System and methods for securing role credentials
AssigneeAmazon Technologies, Inc.
InventorsJasmeet Chhabra, Rebecca Claire Weiss, Eric Robert Northup
Life of this patent
Estimating the term…
Abstract
A customer in a computing resource provider environment launches a virtual machine with an associated role. A key is generated that is specific to the instance and the role. An enclave is generated specifically for the virtual machine to securely store the key such that the virtual machine uses the enclave to sign requests pursuant to the role to access one or more web services in the environment.
Claims20
A system, comprising:
- one or more processors;
- and
- memory including instructions that, as a result of being executed by the one or more processors, cause the system to:
- obtain a request to launch an instance to have privileges associated with a role specified in the request;
- cause a hypervisor to launch the instance on a hardware server;
- cause a trusted execution environment to be instantiated for the instance on the hardware server based at least in part on the instance being associated with the role;
- as a result of verifying the trusted execution environment based, at least in part, on information obtained from the hypervisor, generate a key specific to the instance and the role;
- store the key in the trusted execution environment to protect the key for the instance;
- and
- cause the trusted execution environment to use the key to decrypt encrypted role credentials provided to the instance to sign requests pursuant to the role.
A method, comprising:
- obtaining a request for an instance, the instance to be able to exercise a set of privileges;
- causing a hypervisor to instantiate the instance on a hardware server;
- associating a trusted execution environment with the instance;
- and
- storing a key specific to the instance and usable to decrypt encrypted role credentials provided to the instance and to exercise the set of privileges in the trusted execution environment to allow the instance to cause the trusted execution environment to perform cryptographic operations on behalf of the instance to exercise the set of privileges, wherein the key is derived as a result of verifying the trusted execution environment using information from the hypervisor.
A non-transitory computer-readable storage medium comprising executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
- instantiate a trusted execution environment to cause the trusted execution environment to be specifically associated with an instance associated with a set of permissions, the trusted execution environment to be separate from the instance;
- in response to sending information usable to verify the trusted execution environment to a service, obtain, from the service, a key that is generated based, at least in part, on the information;
- obtain an encrypted role credential specific to the instance and the set of permissions;
- and
- store the key in the trusted execution environment to allow the trusted execution environment to use the key to decrypt the encrypted role credential to allow the instance to exercise the set of permissions.
Dependencies are inferred from the claim text.