# US 12,192,358 B1 · Identity token for accessing computing resources > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,358 B1 - Document ID: US12192358B1 - Status: Granted - Kind: B1 - Application number: 17/478,499 - Filed: 2021-09-17 - Granted: 2025-01-07 - Earliest claimed: 2017-08-24 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Rameez Loladia - Web page: https://patentgrep.com/patent/US12192358B1 ## CPC - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - G06F 21/33: using certificates - G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards - H04L 9/08: Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 9/3247: {involving digital signatures} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/102: {Entity profiles} - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - H04W 12/06: Authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A technology is described for device communication with computing regions. An example method may include receiving at a first computing region a request for a computing resource. In response to receiving the request, a device associated with the request may be authenticated using authentication credentials for the device. An identity token that indicates permission for the device to access the computing resource in a second computing region may be generated and the identity token and instructions to connect to the second computing region may be provided to the device. The device may present the identity token to the second computing region in order to access the computing resource in the second computing region. ## Claims ### Claim 1 A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to: receive, from a device, a first request to access a computing resource in a first computing region, wherein the device is registered with the first computing region; authenticate the device at the first computing region using authentication credentials for the device; determine that the computing resource is unavailable in the first computing region but is available in a set of computing regions; select a second computing region from the set of computing regions based at least in part on a geolocation and a device policy of the device, wherein: the device policy indicates that device is unregistered with the second computing region but has permission to request access; and the geolocation indicates that the second computing region is in closer proximity to the device than another computing region of the set of computing regions; and as a result of selecting the second computing region: generate an identity token signed using an encryption key, wherein the identity token indicates permission for the device to access the computing resource in the second computing region; and provide the identity token and instructions to access the second computing region to the device, wherein the device presents the identity token to the second computing region with a second request to access the computing resource in the second computing region. ### Claim 2 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the executable instructions that, as a result of being executed by the one or more processors, cause the computer system to receive the encryption key from a key management service configured to provide the encryption key to the first computing region and the second computing region. ### Claim 3 (depends on 2) The non-transitory computer-readable storage medium of claim 2, wherein the key management service is further configured to periodically generate the encryption key and push the encryption key to the first computing region and the second computing region to synchronize the encryption key at the first computing region and the second computing region. ### Claim 4 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the encryption key is stored in a secure key repository. ### Claim 5 (depends on 1) The non-transitory computer-readable storage medium of claim 1, wherein the executable instructions further include instructions that, as a result of being executed by the one or more processors, cause the computer system to: authenticate the identity token; and determine that the device is authorized to have access to the second computing region based at least in part on the authentication of the identity token. ### Claim 6 (depends on 5) The non-transitory computer-readable storage medium of claim 5, wherein the authentication of the identity token is based at least in part on the encryption key. ### Claim 7 A computer implemented method, comprising: receiving, from a device that is registered in a first computing region, a request to access a computing resource in the first computing region; authenticating the device associated with the request at the first computing region using authentication credentials for the device; determining that the computing resource is unavailable in the first computing region but is available in a plurality of computing regions; identifying a second computing region from the plurality of computing regions based at least in part on a device policy received from the device and proximity of the device to the second computing region compared to the proximity to the plurality of computing regions, wherein the device policy includes a permission that permits the device to request access despite being unregistered in the second computing region; and as a result of identifying the second computing region: generating an identity token signed using an encryption key, wherein the identity token indicates permission for the device to access the second computing region; and providing the identity token and instructions to access the second computing region to the device, wherein the device presents the identity token to the second computing region. ### Claim 8 (depends on 7) The method of claim 7, further comprising: authenticating the identity token; and as a result of authenticating the identity token, indicating that the device is authorized to transmit a second request to access the computing resource in the second computing region. ### Claim 9 (depends on 7) The method of claim 7, wherein the comparison used to identify the second region is executed based, at least in, part on location coordinates or location name of the device. ### Claim 10 (depends on 7) The method of claim 7, further comprising determining that the second computing region has capacity to handle the request. ### Claim 11 (depends on 7) The method of claim 7, wherein at least two of the plurality of computing regions includes the computing resource. ### Claim 12 (depends on 7) The method of claim 7, wherein the identity token is a temporary token that expires after a predetermined amount of time, after a one-time communication session with the second computing region, or after an occurrence of an event. ### Claim 13 (depends on 7) The method of claim 7, further comprising determining that a device policy for the device includes an operation permission that allows the device to request the computing resource to perform an operation requested by the device. ### Claim 14 A system comprising: at least one hardware processor; and memory including instructions that, as a result of being executed by the one or more processors, cause the system to: receive, from a device, a request to access a computing resource in a first computing region, wherein the device is registered in the first computer region; authenticate the device associated with the request at the first computing region using authentication credentials for the device; determine that the computing resource is unavailable in the first computing region but is available in a group of computing regions; selecting a second computing region among the group of computing regions based at least in part on a location of the device and a device policy received from the device, wherein the device policy indicates that the device is unregistered in the second computing region yet able to request access to the second computing region, the location of the device indicating that the second computing region is in closer proximity to the device than another computing region of the group of computing regions; and as a result of selecting the second computing region: generate an identity token signed using an encryption key, wherein the identity token indicates permission for the device to access the second computing region; and provide the identity token and instructions to access the second computing region to the device, wherein the device presents the identity token to the second computing region. ### Claim 15 (depends on 14) The system of claim 14, further comprising instructions that, as a result of being executed by the one or more processors, cause the system to determine whether to migrate the device from the first computing region to the second computing region based at least in part on a transfer criteria for transferring device data. ### Claim 16 (depends on 15) The system of claim 15, wherein the transfer criteria comprises at least one of a geolocation of the device, a latency value associated with transferring the device data to the second computing region, or a cost associated with transferring the device data to the second computing region. ### Claim 17 (depends on 15) The system of claim 15, further comprising instructions that, as a result of being executed by the one or more processors, cause the system to: generate a registration record in a device registry for the second computing region; and as a result of generating the registration record in the device registry for the second computing region, transmit a request to remove a registration record for the first computing region. ### Claim 18 (depends on 14) The system of claim 14, further comprising instructions that, as a result of being executed by the one or more processors, cause the system to generate a determination of distributing requests received at the first computing region between the first computing region and the second computing region. ### Claim 19 (depends on 18) The system of claim 18, wherein the determination of distributing requests to the second computing region is based at least in part on negotiations between the first computing region and the second computing region. ### Claim 20 (depends on 18) The system of claim 18, wherein the determination of distributing requests to the second computing region is based at least in part on load balancing among multiple regions, a volume of network traffic at the first computing region, or a performance degradation of a computing resource at the first computing region.