# US 9,521,032 B1 · Server for authentication, authorization, and accounting > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,521,032 B1 - Document ID: US9521032B1 - Status: Granted - Kind: B1 - Application number: 13/829,383 - Filed: 2013-03-14 - Granted: 2016-12-13 - Earliest claimed: 2013-03-14 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Timothy Craig Worsley - Web page: https://patentgrep.com/patent/US9521032B1 ## CPC - H04L 63/0892: {by using authentication-authorization-accounting [AAA] servers or protocols} - G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals - G06F 21/305: {by remotely controlling device operation} - G06F 21/31: User authentication - G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets} - G06F 21/41: where a single sign-on provides access to a plurality of computers - G06F 2221/2101: Auditing as a secondary aspect - H04L 63/101: {Access control lists [ACL]} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/71: Hardware identity - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract In some implementations, a client device includes a client identifier embedded into a firmware of the client device. A server may register a service with a global authentication, authorization, and account (AAA) server. The client device may request permission to access the service. The request may be signed using a client signature that is based on the identifier. The global AAA server may send the request to the server and the server may determine whether to grant the client device permission. If the global AAA server determines that the server has granted the client device permission, the global AAA server may provide server credentials to the client device and client credentials to the server. The client device may sign a request to connect to the service using the client signature. The server may grant the request in response to authenticating the request using the client signature. ## Claims ### Claim 1 A global authentication, authorization, and accounting (AAA) server, comprising: one or more processors; and one or more non-transitory computer readable media storing instructions that are executable by the one or more processors to perform acts comprising: receiving a first service request from a client device, the first service request requesting access to a service provided by a server, the first service request including a client signature added by a network interface controller of the client device that monitors outgoing data sent from the client device, the client signature based at least in part on a client identifier embedded in the network interface controller, wherein attempting to modify the client identifier causes the client device to be rendered inoperable; authenticating the client device; determining that the client device is excluded from a blacklist that includes banned devices, the blacklist based at least in part on determining a number of denials, by the server, of previous requests for the service; sending an access request to the server, the access request including information associated with the first service request from the client device; receiving a service response from the server, the service response indicating that the first service request from the client device was approved by a provider of the service; and enabling the client device to access the service based at least in part on the service response indicating that the first service request was approved. ### Claim 2 (depends on 1) The global AAA server of claim 1, the acts further comprising: receiving, from the client device, a connection request to connect to the service, the connection request signed using a private key; sending the connection request to the server; determining that the server approved the connection request; and notifying the client device that the connection request was approved. ### Claim 3 (depends on 2) The global AAA server of claim 2, the acts further comprising: receiving a server log from the server indicating that the server approved the connection request from the client device. ### Claim 4 (depends on 1) The global AAA server of claim 1, wherein before sending the access request to the server the acts further comprise: determining that the client device is permitted to access the server; and sending the access request to the server. ### Claim 5 (depends on 1) The global AAA server of claim 1, wherein the first service request from the client device is approved by the server based at least in part on the client signature associated with the first service request. ### Claim 6 One or more non-transitory computer readable media storing instructions that are executable by one or more processors to perform acts comprising: receiving a registration request to register a service, the registration request signed using a server signature that is based at least in part on a server identifier embedded in a network interface controller of a server hosting the service, the network interface controller including logic to render the server inoperable based at least in part on detecting an attempt to modify the server identifier; determining that the server is a trusted device based at least in part on the server signature; registering the service; receiving, from a client device, a service request requesting permission to access the service, the service request signed using a client signature that is based at least in part on a client identifier embedded in a network interface controller of the client device; determining that the client device is excluded from a blacklist that includes banned devices, the blacklist based at least in part on determining a number of denials, by the server, of previous service requests for the service; and sending the service request to the server hosting the service. ### Claim 7 (depends on 6) The one or more non-transitory computer readable media of claim 6, the acts further comprising: determining that the server has approved the service request; and sending a server fleet identifier to the client device, the server fleet identifier enabling a plurality of client devices associated with a client fleet identifier to access one or more services provided by a server fleet associated with the server fleet identifier. ### Claim 8 (depends on 7) The one or more non-transitory computer readable media of claim 7, the acts further comprising: receiving, from the client device, a connection request to connect to the service, the connection request signed using the client signature; sending the connection request to the server; determining that the server has approved the connection request; and enabling the client device to connect to the service. ### Claim 9 (depends on 8) The one or more non-transitory computer readable media of claim 8, wherein the server approves the connection request from the client device based at least in part on authenticating the client signature included in the connection request. ### Claim 10 (depends on 8) The one or more non-transitory computer readable media of claim 8, wherein enabling the client device to connect to the service comprises providing, to the client device, a network address for connecting to the service. ### Claim 11 (depends on 8) The one or more non-transitory computer readable media of claim 8, the acts further comprising: generating and storing a client log after the client device sends the connection request; retrieving a server log from the server after the server approves the connection request; and comparing the client log with the server log to determine whether the client device is misusing the server. ### Claim 12 (depends on 6) The one or more non-transitory computer readable media of claim 6, wherein: the server identifier is embedded in a firmware of a network interface controller component of the server; and the client identifier is embedded in a firmware of a second network interface controller component of the server. ### Claim 13 A method, comprising: under control of one or more processors configured with specific instructions, the method comprising: registering, at a global authentication, authorization, and accounting (AAA) server, at least one service provided by a server fleet comprising one or more servers; sending, to a service provider associated with the server fleet, a service request requesting permission for a client device of a client fleet to connect to the at least one service, the service request including a client signature that is based at least in part on a client identifier embedded in a firmware of the client device, wherein the firmware of the client device includes logic to render the client device inoperable based at least in part on detecting an attempt to modify the client identifier; and determining that the service provider has approved the service request; providing client credentials including a client key to the server fleet to enable each server of the server fleet to authenticate communications signed by each client device; and providing server credentials including a server key to the client fleet to enable each client device of the client fleet to authenticate communications signed by each server. ### Claim 14 (depends on 13) The method of claim 13, wherein registering the service hosted by the server comprises: receiving a registration request from the server to register the at least one service, the registration request including a server signature based at least in part on a server identifier that is embedded in a firmware of the server; determining that the server is authorized to provide the at least one service based at least partly on the server signature; and registering the service hosted by the server. ### Claim 15 (depends on 13) The method of claim 13, wherein the server determines whether to approve the service request based at least in part on the client signature included in the service request. ### Claim 16 (depends on 13) The method of claim 13, wherein the service request is received from the client device before the service request is sent to the server. ### Claim 17 (depends on 13) The method of claim 13, wherein the client signature is automatically added by a firmware of a network interface controller of the client device. ### Claim 18 (depends on 13) The method of claim 13, the method further comprising: receiving a connection request from the client device, the connection request requesting a connection to the at least one service, the connection request including the client signature. ### Claim 19 (depends on 13) The method of claim 13, the method further comprising: receiving a first connection request from the client device, the first connection request requesting a connection to a first particular service of the at least one service, the first connection request signed using the client signature; granting the first connection request based at least in part on successfully authenticating the client signature, and in part on determining that the client device is authorized to use the first particular service; receiving a second connection request from the client device, the second connection request requesting a connection to a second particular service of the at least one service, the second connection request signed using the client signature; and denying the second connection request based at least in part on determining that the client device is not authorized to use the second particular service. ### Claim 20 (depends on 19) The method of claim 19, the method further comprising: adding a client log based at least in part on determining that the client device accessed the at least one service; receiving a server log from the server, the client log and the server log including information associated with the connection to the at least one service; and determining, based on an analysis of both the client log and the server log that the client device is abusing the connection to the at least one service.