# US 12,003,505 B2 · Custom authorization of network connected devices using signed credentials

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,505 B2
- Document ID: US12003505B2
- Status: Granted
- Kind: B2
- Application number: 17/113,858
- Filed: 2020-12-07
- Published: 2021-03-25
- Granted: 2024-06-04
- Earliest claimed: 2017-10-09
- Assignees: Amazon Technologies, Inc.
- Applicants: Amazon Technologies, Inc.
- Inventors: Ramkishore Bhattacharyya; Rameez Loladia; William Alexander Stevenson; Ashutosh Thakur; Rodrigo Diaz Martin; Andrew John Kiggins; Xin Yi Liu
- Web page: https://patentgrep.com/patent/US12003505B2

## CPC

- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 9/3247: {involving digital signatures}
- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 2209/805: Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems and methods are disclosed herein for enforcing digital signature on a token useable by a network-addressable device to invoke service calls on services of a service provider. A device platform service of the service provider may receive service calls from the network-addressable device and cause one or more operations to be performed by other services of the service provider in response to receiving a notification that the request is authentic. An authentication service analyses a fingerprint associated with a request submitted by the device and determines whether it is a match to a fingerprint generated from cryptographic authentication information provided by the user in connection with registering the network-addressable device.

## Claims

### Claim 1

A computer-implemented method, comprising:
receiving, at a service of a computing resource service provider, a request with a token indicative of a registered network-addressable device of a customer, a digital signature associated with the token and signed by a private key of a public/private key pair, and an identifier registered by the customer of the computing resource service provider in association with a public key and associated with an authorizing mechanism usable to perform an operation on the token, the token comprising at least a credential useable to authenticate the registered network-addressable device;
determining, at the service and based at least in part on the identifier, the public key, of the public/private key pair, from a plurality of public keys, wherein the plurality of public keys are associated with a plurality of registered network-addressable devices;
verifying the digital signature based at least in part on the token and the public key; and
as a result of successful verification of the digital signature, performing an authorization routine to determine whether fulfillment of the request is authorized, the authorization routine including at least performing the operation on the token based, at least in part, on the authorizing mechanism associated with the identifier and performing a comparison process based on at least performing the operation on the token.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, further comprising determining the identifier is a match to an identifier in a record of identifiers at the service.

### Claim 3 (depends on 2)

The computer-implemented method of claim 2, the method further comprising determining the identifier is a match to the identifier in the record of identifiers is a condition precedent to determining the public key.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, wherein the request is received from a network-addressable device of the customer, and the service is for interfacing the network-addressable device with other services of the computing resource service provider.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, wherein verifying the digital signature further comprises decrypting an encrypted token fingerprint.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, wherein the identifier is defined in association with obtaining the token in a registration process.

### Claim 7 (depends on 1)

The computer-implemented method of claim 1, wherein the public/private key pair is generated using an asymmetric key generation algorithm for generating cryptographic keys.

### Claim 8

A system at least partially implemented by hardware, comprising:
one or more processors; and
memory that stores computer-executable instructions that, as a result of execution by the one or more processors, cause the system to:
receive a request with a token indicative of a registered network-addressable device of a customer, a digital signature associated with the token and signed by a private key of a public/private key pair, and an identifier registered by the customer in association with a public key and associated with an authorizing mechanism usable to perform an operation on the token, the token comprising at least a credential useable to authenticate the registered network-addressable device;
determine the public key, of the public/private key pair, from a plurality of public keys, wherein the plurality of public keys are associated with a plurality of registered network-addressable devices;
verify the digital signature based at least in part on the token and the pubic key; and
as a result of successful verification of the digital signature, perform an authorization process to determine whether fulfillment of the request is authorized, the authorization routine including at least performing the operation on the token based, at least in part, on the authorizing mechanism associated with the identifier and performing a comparison process based on at least performing the operation on the token.

### Claim 9 (depends on 8)

The system of claim 8, wherein the request is received from a network-addressable device of the customer.

### Claim 10 (depends on 8)

The system of claim 8, wherein verification of the digital signature includes decrypting an encrypted token fingerprint.

### Claim 11 (depends on 8)

The system of claim 8, wherein the memory that stores the computer-executable instructions that, as a result of execution by the one or more processors, cause the system to further determine the identifier is a match to an identifier in a record of identifiers.

### Claim 12 (depends on 8)

The system of claim 8, wherein customer-defined policy information is retrieved as a result of successful verification of the digital signature, the customer-defined policy information specifying permissions for performing one or more operations in fulfillment of the request.

### Claim 13 (depends on 8)

The system of claim 8, wherein determining that the identifier is a match to the identifier in the record of identifiers is a condition precedent to determining the public key.

### Claim 14 (depends on 8)

The system of claim 8, wherein the identifier is defined by the customer in association with obtaining the token in a registration process.

### Claim 15 (depends on 8)

The system of claim 8, wherein the public/private key pair generated using an asymmetric key generation algorithm for generating cryptographic keys.

### Claim 16

A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
receive a request with a token indicative of a registered network-addressable device of a customer, a digital signature associated with the token and signed by a private key of a public/private key pair, and an identifier registered by the customer in association with a public key and associated with an authorizing mechanism usable to perform an operation on the token, the token comprising at least a credential useable to authenticate the registered network-addressable device;
determine the public key, of the public/private key pair, from a plurality of public keys, wherein the plurality of public keys are associated with a plurality of registered network-addressable devices;
verify the digital signature based at least in part on the token and the public key; and
as a result of successful verification of the digital signature, perform an authorization process to determine whether fulfillment of the request is authorized, the authorization routine including at least performing the operation on the token based, at least in part, on the authorizing mechanism associated with the identifier and performing a comparison process based on at least performing the operation on the token.

### Claim 17 (depends on 16)

The non-transitory computer-readable storage medium of claim 16, wherein the request is submitted by a network-addressable device of the customer.

### Claim 18 (depends on 16)

The non-transitory computer-readable storage medium of claim 16, wherein the public/private key pair is generated using an asymmetric key generation algorithm for generating cryptographic keys.

### Claim 19 (depends on 18)

The non-transitory computer-readable storage medium of claim 18, wherein the identifier is defined by the customer in association with obtaining the token in a registration process.

### Claim 20 (depends on 16)

The non-transitory computer-readable storage medium of claim 16, wherein customer-defined policy information is retrieved as a result of successful verification of the digital signature, the customer-defined policy information specifying permissions for performing one or more operations in fulfillment of the request.