Host identity bootstrapping
AssigneeAmazon Technologies, Inc.
InventorsJesper M. Johansson, Matthew T. Corddry, Tom F. Hansen, Luke F. Kearney
Life of this patent
Estimating the term…
Abstract
Automated provisioning of hosts on a network with reasonable levels of security is described in this application. A certificate management service (CMS) on a host, one or more trusted agents, and a public key infrastructure are utilized in a secure framework to establish host identity. Once host identity is established, signed encryption certificates may be exchanged and secure communication may take place.
Claims21
One or more non-transitory computer-readable storage media storing instructions that when executed instruct a processor of an infrastructure coordination server to perform acts comprising:
- receiving an enrollment request from a host;
- mapping the host to a certificate profile;
- determining a validity of a host identity associated with the host;
- obtaining, without human intervention, a personal identification number (PIN) from a public key infrastructure (PKI);
- mapping multiple certificate authorities (CAs) to the host to accommodate for a failure of at least one of the multiple CAs;
- providing, without human intervention, the PIN and CA connection information to the host;
- signing an encryption certificate using a private key;
- issuing the signed encryption certificate to the host;
- sending, to the host, a new certificate;
- revoking the signed encryption certificate;
- and
- renewing the new certificate.
A method comprising:
- under control of one or more computing devices having computer-executable instructions:
- receiving an enrollment request from a host;
- mapping the host to a certificate profile, the certificate profile identifying one or more types of certificates that are available to the host;
- determining a validity of a host identity associated with the host;
- obtaining, without human intervention, a personal identification number (PIN) from a public key infrastructure (PKI) based at least partly on determining the validity of the host identity;
- mapping multiple certificate authorities (CAs) to the host to accommodate for a failure of at least one of the multiple CAs;
- providing, without human intervention, the PIN and CA connection information to the host;
- signing an encryption certificate using a private key;
- issuing the signed encryption certificate to the host based at least in part on the PIN and the CA connection information;
- sending, to the host, a new certificate;
- revoking the certificate;
- and
- renewing the new certificate.
A method comprising:
- under control of one or more computing devices having computer-executable instructions:
- receiving an enrollment request from a host;
- determining a validity of a host identity associated with the host;
- obtaining, without human intervention, a personal identification number (PIN) from a public key infrastructure (PKI), as a result of, determining the validity of the host identity;
- mapping multiple certificate authorities (CAs) to the host to accommodate for a failure of at least one of the multiple CAs;
- providing, without human intervention, the PIN and CA connection information to the host, the CA connection information being associated with at least one of the multiple CAs;
- signing an encryption certificate using a private key;
- issuing the signed encryption certificate to the host based at least in part on validating the PIN and the CA connection information received from the host;
- sending, to the host, a new certificate;
- revoking the certificate;
- and
- renewing the new certificate.
Dependencies are inferred from the claim text.