Authentication through a secret holding proxy

• US 10,103,875 B1
• Filed: 12/20/2011
• Issued: 10/16/2018
• Est. Priority Date: 12/20/2011
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory B., Baer, Graeme D., Fitch, Nathan R., Crahen, Eric D., Brandwine, Eric J.
• Primary Examiner(s): Ullah, Sharif E
• Application Number:
  US13/332,199
• Time in Patent Office: 2,492 Days
• Field of Search: 380228-229, 380255, 380277, 713150-151, 713175-176, 713180, 713189-193, 726 2, 726 26
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/065 Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Client requests may be directed through a secret holding proxy system such that the secret holding proxy system may insert a secret into a client request before arriving at the destination. The insertion of a secret may include inserting a digital signature, token or other information that includes a secret or information based upon a secret, which may include secret exchange or authentication protocols. The secret holding proxy system may also remove secrets and/or transform incoming messages such that the client may transparently receive the underlying content of the message.

Claims

1. A computer-implemented method for providing authentication services, comprising:

under the control of one or more computer systems configured with executable instructions, receiving, by a signing service, a signed message having instructions from a client, the signed message addressed to a resource;

determining whether to send the instructions to the resource based at least in part on a policy, the policy based at least in part on the outcomes of operations that include;

verifying the signed message is signed with the interim credential; and

determining whether the client has permission to access the resource;

signing the instructions using a recognized credential when the client has permission and the message is signed with the interim credential, the recognized credential being unshared with the client and inaccessible to the client and valid for use to access the resource; and

sending the instructions signed with the recognized credential to the resource when the instructions have been signed with the recognized credential.

2. The computer-implemented method of claim 1, wherein the client and the signing service are connected by a trusted network, the trusted network segregated from other networks such that communications between the client and signing service have assurance that the communications are not altered.

3. The computer-implemented method of claim 2, wherein the resource is outside of the trusted network.

4. The computer-implemented method of claim 3, wherein the instructions are sent from the signing service to the resource over a secure connection.

5. The computer-implemented method of claim 1, further comprising removing a signature from the signed message, the signature having used the interim credential.

6. The computer-implemented method of claim 1, wherein the policy further includes the operation of determining whether a client has paid for the signing service.