Access control using impersonization

• US 9,420,007 B1
• Filed: 12/04/2013
• Issued: 08/16/2016
• Est. Priority Date: 12/04/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory Branchek, Wren, Matthew James, Pratt, Brian Irl
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Shayanfar, Ali
• Application Number:
  US14/096,783
• Time in Patent Office: 986 Days
• Field of Search: 726/1
• US Class Current: 1/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 2463/062 applying encryption of the keys
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A first service submits a request to a second service on behalf of a customer of a service provider. The request may have been triggered by a request of the customer to the first service. To process the request, the second service evaluates one or more policies to determine whether fulfillment of the request is allowed by policy associated with the customer. The one or more policies may state one or more conditions on one or more services that played a role in submission of the request. If determined that the policy allows fulfillment of the request, the second service fulfills the request.

Claims

1. A system of a virtual computing resource service provider, comprising a plurality of computing devices collectively configured to implement an authentication system, a policy evaluation system and a first and second and third computing resource service, wherein:

the authentication system processes an authentication request by verifying an electronic signature of a first request and provides an authentication response having information identifying a set of computing resource services being a cause of the authentication request;

the first computing resource service receives the first request and, as a result, submits the authentication request to the authentication system, receives the authentication response and, as part of fulfilling the first request, uses the authentication response to submit a second request to the second computing resource service;

the first request triggered by a single customer request and the second request being triggered by the first request;

the policy evaluation system evaluates, based at least in part on a user profile associated with the single customer request and the information identifying the set of computing resource services that caused the authentication request including the first computing resource service, a set of policies applicable to the second request to determine a policy determination;

the second computing resource service receives the second request from the first computing resource service and processes the second request in accordance with the policy determination;

the third computing resource service receives a third request from the second computing resource service, the third request triggered by the second request, the first request, and the single customer request; and

the third computing resource service processes the third request in accordance with a policy based at least in part on the user profile associated with the single customer request and information identifying a set of computing resource services that triggered the third request, including the first and second computing resource service.

2. The system of claim 1, wherein:

fulfillment of the second request includes use of a cryptographic key specified in the second request to perform one or more cryptographic operations; and

the set of policies specify one or more conditions required to be satisfied before the cryptographic key is usable for request fulfillment.

3. The system of claim 1, wherein:

the second request is submitted on behalf of a customer of the computing resource service provider; and

the set of policies are configured such that the policy determination is different than the policy determination would be if the second request was received from the customer.

4. The system of claim 1, wherein the plurality of computing devices further implement an application programming interface through which application programming interface requests are submitable, by a customer of the computing resource service provider, to define one or more conditions for fulfillment of requests submitted by the first computing resource service on behalf of the customer.

5. The system of claim 1, wherein the second computing resource service comprises an application programming interface through which customers of the computing resource service provider are able to submit requests to be fulfilled by the second computing resource service.

6. A computer-implemented method, comprising:

under the control of one or more computer systems configured with executable instructions,

receiving a definition of a policy authored by a user of a computing resource service provider account and applicable to a plurality of computing resources of the computing resource service provider account, including a first, second and third computing resource service, the definition of the policy specifying one or more conditions for fulfillability of a second request submitted as part of, and triggered by, fulfillment of a single first request, and a third request submitted as part of fulfillment of, and triggered by, the second request and the single first request, the one or more conditions based at least in part on an entity submitting the second request;

receiving, from a first entity on behalf of the service provider account, the first request to perform one or more operations in connection with the one or more computing resources and, as a result, submits an authentication request to an authentication system identifying a set of computing resource services being a cause of the authentication request, including the first computing resource service;

based at least in part on the policy, processing the first request to perform one or more operations by the first computing resource and, as part of fulfilling the first request, receives an authentication response based at least in part on the authentication request having information identifying a set of computing resource services being a cause of the authentication request, and uses the authentication response to submit a second request to the second computing resource service;

receiving, from the first computing resource, the second request to perform one or more operations in connection with the one or more computing resources; and

based at least in part on the policy, processing the second request to perform one or more operations by the second computing resource;

receiving, from the second computing resource, the third request to perform one or more operations in connection with the one or more computing resources; and

based at least in part on the policy, processing the third request to perform one or more operations by the third computing resource.

7. The computer-implemented method of claim 6, wherein:

the one or more resources include a cryptographic key; and

fulfillment of the received request involves performance of one or more cryptographic operations using the cryptographic key.

8. The computer-implemented method of claim 7, wherein the received request includes an identifier for the cryptographic key.

9. The computer-implemented method of claim 6, wherein processing the request based at least in part on the policy comprises:

determining, based at least in part on information provided with the request, one or more computing resource services that each submitted a corresponding request thereby becoming a cause of the request; and

determining, based at least in part on the one or more computing resource services, whether fulfillment of the request is in compliance with the policy.

10. The computer-implemented method of claim 9, wherein the information provided with the request is encoded in a token generated by an authentication service.

11. The computer-implemented method of claim 6, wherein:

the entity is a computing resource service of the service provider; and

the request was triggered by a customer request submitted to the computing resource service, the customer request corresponding to the service provider account.

12. The computer-implemented method of claim 6, wherein the policy requires the first request to be submitted from a user associated with the service provider account.

13. The computer-implemented method of claim 6, further comprising, as a result of receiving the request, writing a set of one or more intermediate computing resource services that caused the request to be identified to an audit log in association with the request.

14. The computer-implemented method of claim 6, wherein:

the first entity is a subsystem of the service provider; and

the set of policies are configured such that the policy determination is different than the policy determination would be if the request was received from a user of the service provider account.

15. The computer-implemented method of claim 6, wherein:

the policy specifies a cryptographic key; and

processing the request based at least in part on the policy is performed as a result of use of the cryptographic key required for fulfillment of the request.

16. The computer-implemented method of claim 6, wherein:

the policy specifies a tag value; and

processing the request based at least in part on the policy is performed as a result of the request being applicable to a set of compute resources associated with the tag value.

17. A non-transitory computer-readable storage medium having stored thereon instructions that, when executed by one or more processors of a computer system, cause the computer system to:

for a pending second request triggered by a first request, determine a set of one or more intermediate computing resource services, including a first computing resource service, that caused submission of the second request based at least in part on an authentication response associated with the first request and identifying the set of one or more intermediate computing resource services, the first request triggered by submission of a single customer request;

determine, based at least in part on the determined set of one or more intermediate computing resource services, whether fulfillment of the second request complies with a set of policies applicable to the second request, the set of policies includes at least a first policy issued by the customer that identifies one or more authorized computing resources including at least a nonempty subset of the set of one or more intermediate computing resource services; and

cause the pending second request to be processed by a second computing resource service, based at least in part on whether fulfillment of the second request complies with the set of policies including a determination that each of the set of one or more intermediate computing resource services is an authorized computing resource identified by the first policy;

for a pending third request, determine a set of one or more intermediate computing resource services, including the second computing resource service, that caused submission of the third request triggered by second request;

determine, based at least in part on the determined set of one or more intermediate computing resource services, whether fulfillment of the third request complies with a set of policies applicable to the third request, the set of policies includes at least the first policy issued by the customer that identifies one or more authorized computing resources including at least a nonempty subset of the set of one or more intermediate computing resource services; and

cause the pending third request to be processed by a third computing resource service, based at least in part on whether fulfillment of the third request complies with the set of policies including a determination that each of the set of one or more intermediate computing resource services is an authorized computing resource identified by the first policy.

18. The non-transitory computer-readable storage medium of claim 17, wherein:

the set of entities comprises a first computing resource service of a service provider and a second computing resource service of the service provider; and

the pending request was submitted from the first computing resource service to the computing resource second service.

19. The non-transitory computer-readable storage medium of claim 17, wherein fulfillment of the pending request is part of fulfillment of at least one other pending request submitted by an entity of the multiple entities.

20. The non-transitory computer-readable storage medium of claim 17, wherein determining the set of multiple entities includes analyzing a token provided with the request and generated by an authentication service.

21. The non-transitory computer-readable storage medium of claim 17, wherein the pending request is to access, in plaintext form, data persistently stored in encrypted form.

22. The non-transitory computer-readable storage medium of claim 21, wherein the set of policies applicable to the request includes at least one policy determinable based at least in part on the data persistently stored in encrypted form.

23. The non-transitory computer-readable storage medium of claim 21, wherein the set of policies applicable to the request includes at least one policy determinable based at least in part on one or more keys necessary for decrypting the data persistently stored in encrypted form.

24. The non-transitory computer-readable storage medium of claim 17, wherein at least one policy of the set of policies applies to the pending request as a result of the pending request specifying a cryptographic key of a plurality of cryptographic keys managed by a system that securely manages cryptographic keys.

25. The non-transitory computer-readable storage medium of claim 17, wherein:

the computer system is operated by a service provider; and

the request was submitted on behalf of a customer of the service provider by an entity different than the customer.

26. The non-transitory computer-readable storage medium of claim 17, wherein the instructions further comprise instructions that, when executed by the one or more processors of the computer system, cause the computer system to:

determine a set of computing resources affected by fulfillment of the request; and

determine, based at least in part on the determined set of computing resources, the set of policies applicable to the request.

27. The non-transitory computer-readable storage medium of claim 17, wherein the instructions further comprise instructions that, when executed by the one or more processors of the computer system, cause the computer system to receive at least a subset of the set of policies applicable to the request from the customer.