Presigned URLs and customer keying
AssigneeAmazon Technologies, Inc.
InventorsGregory Branchek Roth, Eric Jason Brandwine
Life of this patent
Estimating the term…
Abstract
Requests are pre-generated to include a cryptographic key to be used in fulfilling the requests. The requests may be encoded in uniform resource locators and may include authentication information to enable a service provider to whom the requests are submitted to determine whether the requests are authorized. The requests may be passed to various entities who can then submit the requests to the service provider. The service provider, upon receipt of a request, can verify the authentication information and fulfill the request using a cryptographic key encoded in the request.
Claims20
A non-transitory computer-readable storage medium storing instructions that are executable by one or more processors of a computer system to cause the computer system to:
- obtain, from a customer of a service provider, a signed uniform resource locator (URL) to give time-limited read or write access to a resource of the service provider, the signed URL signed by a first cryptographic key of the customer to generate a signature of the URL, the signed URL comprising information indicating an operation to be performed, the operation comprising storing or retrieving data, expiration information to indicate when the signed URL expires to no longer be usable for submission to access the resource, and a path to the resource, wherein the first cryptographic key is a private key;
- add an unsigned portion to the signed URL, the unsigned portion comprising a second encryption key;
- and
- use the signed URL comprising the unsigned portion to access the resource.
A system, comprising:
- one or more processors;
- and
- memory storing instructions that are executable by the one or more processors to cause the system to:
- obtain, from a customer of a service provider, a signed uniform resource locator (URL) to give time-limited read or write access to a resource of the service provider, the signed URL signed by a first encryption key to generate a signature of the URL, the signed URL comprising information indicating an operation to be performed, the operation comprising storing or retrieving data, expiration information to indicate when the signed URL expires to no longer be usable for submission to access the resource, and a path to the resource, wherein the first encryption key is a private key;
- add an unsigned portion to the signed URL, the unsigned portion comprising a second encryption key;
- and
- use the signed URL comprising the unsigned portion to access the resource.
A computer-implemented method, comprising:
- obtaining, from a customer of a service provider, a signed uniform resource locator (URL) to give time-limited read or write access to a resource of the service provider, the signed URL signed by a first cryptographic key of the customer to generate a signature of the URL, the signed URL comprising information indicating an operation to be performed, the operation comprising storing or retrieving data, expiration information to indicate when the signed URL expires to no longer be usable for submission to access the resource, and a path to the resource, wherein the first cryptographic key is a private key;
- adding an unsigned portion to the signed URL, the unsigned portion comprising a second cryptographic key;
- and
- using the signed URL comprising the unsigned portion to access the resource.
Dependencies are inferred from the claim text.