Kevin P O'Neill

US Patent:

8607067, Dec 10, 2013

Filed:

Mar 1, 2011

Appl. No.:

13/038277

Inventors:

Cornelle Christiaan Pretorius Janse van Rensburg - Cape Town, ZA
Marc J. Brooker - Cape Town, ZA
David Brown - Cape Town, ZA
Abhinav Agrawal - Seattle WA, US
Matthew S. Garman - Seattle WA, US
Kevin Ross O'Neill - Seattle WA, US
Eric Jason Brandwine - Haymarket VA, US
Christopher Richard Jacques de Kadt - Cape Town, ZA
Mark Joseph Cavage - Seattle WA, US

Assignee:

Amazon Technologies, Inc. - Reno NV

International Classification:

H04L 29/06

US Classification:

713189

Abstract:

Systems and methods for attesting to information about a computing resource involve electronically signed documents. For a computing resource, a document containing information about the resource is generated and electronically signed. The document may be provided to one or more entities as an attestation to at least some of the information contained in the document. Attestation to information in the document may be a prerequisite for performance of one or more actions that may be taken in connection with the computing resource.

US Patent:

8640200, Jan 28, 2014

Filed:

Mar 23, 2012

Appl. No.:

13/429180

Inventors:

Gregory B. Roth - Seattle WA, US
Kevin Ross O'Neill - Seattle WA, US

Assignee:

Amazon Technologies, Inc. - Reno NV

International Classification:

G06F 12/14
G06F 15/16
G06F 15/173
H04L 29/06

US Classification:

726 3, 709225, 709228, 726 18, 726 19

Abstract:

Techniques are described for enabling principals to inject context information into a credential (e. g. session credential). Once the credential has been issued, any arbitrary principal is allowed to inject context information into the existing credential. The injected context is scoped to the principal that made the injection. Subsequently, at authentication time, when the credential is used to request access to a particular resource, the system can verify whether the principal that made the injection is trusted and if the principal is deemed trusted, the context information can be applied to a policy that controls access to one or more resources, or can alternatively be translated into some context residing in a different namespace which can then be applied to the policy. In addition, the system enables arbitrary users to insert additional deny statements into an existing credential, which further restrict the scope of permissions granted by the credential.

US Patent:

20130086662, Apr 4, 2013

Filed:

Sep 29, 2011

Appl. No.:

13/248962

Inventors:

Gregory B. Roth - Seattle WA, US
Bradley Jeffery Behm - Seattle WA, US
Eric D. Crahen - Seattle WA, US
Cristian M. Ilac - Sammamish WA, US
Nathan R. Fitch - Seattle WA, US
Eric Jason Brandwine - Haymarket VA, US
Kevin Ross O'Neill - Seattle WA, US

Assignee:

Amazon Technologies, Inc. - Reno NV

International Classification:

G06F 21/00

US Classification:

726 7

Abstract:

Systems and methods for authentication generate keys from secret credentials shared between authenticating parties and authenticators. Generation of the keys may involve utilizing specialized information that, as a result of being used to generate the keys, renders the generated keys usable for a smaller scope of uses than the secret credential. Further, key generation may involve multiple invocations of a function where each of at least a subset of the invocations of the function results in a key that has a smaller scope of permissible use than a key produced from a previous invocation of the function. Generated keys may be used as signing keys to sign messages. One or more actions may be taken depending on whether a message and/or the manner in which the message was submitted complies with restrictions of the a key's use.

US Patent:

20130086663, Apr 4, 2013

Filed:

Sep 29, 2011

Appl. No.:

13/248973

Inventors:

Gregory B. Roth - Seattle WA, US
Bradley Jeffery Behm - Seattle WA, US
Eric D. Crahen - Seattle WA, US
Cristian M. Ilac - Sammamish WA, US
Nathan R. Fitch - Seattle WA, US
Eric Jason Brandwine - Haymarket VA, US
Kevin Ross O'Neill - Seattle WA, US

Assignee:

Amazon Technologies, Inc. - Reno NV

International Classification:

H04L 9/32
G06F 21/00

US Classification:

726 7

Abstract:

Systems and methods for authentication generate keys from secret credentials shared between authenticating parties and authenticators. Generation of the keys may involve utilizing specialized information that, as a result of being used to generate the keys, renders the generated keys usable for a smaller scope of uses than the secret credential. Further, key generation may involve multiple invocations of a function where each of at least a subset of the invocations of the function results in a key that has a smaller scope of permissible use than a key produced from a previous invocation of the function. Generated keys may be used as signing keys to sign messages. One or more actions may be taken depending on whether a message and/or the manner in which the message was submitted complies with restrictions of the a key's use.

US Patent:

20200242082, Jul 30, 2020

Filed:

Jan 30, 2019

Appl. No.:

16/262756

Inventors:

- Seattle WA, US
Kevin David Jamieson - North Vancouver, CA
Junjie Liang - Seattle WA, US
Kevin Ross O'Neill - Seattle WA, US
Sihang Su - Vancouver, CA

International Classification:

G06F 16/178
G06F 16/182
G06F 16/18
H04L 29/08

Abstract:

Embodiments are directed to a replication engine that provides a root node for a file that may be associated with a replication snapshot where the file is comprised of the root node, internal nodes, and data nodes. The replication engine may start at the root node and traverse the file system. If a visited internal node has an epoch value that matches the epoch, the replication engine may continue the traversal by visiting a next unvisited adjacent internal node. If the visited internal node has an epoch value that mismatches the epoch, the replication engine may backtrack to a nearest adjacent internal node that matches the epoch. And, in response to visiting a data node the replication engine may be arranged to determine blocks that are associated with the data node and communicate a copy of the blocks to a target file system.

US Patent:

20190332579, Oct 31, 2019

Filed:

Sep 7, 2018

Appl. No.:

16/125573

Inventors:

- Seattle WA, US
Neal Thomas Fachan - Seattle WA, US
Junjie Liang - Seattle WA, US
Kevin Ross O'Neill - Seattle WA, US

International Classification:

G06F 16/178
G06F 16/182
G06F 16/11
H04L 29/08
H04L 29/06

Abstract:

Embodiments are directed to file systems. A replication engine may establish a secure communication channel between a source file system and a target file system. The replication engine may: instantiate a replication job associated with rules; determine changes in the source file system; determine characteristics of the replication job that may be based on the changes; compare the to the characteristics and a black-out schedule; execute the replication job to communicate the changes in the source file system to the target file system based on a result of the comparison. Upon completion of the replication job, the replication engine may automatically instantiating a next replication job to copy subsequent changes in the source file system to the target file system.

US Patent:

20190036901, Jan 31, 2019

Filed:

Oct 4, 2018

Appl. No.:

16/152132

Inventors:

- Seattle WA, US
Mark Joseph Cavage - Seattle WA, US
David Brown - Sunnydale, ZA
Kevin Ross O'Neill - Seattle WA, US
Eric Jason Brandwine - Haymarket VA, US
Christopher Richard Jacques de Kadt - Cape Town, ZA

International Classification:

H04L 29/06
G06F 21/44

Abstract:

A plurality of virtual computing resources is detected to have been provisioned. Credentials are distributed to the plurality of virtual computing resources. A credentials map that maps the credentials to the plurality of virtual computing resources is updated. The credentials for the plurality of virtual computing resources are activated to enable the plurality of virtual computing resources to use the credentials to authenticate to a second computer system that manages a resource service, with the credentials being inaccessible to resources of the resource service. A virtual computing resource of the plurality of virtual computing resources is detected to been deprovisioned, and the credentials for the virtual computing resource are deactivated.

US Patent:

20170272423, Sep 21, 2017

Filed:

May 31, 2017

Appl. No.:

15/610295

Inventors:

- Reno NV, US
Nathan R. Fitch - Seattle WA, US
Kevin Ross O'Neill - Seattle WA, US
Graeme D. Baer - Seattle WA, US
Bradley Jeffery Behm - Seattle WA, US
Brian Irl Pratt - Seattle WA, US

International Classification:

H04L 29/06
G06F 21/62

Abstract:

Systems and methods are described for delegating permissions to enable account access. The systems utilize a delegation profile that can be created within a secured account of at least one user. The delegation profile includes a name, a validation policy that specifies principals which may be external to the account and which are permitted to assume the delegation profile, and an authorization policy that indicates the permitted actions within the account for those principals which are acting within the delegation profile. Once the delegation profile is created, it can be provided to external principals or services. These external principals or services can use the delegation profile to obtain credentials for performing various actions in the account using the credentials of the delegation profile.