Conditioned use of certificates
AssigneeAmazon Technologies, Inc.
InventorEric J. Brandwine
Life of this patent
Estimating the term…
Abstract
Identity certificates such as SSL certificates can be issued in such a way that their use can be disabled upon short notice. In one embodiment, private signing information associated with a certificate is used by an infrastructure service on behalf of an entity, without making the private signing information accessible to the entity. In another embodiment, short-term certificates are dynamically issued to an application based on a previous certificate authorization.
Claims27
A method, under control of one or more computing systems configured with executable instructions, comprising:
- executing, by the one or more computing systems, a network application on behalf of an entity;
- obtaining a certificate that associates a public cryptographic key with the entity, wherein the public cryptographic key corresponds to a private cryptographic key;
- storing the private cryptographic key and the certificate for use in conjunction with the network application, wherein the private cryptographic key is inaccessible to the entity;
- in response to requests to the network application, determining whether the entity is authorized to use the certificate;
- and
- in response to determining that the entity is authorized to use the certificate, generating responses on behalf of the entity using the private key and delivering the responses and the certificate on behalf of the entity.
A system that provides computing resources for use by entities, comprising:
- one or more processors;
- computer-readable memory storing instructions that are executable by the one or more processors to perform actions comprising:
- authorizing at least one of the entities a first time to use a certificate;
- executing applications on behalf of the said at least one of the entities to serve data to application consumers;
- in response to receiving a request from said at least one of the entities for the certificate to be served to the application consumers, authorizing said at least one of the entities a second time to use the certificate;
- and
- generating application responses on behalf of said one of the entities using authentication information associated with the certificate, the authentication information including at least a private portion that is inaccessible to said at least one of the entities.
A method, under control of one or more computing systems configured with executable instructions, comprising:
- receiving, by the one or more computing systems, an authorization request from a requesting entity for a certificate authorization;
- in response to receiving the authorization request, attempting to authorize the requesting entity;
- upon authorizing the requesting entity, granting the certificate authorization, wherein the certificate authorization is valid for a first time period;
- receiving multiple certificate requests from the requesting entity based at least in part on the certificate authorization;
- and
- in response to receiving one of the certificate requests during the first time period, providing a certificate, the certificate being valid for a second time period that is smaller than the first time period.
A method, under control of one or more computing systems configured with executable instructions, comprising:
- receiving, by the one or more computing systems, an authorization request from a requesting entity for a certificate authorization;
- in response to receiving the authorization request, attempting to authorize the requesting entity;
- upon authorizing the requesting entity a first time, granting the certificate authorization;
- issuing one or more certificates to the entity based at least in part on the certificate authorization;
- and
- conditioning use of the one or more certificates upon authorizing the requesting entity again a subsequent time, after the certificate authorization is granted and after the one or more certificates are issued.
Dependencies are inferred from the claim text.