supplied encryption key to perform the operation to fulfill the request, wherein a second portion of the URL includes the customer-supplied encryption key, and the second portion of the URL is unsigned by the private key.
A computer-implemented method, comprising:
- obtaining a request comprising a signed uniform resource locator (URL) along with a customer-supplied encryption key, wherein the signed URL is created to give time-limited read or write access to a resource, and wherein the signed URL comprises:
- a first portion of the URL to be signed, wherein the first portion of the URL to be signed comprises information indicating an operation to be performed, the operation comprising storing or retrieving data, expiration information to indicate when the signed URL expires to no longer be usable for submission to access the resource, and a path to the resource;
- a digital signature generated by signing the first portion of the URL with a private key to generate a signature of the first portion of the URL;
- a reference to the resource, wherein the first portion of the URL comprises the expiration information, and the signature;
- and
- a second portion that is unsigned by the private key, the second portion including the customer-supplied encryption key;
- using a public key corresponding to the private key to verify that the signature is valid;
- and
- using the customer-supplied encryption key to perform the operation to fulfill the request.
Dependencies are inferred from the claim text.