US 9,425,966 B1Granted

Security mechanism evaluation service

AssigneeAmazon Technologies, Inc.

InventorsNachiketh Rao Potlapally, Eric Jason Brandwine, Gregory Alan Rubin, Patrick James Ward, James Leon Irving, Jr., Andrew Paul Mikulski, Donald Lee Bailey, Jr.

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

Methods and apparatus for a security mechanism evaluation service are disclosed. A storage medium stores program instructions that when executed on a processor define a programmatic interface enabling a client to submit an evaluation request for a security mechanism. On receiving an evaluation request from a client indicating a particular security mechanism using public-key encryption, the instructions when executed, identify resources of a provider network to be used to respond. The instructions, when executed, provide to the client, one or more of: (a) a trustworthiness indicator for a certificate authority that issued a public-key certificate in accordance with the particular security mechanism; (b) a result of a syntax analysis of the public-key certificate; or (c) a vulnerability indicator for a key pair.

Claims22

Dependent claims

A system, comprising:

one or more computing devices configured to implement, via one or more hardware processors of the one or more computing devices, a network-accessible security mechanism evaluation service configured to:
receive, on behalf of a client and via one or more programmatic interfaces, an evaluation request for one or more security mechanisms, wherein the evaluation request includes at least one parameter to determine resources of a provider network to be used for evaluating the one or more security mechanisms, wherein the at least one parameter comprises one or more of:
(a) a service usage type or duration, (b) one or more types of analysis to be performed, (c) one or more time constraints, (d) one or more budget limits, or (e) identification information for the client;
and
in accordance with the evaluation request received on behalf of the client via a programmatic interface of the one or more programmatic interfaces, wherein the evaluation request indicates a particular security mechanism using public-key encryption:
identify, in accordance with the at least one parameter of the evaluation request, one or more resources of the provider network to be used to evaluate the particular security mechanism, wherein to identify the one or more resources, the service is configured to determine, based at least in part on the at least one parameter, (a) an upper bound on computing capacity to be dedicated to respond to the evaluation request, and (b) one or more compute resources of the provider network in accordance with the upper bound;
obtain, using the one or more resources:
(a) a trustworthiness indicator for a certificate authority that issued a public-key certificate in accordance with the particular security mechanism;
(b) a result of a syntax analysis of the public-key certificate;
and (c) a vulnerability indicator for a key pair used in accordance with the particular security mechanism;
and provide, to the client, an evaluation response including the trustworthiness indicator, the result of the syntax analysis, and the vulnerability indicator.

8 more elements

A method, comprising:

receiving, on behalf of a client and via one or more programmatic interfaces, an evaluation request for one or more security mechanisms, wherein the evaluation request comprises a parameter to determine resources of a provider network to be used for evaluating the one or more security mechanisms, wherein the parameter comprises one or more of:
(a) a service usage type or duration, (b) one or more types of analysis to be performed, (c) one or more time constraints, (d) one or more budget limits, or (e) identification information for the client;
and
in accordance with the evaluation request received on behalf of the client via a programmatic interface of the one or more programmatic interfaces, wherein the evaluation request indicates a particular security mechanism using public-key encryption:
identifying, in accordance with the parameter of the evaluation request, one or more resources of the provider network to be used to evaluate the particular security mechanism, wherein said identifying comprises determining, based at least in part on the parameter, (a) an upper bound on computing capacity to be dedicated to respond to the evaluation request, and (b) one or more compute resources of the provider network in accordance with the upper bound;
and providing, to the client, based at least in part on using the one or more resources, one or more of:
(a) a trustworthiness indicator for a certificate authority that issued a public-key certificate in accordance with the particular security mechanism;
(b) a result of a syntax analysis of the public-key certificate;
(c) a vulnerability indicator for a key pair used in accordance with the particular security mechanism;
or (d) a result of an IP (Internet Protocol) address mapping verification operation for a domain name included in the public-key certificate.

7 more elements

A non-transitory computer-accessible storage medium storing program instructions that when executed on one or more hardware processors implement a security mechanism evaluation service configured to:

receive, on behalf of a client and via one or more programmatic interfaces, an evaluation request for one or more security mechanisms, wherein the evaluation request comprises a parameter for determining provider network resources to use to evaluate the one or more security mechanisms, wherein the parameter comprises one or more of:
(a) a service usage type or duration, (b) one or more types of analysis to be performed, (c) one or more time constraints, (d) one or more budget limits, or (e) identification information for the client;
and
in accordance with the evaluation request received on behalf of the client via a programmatic interface of the one or more programmatic interfaces, wherein the evaluation request indicates a particular security mechanism using public-key encryption:
identify, in accordance with the parameter of the evaluation request, one or more resources of the provider network to be used to evaluate the particular security mechanism, wherein to identify the one or more resources, the service is configured to determine, based at least in part on the parameter, (a) an upper bound on computing capacity to be dedicated to respond to the evaluation request, and (b) one or more compute resources of the provider network in accordance with the upper bound;
and
provide, to the client, based at least in part on using the one or more resources, one or more of:
(a) a trustworthiness indicator for a certificate authority that issued a public-key certificate in accordance with the particular security mechanism;
(b) a result of a syntax analysis of the public-key certificate;
or (c) a vulnerability indicator for a key pair used in accordance with the particular security mechanism.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 13/826,888Filed 14 Mar 2013
Granted: 23 Aug 2016
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 9/3263
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…:…
H04L 9/302
Underlying computational problems or public-key parameters: involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes
H04L 9/3268
Involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements: using…
H04L 63/0823
For authentication of entities: using certificates