Validation for requests

• US 10,291,605 B2
• Filed: 08/10/2017
• Issued: 05/14/2019
• Est. Priority Date: 08/07/2015
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Bowen, Peter Zachary
• Primary Examiner(s): Cribbs, Malcolm
• Application Number:
  US15/674,408
• Publication Number:
  US 20170366538A1
• Time in Patent Office: 642 Days
• Field of Search: None
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A customer can demonstrate control over an element, such as a domain, by receiving a certificate from a certificate authority. The customer can utilize a device for sending a request relating to a specified domain and receiving a request token to be provided to a domain registry associated with the subject domain. Request token creation can entail generating at least one of a random string, a string generated based on information about a customer, a string generated based on information about the application, a password, or a key. After receiving the request token, the domain registry, in turn, will provide the token to the authority, which will verify that the request token received from the domain registry corresponds to the request token originally provided to the customer'"'"'s device. If the two tokens match, the authority can act in accordance with the request, such as by issuing the certificate.

Claims

1. A computer-implemented method, comprising:

receiving, from a client device, a certificate signing request to initiate an application for a specified domain;

providing, to the client device, a request token generated by a certificate authority, based at least in part on information about the application, and to be provided to a domain registry associated with the specified domain;

receiving the request token from the domain registry;

verifying that the request token, received from the domain registry, corresponds to the request token provided to the client device; and

issuing a certificate, after verifying the request token, in response to the certificate signing request.

2. The computer-implemented method of claim 1, further comprising:

causing the request token to be stored to registration information associated with the domain and tracked by the domain registry.

3. The computer-implemented method of claim 1, further comprising:

enabling control of the domain to be verified through use of the request token without requiring access to, or disclosure of, personal information.

4. The computer-implemented method of claim 1, wherein generating the request token further comprises:

generating at least one of a random string, a string generated based on information about a customer, a string generated based on information about the application, a password, or a key.

5. The computer-implemented method of claim 1, wherein the certificate signing request specifies information about the application configured to cause a task to be performed with respect to the domain, and further comprising:

generating the request token using information about the application.

6. The computer-implemented method of claim 1, further comprising receiving a plurality of requests, wherein at least a subset of the plurality of requests is received from a third party user associated with a customer.

7. A computing system, comprising:

at least one processor; and

memory having stored therein a set of instructions, which when performed by the at least one processor, cause the computing system to;

receive, from a client device, a certificate signing request to initiate an application for a specified domain;

provide, to the client device, a request token generated by a certificate authority, based at least in part on information about the application, and to be provided to a domain registry associated with the specified domain;

receive the request token from the domain registry;

verify that the request token, received from the domain registry, corresponds to the request token provided to the client device; and

issue a certificate, after verifying the request token, in response to the certificate signing request.

8. The computer system of claim 7, wherein performing the instructions further causes the computer system to:

store the request token to registration information associated with the domain and tracked by the domain registry.

9. The computer system of claim 7, wherein performing the instructions further causes the computer system to:

enable control of the domain to be verified through use of the request token without requiring access to, or disclosure of, personal information.

10. The computer system of claim 7, wherein performing the instructions further causes the request token, provided by computer system to the client device, to include at least one of a random string, a string generated based on information about a customer, a string generated based on information about the application, a password, or a key.

11. The computer system of claim 7, wherein the certificate signing request specifies information about the application configured to cause a task to be performed with respect to the domain and performing the instructions further causes the computer system to:

generate the request token using information about the application.

12. The computer system of claim 7, wherein the specified domain is a fully-qualified domain name (FQDN).

13. A non-transitory computing device-readable medium comprising computing device-executable instructions, wherein the instructions, in response to execution by a computing device, cause the computing device to:

receive, from a client device, a certificate signing request to initiate an application for a specified domain;

provide, to the client device, a request token generated by a certificate authority, based at least in part on information about the application, and to be provided to a domain registry associated with the specified domain;

receive the request token from the domain registry;

verify that the request token, received from the domain registry, corresponds to the request token provided to the client device; and

issue a certificate, after verifying the request token, in response to the certificate signing request.

14. The non-transitory computing device-readable medium of claim 13, further comprising the instructions, in response to execution by a computing device, causing the computing device to instruct that the request token be placed in registration information associated with the specified domain and tracked by the domain registry.

15. The non-transitory computing device-readable medium of claim 13, further comprising the instructions, in response to execution by a computing device, causing the computing device to enable control of the specified domain to be verified through use of the request token without requiring access to, or disclosure of, personal information.

16. The non-transitory computing device-readable medium of claim 13, further comprising the instructions, in response to execution by a computing device, causing the computing device to generate the request token including generating at least one of a random string, a string generated based on information about a customer, a string generated based on information about the application, a password, or a key.

17. The non-transitory computing device-readable medium of claim 13 wherein the certificate signing request specifies information about the application configured to cause a task to be performed with respect to the domain, and wherein the instructions, in response to execution by a computing device, cause the computing device to further generate the request token using information about the application.