Federated key management
AssigneeAmazon Technologies, Inc.
InventorsGregory Branchek Roth, Matthew James Wren, Eric Jason Brandwine, Brian Irl Pratt
Life of this patent
Estimating the term…
Abstract
A system uses information submitted in connection with a request to determine if and how to process the request. The information may be electronically signed by a requestor using a key such that the system processing the request can verify that the requestor has the key and that the information is authentic. The information may include information that identifies a holder of a key needed for processing the request, where the holder of the key can be the system or another, possibly third party, system.
Claims20
A first computer system, comprising:
- one or more processors;
- and
- memory including instructions that, when executed by the one or more processors, cause the first computer system to:
- store a set of one or more keys on the first computer system in association with a first key stored on an external third-party computer system;
- receive a request that requires use of the first key for fulfillment;
- and
- in response to the first key being held by the external third-party computer system, cause the external third-party computer system to:
- determine to authorize access to the first key, wherein one or more operations are performed in response to the determination to authorize access to the first key.
One or more non-transitory computer-readable storage media, having stored thereon instructions that, when executed by one or more processors of a computing device, cause the computing device to:
- store a first key in association with an identifier for a second key, wherein the second key is stored on an external third-party computer system;
- and
- send a first request to the external third-party computer system, the first request based, at least in part, on the identifier for the second key and a second request that requires use of the second key for fulfillment, wherein the first request causes the external third-party computer system to:
- determine to authorize access to the second key, wherein one or more operations are performed based at least in part on the determination to authorize access to the second key.
A computer-implemented method, comprising:
- associating a first key stored on a first computer system with an identifier for a second key, wherein the second key is stored on an external third-party computer system;
- and
- sending a first request to the external third-party computer system based, at least in part, on the identifier for the second key and a second request received by the first computer system that requires use of the second key for fulfillment, wherein the first request causes the external third-party computer system to:
- determine to authorize access to the second key, wherein one or more operations requiring authorization are performed based, at least in part, on the determination to authorize access to the second key.
Dependencies are inferred from the claim text.