VALIDATION FOR REQUESTS

• US 20170366539A1
• Filed: 08/10/2017
• Published: 12/21/2017
• Est. Priority Date: 08/07/2015
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Bowen, Peter Zachary
• Granted Patent: US 10,320,773 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A customer can demonstrate control over an element, such as a domain, by receiving a certificate from a certificate authority. After receiving a request for a certificate for a certain domain name, the certificate authority uses a public key cryptography protocol to generate a request for information regarding the domain name. The request for information is submitted to a domain service which hosts that domain name, and the domain service will provide a response to the certificate authority which includes a public key and data for the domain name, with the data encrypted under an associated private key for the domain name. The certificate authority will issue a certificate specifying the domain name and utilizing the received public key, and the certificate is unable to be validated without access to the associated private key.

Claims

1. A computer-implemented method, comprising:

receiving, by a certificate authority, a request for a certificate for a domain name;

generating, utilizing a public key cryptography protocol, a request for information regarding the domain name;

submitting the request for information to a domain service hosting the domain name;

receiving, from the domain service, a response including a public key and including data for the domain name, with the data encrypted under an associated private key for the domain name; and

issuing, by the certificate authority, a certificate specifying the domain name and utilizing the received public key, the certificate unable to be validated without access to the associated private key.

2. The computer-implemented method of claim 1, further comprising:

causing the certificate to be self-signed on behalf of a user.

3. The computer-implemented method of claim 1, further comprising:

providing the public key via an active server for the domain name, wherein control over the active server is verified concurrently with providing the public key.

4. The computer-implemented method of claim 1, further comprising:

encrypting, by the certificate authority and prior to certificate issuance and using the public key, the certificate.

5. The computer-implemented method of claim 1, wherein the request for the certificate is a certificate signing request and the action includes issuance of a certificate.

6. The computer-implemented method of claim 5, wherein the certificate signing request specifies information about an application configured to cause a task to be performed with respect to the domain, and further comprising:

generating the request key using information about the application.

7. The computer-implemented method of claim 1, further comprising:

receiving a plurality of requests, wherein at least a subset of the plurality of requests is received from a third party user associated with a customer.

8. The computer-implemented method of claim 1, wherein the domain name is a fully-qualified domain name (FQDN).

9. A computing system, comprising:

at least one processor; and

memory having stored therein a set of instructions, which when performed by the at least one processor, cause the computing system to;

receive, by a certificate authority, a request for a certificate for a domain name;

utilizing public key cryptography protocol, generate a request for information regarding the domain name;

submit the request for information to a domain service hosting the domain name;

receive, from the domain service, a response including a public key and including data for the domain name, with the data encrypted under an associated private key for the domain name; and

issue, by the certificate authority, a certificate specifying the domain name and utilizing the received public key, the certificate unable to be validated without access to the associated private key.

10. The computer system of claim 9, wherein the response comprises a self-signed certificate.

11. The computer system of claim 9, wherein the domain name is a fully-qualified domain name (FQDN).

12. The computer system of claim 9, further comprising provision of the public key via an active server for the domain name, and wherein control over the active server is verified concurrently with providing the public key.

13. The computer system of claim 9, further comprising encrypting, by the certificate authority prior to certificate issuance and using the public key, the certificate.

14. The computer system of claim 9, wherein the request for the certificate is a certificate signing request.

15. A non-transitory computing device-readable medium comprising computing device-executable instructions, wherein the instructions, in response to execution by a computing device, cause the computing device to:

receive, by a certificate authority, a request for a certificate for a domain name;

utilizing public key cryptography protocol, generate a request for information regarding the domain name;

submit the request for information to a domain service hosting the domain name;

receive, from the domain service, a response including a public key and including data for the domain name, with the data encrypted under an associated private key for the domain name; and

issue, by the certificate authority, a certificate specifying the domain name and utilizing the received public key, the certificate unable to be validated without access to the associated private key.

16. The non-transitory computing device-readable medium of claim 15, wherein the response comprises a self-signed certificate.

17. The non-transitory computing device-readable medium of claim 15, further comprising provision of the public key via an active server for the domain name, and wherein control over the active server is verified concurrently with providing the public key.

18. The non-transitory computing device-readable medium of claim 15, further comprising encrypting, by the certificate authority prior to certificate issuance and using the public key, the certificate.

19. The non-transitory computing device-readable medium of claim 15, wherein the request for the certificate is a certificate signing request.

20. The non-transitory computing device-readable medium of claim 15, wherein the domain name is a fully-qualified domain name (FQDN).