Back to results
US 12,615,316 B1Granted
Tracing data share permission enforcement of parameters through service interfaces
AssigneeAmazon Technologies, Inc.
InventorStephen E Schmidt
Life of this patent
Estimating the term…
Abstract
Tracing of data share permission enforcement may be performed through service interfaces. A parameter of a request may be an encoded token that in decoded form describes the interface and share permissions for the parameter of the request. The encoded token may be injected as the parameter of the request and submitted via an interface of a service. Trace data reports from locations that receive the encoded token are used to generate a trace for the parameter of the interface that describes movement of the encoded token and data sharing permission enforcement.
Claims20
A system, comprising:
- at least one processor;
- and
- a memory, storing program instructions that when executed by the at least one processor,
- cause the at least one processor to:
- cause generation of an encoded token that describes an interface of a service as an entry point for a parameter and one or more share permissions for the parameter, wherein the encoded token conforms to a format of the parameter specified for the interface;
- cause inclusion of the encoded token as the parameter of a request submitted via the interface;
- receive respective trace data reports from one or more other services that received the encoded token, wherein the respective trace data reports include respective indications of data sharing permission enforcement as compared with a description of the one or more share permissions for the parameter of the request as obtained from a decoded form of the token;
- generate a trace for the parameter of the interface based on the respective trace data reports, the trace describes a movement path of the encoded token from the entry point and through the one or more other services and the respective indications of the data sharing permission enforcement as compared with the description of the one or more share permissions for the parameter of the request;
- and
- storing the trace for the parameter of the interface.
7 more elements
A method, comprising:
- injecting, as a parameter of a request submitted via an interface of a service, an encoded token that, in decoded form, describes the interface as an entry point for the parameter and one or more share permissions for the parameter of the request, wherein the encoded token conforms to a format of the parameter;
- obtaining respective trace data reports from one or more other services that received the encoded token, wherein the trace data reports include respective indications of data sharing permission enforcement as compared with a description of the one or more share permissions for the parameter of the request as obtained from the decoded form of the encoded token;
- generating a trace for the parameter of the interface based on the respective trace data reports, wherein the trace describes a movement path of the encoded token from the entry point and through the one or more other services and the respective indications of the data sharing permission enforcement as compared with the description of the one or more share permissions for the parameter of the request;
- and
- storing the trace for the parameter of the interface.
2 more elements
One or more non-transitory, computer-readable storage media, storing program instructions that when executed on or across one or more computing devices cause the one or more computing devices to implement:
- causing injection, as a parameter of a request submitted via an interface of a service, an encoded token that, in decoded form, describes the interface as an entry point for the parameter and one or more share permissions for the parameter of the request, wherein the encoded token conforms to a format of the parameter;
- receiving respective trace data reports from one or more other services that received the encoded token, wherein the respective trace data reports include respective indications of data sharing permission enforcement as compared with a description of the one or more share permissions for the parameter of the request as obtained from the decoded form of the encoded token;
- generating a trace for the parameter of the interface based on the respective trace data reports, the trace describes a movement path of the encoded token from the entry point and through the one or more other services and the respective indications of the data sharing permission enforcement as compared with a description of the one or more share permissions for the parameter of the request;
- and
- storing the trace for the parameter of the interface.
2 more elements
Dependencies are inferred from the claim text.