Secure authorization for sensitive information
AssigneeAmazon Technologies, Inc.
InventorDaniel Morgan Harris
Life of this patent
Estimating the term…
Abstract
Techniques for securing access to protected resources are provided. In the method and apparatus, an access key and proof of successful completion of a first authentication is obtained in connection to a request. The proof of completion of the first authentication and the access key are verified. The access key is then used to generate a determination that information in the access key indicates that a second authentication was successfully completed prior to allowing the request to be fulfilled.
Claims20
A computer-implemented method, comprising:
- receiving a first request that indicates an intent to access a resource, the first request including a first bearer token;
- verifying that the first bearer token indicates authorization to fulfill the first request associated with a client computer system responsible for providing the first request;
- generating an access key including the first bearer token and information that indicates an interval of time during which the access key is valid;
- encrypting the access key to obtain an encrypted key;
- providing the encrypted key in response to the first request;
- receiving a second request to access the resource, the second request identifying the resource and comprising the encrypted key and a second bearer token;
- decrypting the encrypted key to result in a decrypted key;
- verifying that the second request is received within the interval of time, that the second bearer token indicates authorization to fulfill the second request, and that the first bearer token and second bearer token are different;
- and
- providing access to the resource to fulfill the second request.
A system, comprising:
- one or more processors;
- and
- memory that stores computer-executable instructions that, as a result of being executed by the one or more processors, cause the system to:
- obtain a first request for access at a future interval of time, the first request including first proof of successful completion of a first authentication;
- generate an encrypted access key;
- provide, in response to the first request, the encrypted access key;
- obtain, during the future interval of time, a second request including the encrypted access key and second proof of successful completion of a second authentication;
- verify the second proof of successful completion of the second authentication based at least in part on the second proof of successful completion of the second authentication being different from the first proof of successful completion of the first authentication;
- determine that the first request and the second request are from a same requestor computing system based at least in part on the encrypted access key;
- and
- allow the second request to be fulfilled.
A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
- receive a first token from at least one authorization server;
- transmit a first request via a network to at least one resource server, the first request indicating an intent to access protected information, the first request to include the first token indicating authorization to access the protected information;
- receive, from the at least one resource server via the network in response to the first request, an acknowledgement to access the protected information during a future interval of time;
- in response to the acknowledgement, transmit a second request requesting a second token different from the first token from the at least one authorization server;
- obtain, in response to the second request, the second token from the at least one authorization server;
- and
- transmit, to the at least one resource server via the network, a third request to access the protected information during the future interval of time, the third request including the acknowledgement, the first token, and the second token.
Dependencies are inferred from the claim text.