US 11,695,569 B2 · Contribution signatures for tagging

Abstract

A request to add tags (e.g., labels, key-value pairs, or metadata) to resources can be digitally signed by the entity making the request, such that the source can be verified and an authorization determination made for each tag. For a request involving multiple services (or entities) that can each add tags, any tag added by a service can be included in the request and digitally signed by that service. Each service processing the request can also digitally sign the request before forwarding, so that each service signs a version of the request, which includes elements signed by other services earlier in the request chain. When the request is received to a tagging service, the service ensures that every tag was digitally signed by the appropriate authorized entity or service, and validates the signatures to ensure that no data was modified or omitted, before adding the tags to the designated resource(s).

Claims20

Dependent claims

A computer-implemented method, comprising:

determining that a user is authenticated for a user account in a computing resource environment;
determining at least one resource and at least one service associated with the user account;
enabling a first signed request to comprise signed tagging metadata, at least one second signed request, and at least one signed additional metadata, the first signed request and the at least one second signed request associated with different entities;
validating a first signature for the first signed request and at least one second signature for the at least one second signed request;
and
provisioning the at least one resource with access to the at least one service by tagging the at least one resource using metadata associated with the signed tagging metadata and the at least one signed additional metadata.

3 more elements

A system, comprising:

at least one processor;
and
memory including instructions that, when executed by the at least one processor, cause the system to:
determine at least one resource and at least one service associated with a user account of a user authenticated in a computing resource environment;
enabling a first signed request to comprise signed tagging metadata, at least one second signed request, and at least one signed additional metadata, the first signed request and the at least one second signed request associated with different entities;
validating signatures for the first signed request and for the at least one second signed request;
and
provisioning the at least one resource with access to the at least one service by tagging the at least one resource using metadata associated with the signed tagging metadata and the at least one signed additional metadata.

5 more elements

A non-transitory computer readable medium comprising instructions that when executed by at least one processor cause the at least one processor to:

determine at least one resource and at least one service associated with a user account of a user authenticated in a computing resource environment;
enabling a first signed request to comprise signed tagging metadata, at least one second signed request, and at least one signed additional metadata, the first signed request and the at least one second signed request associated with different entities;
validating signatures for the first signed request and for the at least one second signed request;
and
provisioning the at least one resource with access to the at least one service by tagging the at least one resource using metadata associated with the signed tagging metadata and the at least one signed additional metadata.

2 more elements

Dependencies are inferred from the claim text.

Facts

Application

17/212,915Filed 25 Mar 2021 · continuation

Priority

22 Dec 2015

Published

US 2021/0211304 A18 Jul 2021

Granted

4 Jul 2023

Term ends

Not estimatedThe source records don’t support an estimate.

Classification9 codes

H04L 9/3247
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…:…
G06F 12/1408
Protection against unauthorised use of memory or access to memory: by using cryptography
G06F 21/604
Protecting data: tools and structures for managing or administering access control systems
G06F 21/64
Protecting data: protecting data integrity, e.g. using checksums, certificates or signatures

Family

Application14/979,308Parent of this continuation · filed 22 Dec 2015

Application16/726,734Parent of this continuation · filed 24 Dec 2019

US 10,536,277 B1Parent of this continuation · filed 14 Jan 2020

US 2021/0211304 A1Pre-grant publication · published 8 Jul 2021

US 10,972,288 B2Parent of this continuation

US 2020/0136834 A1Published application

US 11,695,569 B2This patent

From the US filing history. Foreign family members aren’t listed.

Contribution signatures for tagging

Life of this patent

Contribution signatures for tagging

Life of this patent

Abstract

Claims20