WO2015042046A1 - Network connection automation - Google Patents

Network connection automation Download PDF

Info

Publication number
WO2015042046A1
WO2015042046A1 PCT/US2014/055874 US2014055874W WO2015042046A1 WO 2015042046 A1 WO2015042046 A1 WO 2015042046A1 US 2014055874 W US2014055874 W US 2014055874W WO 2015042046 A1 WO2015042046 A1 WO 2015042046A1
Authority
WO
WIPO (PCT)
Prior art keywords
customer
computing resource
service provider
resource service
authentication
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/US2014/055874
Other languages
English (en)
French (fr)
Inventor
Mark Edward Stalzer
Christian Arthur Arllen
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Amazon Technologies Inc
Original Assignee
Amazon Technologies Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Amazon Technologies Inc filed Critical Amazon Technologies Inc
Priority to CN201480050814.4A priority Critical patent/CN105556894B/zh
Priority to EP14845785.6A priority patent/EP3047602A4/en
Priority to JP2016542872A priority patent/JP6656157B2/ja
Priority to CA2923431A priority patent/CA2923431C/en
Priority to SG11201601797TA priority patent/SG11201601797TA/en
Priority to EP19204080.6A priority patent/EP3654612B1/en
Publication of WO2015042046A1 publication Critical patent/WO2015042046A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H04L43/0805—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability
    • H04L43/0811—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters by checking availability by checking connectivity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/04—Network management architectures or arrangements
    • H04L41/046—Network management architectures or arrangements comprising network management agents or mobile agents therefor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/302—Route determination based on requested QoS
    • H04L45/306—Route determination based on the nature of the carried application
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0853—Network architectures or network communication protocols for network security for authentication of entities using an additional device, e.g. smartcard, SIM or a different communication terminal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/14—Charging, metering or billing arrangements for data wireline or wireless communications
    • H04L12/1432—Metric aspects
    • H04L12/1435—Metric aspects volume-based
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0896—Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks

Definitions

  • Computing resource service providers and other service providers often grant users access to their services through the use of dedicated network connections. Many users, for example, utilize a colocation environment to connect directly with the computing resource service provider in order to access one or more services.
  • creating a dedicated and secure connection between the computing resource service provider and a customer may not be free of all risks. For example, despite their best efforts to avoid it, even a physical, dedicated connection may have points of susceptibility (e.g., at patch panels) where unauthorized and/or unintentional access to communications is possible.
  • computing resource service providers may use conventional authentication methods to ensure that the connection is secure. However, conventional authentication methods often rely on manual intervention and are inherently inflexible. Additionally, the cryptographic techniques used to secure the connection may have vulnerabilities exploitable to gain unauthorized access to the connection. Adequately addressing these risks presents additional costs to the organizations that rely on the dedicated connection and to the computing resource service provider.
  • FIG. 1 shows an illustrative example of an environment in which various embodiments can be practiced
  • FIG. 2 shows an illustrative example of an environment in which various embodiments can be practiced
  • FIG. 3 shows an illustrative example of one or more services provided by a computing resource service provider in accordance with at least one embodiment
  • FIG. 4 shows an illustrative example of an environment in which various embodiments can be practiced
  • FIG. 5 shows an illustrative example of an environment in which a physical connection is authenticated in accordance with at least one embodiment
  • FIG. 6 shows an illustrative example of an environment in which a connection with one or more services is managed upon initial authentication in accordance with at least one embodiment
  • FIG. 7 shows an illustrative example of a process for establishing a physical connection between a customer and a computing resource service provider in accordance with at least one embodiment
  • FIG. 8 shows an illustrative example of a process for authenticating a connection for the first time in accordance with at least one embodiment
  • FIG. 9 shows an illustrative example of a process for authenticating a connection after a connection has been previously established in accordance with at least one
  • FIG. 10 shows an illustrative example of a process for authenticating a connection in accordance with at least one embodiment
  • FIG. 11 illustrates an environment in which various embodiments can be implemented.
  • a computing resource service provider may receive a request from an entity (e.g., an organization) to establish a direct connection between the entity and the computing resource service provider.
  • entity e.g., an organization
  • the entity may be a customer of the computing resource service provider who may operate various services, such as data storage services, virtual computing system services and/or database services.
  • the computing resource service provider may allow customers to communicate with the computing resource service provider's network using direct connections, i.e. physical communications connections that connect customer computing resources to computing resource service provider computing resources.
  • Example techniques for establishing such connections are described in U.S. Patent Application No. 13/306,775, filed on November 29, 2011, titled "Interfaces to Manage Direct Network Peerings," which is incorporated herein by reference in its entirety for all purposes.
  • the computing resource service provider may generate a letter of authority in order to allow an employee of the computing resource service provider (e.g., a data technician) to connect physical routers associated with the customer and the computing resource service provider.
  • This letter of authority may be generated in response to the received request from a customer to establish a direct connection with the computing resource service provider.
  • the computing resource service provider may transmit one or more signals to the customer router upon connection to initiate network connectivity between the customer and the computing resource service provider.
  • These one or more signals may additionally include an authentication request in order to verify that the connection has been established correctly and that the customer is the correct entity authorized to connect to the computing resource service provider.
  • the customer may transmit one or more signals in response to computing resource service provider in order to verify that the customer is authorized to access the computing resource service provider computer systems.
  • These one or more signals may include a digital signature generated using one or more authentication credentials, such as a secret cryptographic key, originating from one or more customer computer systems. This signature may be generated using a symmetric cryptographic algorithm and/or an asymmetric cryptographic algorithm.
  • the computing resource service provider may transmit the customer signals (or information based at least in part thereon) to an authentication service in order to determine whether the signature received from the customer is authentic and corresponds to this customer. If the customer signals are not authenticated, the computing resource service provider may deny access to its various services. Otherwise, the customer may be granted access to the one or more services that the customer has opted to use.
  • the computing resource service provider may transmit one or more authentication requests to the customer over time after the initial connection to ensure the connection has not been compromised.
  • the customer may transmit a response to the request, which may comprise a digital signature generated using a hash function and a cryptographic key to the computing resource service provider to provide evidence that the customer is authorized to maintain the connection. Accordingly, if the signature is verified, such as through the authentication service, the computing resource service provider may allow the connection to continue. However, if the authentication service is unable to verify that the customer has the authority to access the services provided by the computing resource service provider, the computing resource service provider may limit the customer's access to the services until the customer is able to provide a valid digital signature to the computing resource service provider.
  • the customer transmits an authentication request to the computing resource service provider, such as through an appropriately configured API call to the service, to verify that the connection is currently between the customer and the computing resource service provider. If the signal received from the computing resource service provider is not authentic (e.g., does not include a valid digital signature on behalf of the computing resource service provider), the customer may limit or even terminate the connection with the computing resource service provider. Otherwise, the customer may continue his/her access to the various services provided by the computing resource service provider provided the customer may reciprocally provide authentication credentials to the computing resource service provider when requested.
  • the computing resource service provider such as through an appropriately configured API call to the service
  • the customer may transmit an authentication request to the computing resource service provider, such as through an appropriately configured API call to the service, to cause the authentication service to verify that the customer communications are truly originating from a customer computer system.
  • This authentication request transmitted by the customer may include a digital signature which may be used by the computing resource service provider to verify the customer's identity. If the digital signature is authentic, the computing resource service provider may transmit one or more signals comprising a digital signature for the computing resource service provider to the customer. Accordingly, the customer may use this digital signature to verify the identity of the computing resource service provider.
  • the computing resource service provider and its customers may be connected through one or more physical routers and ensure that the connection is limited or terminated in the event of a failure to authenticate the customer or computing resource service provider signals.
  • the techniques described herein facilitate additional technical advantages. For example, because, in some embodiments, the authentication processes are performed by computer systems managed by either the computing resource service provider or the customer, manual intervention may not be required to authenticate the connection. Accordingly, these techniques may increase the flexibility available to the computing resource service provider and its customers in ensuring a secure connection. Additionally, the use of an alternative authentication process may eliminate the use of the conventional router-to-router authentication techniques, potentially eliminating or mitigating any vulnerability that may be inherent in the conventional techniques. Additional uses are also enabled by the various techniques described herein.
  • FIG. 1 shows an illustrative example of an environment 100 in which various embodiments may be practiced.
  • a computing resource service provider 102 provides various computing resource services to customers of the computing resource service provider.
  • the computing resource service provider 102 may be an organization that hosts various computing resources on behalf of one or more customers.
  • a computing resource service provider may operate one or more facilities that are used to host various computing hardware resources, such as hardware servers, data storage devices, network devices, and other equipment, such as server racks, networking cables and the like.
  • the computing resource hardware may utilize its computing hardware resources to operate one or more services.
  • Such services may include services that enable customers of the computing resource service provider to remotely manage computing resources to support the customers' operations while reducing or even eliminating the need of the customers to invest in physical equipment.
  • Example services include, but are not limited to, various data storage services (object-based data storage services, archival data storage services, database services and the like), program execution services and other services.
  • the services may be used by customers to support a wide variety of activities, such as operating a website, operating enterprise systems supporting an organization, distributed computation and/or other activities.
  • the environment 100 includes a customer 104.
  • the customer 104 may be an organization that utilizes some or all of the various services at least in part by establishing a direct connection with the computing resource service provider 102.
  • the customer 104 of the computing resource service provider 102 may utilize various services provided by the computing resource service provider 102.
  • the customer 104 may utilize the services provided by the computing resource service provider 102 through automated processes, such as batch requests made to a service or customer server requests that require access to the service to support a customer operation.
  • the customer 104 may contact the computing resource service provider 102 to request the installation of a direct connection to the computing resource service provider.
  • the computing resource service provider may generate a letter of authority and either deploy a data technician or allow the customer 102 to use its own data technician or third party to connect a customer router and a computing resource service provider router 106.
  • the routers may be located in a data center or colocation which, in turn, may be located in a remote location. While routers are used extensively throughout the present disclosure for the purpose of illustration, the techniques illustrated in the present disclosure may additionally apply generally to other network devices (e.g., gateway devices, etc.).
  • the computing resource service provider router may initiate transmission of one or more signals to the customer router.
  • One such signal may include an authentication request in order to verify that the customer 104 is authorized to connect to the computing resource service provider 102.
  • This authentication request may originate in an authentication service 108, maintained and operated by the computing resource service provider 102.
  • the authentication service 108 may be configured to obtain customer information from an account service (not shown) in order to obtain a cryptographic key which may be necessary to hash the received customer data to generate an expected customer digital signature. This expected customer digital signature may be compared to the received customer digital signature to verify the customer's identity.
  • the authentication service 108 may be configured to transmit executable commands to the computing resource service provider router 106 to transmit the authentication request to the customer 104.
  • the customer 104 may provide one or more data packets comprising a digital signature along with additional data (e.g., customer identification number, port number, etc.) to the computing resource service provider 102 through one or more signals transmitted to the computing resource service provider router 106.
  • the router 106 may transmit these data packets to the authentication service 108 for validation.
  • the authentication service 108 may be configured to hash the additional data received from the customer 104, along with a cryptographic key to generate an expected customer digital signature. .
  • the authentication service 108 may reconfigure the computing resource service provider router 106 to enable the customer to access one or more other services 110 provided by the computing resource service provider 102.
  • These other services 110 may include various data storage services (object-based data storage services, archival data storage services, database services and the like), program execution services and the like.
  • the authentication service 108 may deny access to the other services 110.
  • the customer 104 may initiate the authentication process, such as through an appropriately configured API call to the service, by transmitting one or more data packets to the computing resource service provider router 106.
  • These data packets may include a digital signature generated using a secret key which, when processed by the computing resource service provider 102, causes the service provider to hash the received data, along with a cryptographic key, to generate an expected customer digital signature which may be used to determine whether the received digital signature is authentic.
  • these data packets may cause the service provider 102 to generate one or more data packets comprising its own digital signature which may be used by the customer 104 to verify the identity of the computing resource service provider. In this fashion, both the customer 104 and the computing resource service provider 102 may verify the authenticity of the signals transmitted through the direct physical connection.
  • the authentication service 108 may refer to the account service (not shown) to apply one or more restrictions to the connection in accordance with customer 104 specifications.
  • the customer 104 may have specified during the initial request for a direct connection to the computing resource service provider 102 that certain actions are to be taken if the connection is compromised.
  • the computing resource service provider 102 may restore the connection if the customer 104 at a later point provides valid authentication credentials to the computing resource service provider.
  • FIG. 2 is an illustrative example of an environment in which various embodiments can be practiced.
  • direct connections may have been established between one or more customers 202 and a computing resource service provider 212.
  • a customer 202 may contact the computing resource service provider 212 to request the installation of a direct connection to the computing resource service provider.
  • the computing resource service provider 212 may deploy a data technician to establish a physical connection between a customer router 206 and a computing resource service provider router 210.
  • the routers 206, 210 may be located in a data center or colocation 204 which, in turn, may be located in a remote location.
  • the direct connection between one or more customers 202 and the computing resource service provider 212 may be established by installing cables between the customer routers 206 and a computing resource service provider router 210.
  • the routers 206, 210 illustrated in FIG. 2 may comprise a variety of ports configured to allow users to transmit data to a recipient or receive data from a source.
  • a router 206, 210 may comprise a number of transmission ports and a number of receiving ports.
  • the connection between a customer router 206 and the computing resource service provider router 210 may include a plurality of cables that, when connected to the routers, enable a customer 202 and the computing resource service provider 212 to transmit and receive data.
  • embodiments of the present disclosure are not limited to those in which a contiguous cable connects the customer and provider routers.
  • the computing resource service provider 212 may begin transmitting one or more signals through the computing resource service provider router to the customer routers.
  • the customer router 206 upon receiving the one or more signals from the computing resource service provider 212, may transmit the one or more signals to the customer 202 for processing.
  • the one or more signals may include an authentication request which may cause the computer systems operated by a customer 202 to transmit a response comprising
  • the authentication proof may include a digital signature or other account credential necessary to establish the identity of the customer 202. While the use of digital signatures for authentication is used extensively throughout the present disclosure for the purpose of illustration, other authentication methods may be used.
  • the authentication request sent by a computing resource service provider 212 may include executable instructions that may cause a customer graphical user interface to appear on a customer 202 computer system with a prompt for a password.
  • a customer 202 may be required to type in a password in the prompt in order to authenticate the connection.
  • the computing resource service provider 212 may re-configure the computing resource service provider router 210 to allow communications between a customer 202 and one or more services provided by the computing resource service provider.
  • the computing resource service provider 212 may transmit one or more signals through its router 210 to a customer 202 to verify that the connection has not been compromised.
  • the computing resource service provider may once again re-configure the computing resource service provider router 210 to limit the customer's 202 access to the one or more services.
  • adequate authentication proof e.g., invalid credential, invalid digital signature, incorrect Internet protocol (IP) address, checksum mismatch, etc.
  • the customer 202 may transmit, through the customer router 206 one or more signals to the computing resource service provider 212 to verify that the connection has not been compromised. If the computing resource service provider 212 is unable to provide adequate authentication proof, the customer 202, through one or more computer systems operated by the customer, may transmit an executable command to the customer router 206 to limit or even terminate the existing connection.
  • FIG. 3 is an illustrative example of one or more services provided by a computing resource service provider 302 in accordance with at least one embodiment.
  • the computing resource service provider 302 provides at least five types of services.
  • the services provided by the computing resource service provider 302, in this example, include a virtual computer system service 304, an object-based data storage service 306, a database service 308, an account service 310, an authentication service 312 and one or more other services 314, although not all embodiments of the present disclosure will include all such services and additional services may be provided in addition to or as an alternative to services explicitly described herein.
  • the virtual computer system service 304 may be a collection of computing resources configured to instantiate virtual machine instances onto virtual computing systems on behalf of the customers of the computing resource service provider 302.
  • Customers of the computing resource service provider 302 may interact with the virtual computer systems' service to provision and operate virtual computer systems that are instantiated on physical computing devices hosted and operated by the computing resource service provider 302.
  • the virtual computer systems may be used for various purposes, such as to operate as servers supporting a website.
  • Other applications for the virtual computer systems may be to support database applications, electronic commerce applications, business applications and/or other applications.
  • the object-based data storage service 306 may comprise a collection of computing resources that collectively operate to store data for a customer.
  • the data stored in the object- based data storage service 306 may be organized into data objects.
  • the data objects may have arbitrary sizes except, perhaps, for certain constraints on size.
  • the object-based data storage service 306 may store numerous data objects of varying sizes.
  • the object-based data storage service 306 may operate as a key value store that associates data objects with identifiers of the data objects which may be used by the customer to retrieve or perform other operations in connection with the data objects stored by the data storage service 306. Access to the data storage service may be through appropriately configured API calls.
  • the database service 308 may be a collection of computing resources that collectively operate to run one or more databases for one or more customers.
  • Customers of the computing resource service provider 302 may operate and manage a database from the database service 308 by utilizing appropriately configured API calls. This, in turn, may allow a customer to maintain and potentially scale the operations in the database.
  • the account service 310 may be a collection of computing resources that collectively operate to maintain customer account information for each customer of the computing resource service provider 302.
  • the account service 310 may include, for example, the customer name, address, phone numbers, billing details and other personal identification information for each customer of the computing resource service provider 302.
  • the account service 310 may include cryptographic keys or other credentials that may be used to verify that a customer has the proper authorization to access the one or more services provided by the computing resource service provider 302. Accordingly, the account service 310 may be configured to operate in conjunction with the authentication service 312 to enable customer connections and limit access to the one or more services provided by the computing resource service provider 302 should the customer fail to provide adequate authentication proof (e.g., digital signature, password, etc.). The customer may be able to interact with the account service 310 through one or more communications networks, such as the Internet, in order to provide and update the account information as necessary.
  • the account service 310 may include cryptographic keys or other credentials that may be used to verify that a customer has the proper authorization to access the one or more services provided by the computing resource service provider 302. Accordingly, the account service 310 may be configured to operate in conjunction with the authentication service 312 to enable customer connections and limit access to the one or more services provided by the computing resource service provider 302 should the customer fail to provide adequate authentication proof (e.g., digital signature, password
  • the customer may access the account service 310 to perform a key exchange to ensure both the customer and the computing resource service provider 302 have a copy of the cryptographic keys necessary to validate a physical connection.
  • the authentication service 312 may serve to authenticate and verify a connection between the computing resource service provider 302 and a customer. For instance, after a direct connection has been established between a customer and the computing resource service provider 302 (e.g., for example, through the use of routers located in a co location, as illustrated in FIG. 2), the authentication service 312 may transmit an authentication request to the customer in order to ensure that the customer has
  • the authentication service 312 may be configured to receive authentication proof from the customer and perform one or more operations to determine whether the authentication proof provided is authentic. For instance, the authentication service 312 may interact with the account service 310 to obtain necessary customer information for verifying the provided authentication proof (e.g., one or more cryptographic keys, passwords, customer identification numbers, etc.). If the authentication proof is not adequate, the authentication service 312 may transmit one or more executable commands to the computing resource service provider 302 router to limit customer access to the one or more services until the customer is able to provide adequate authentication proof. The authentication service 312 may be configured to perform this authentication process at different times to ensure that a connection between the customer and the computing resource service provider 302 is not compromised.
  • the authentication service 312 may interact with the account service 310 to obtain necessary customer information for verifying the provided authentication proof (e.g., one or more cryptographic keys, passwords, customer identification numbers, etc.). If the authentication proof is not adequate, the authentication service 312 may transmit one or more executable commands to the computing resource service provider 302 router to limit customer
  • the authentication service 312 may additionally be configured to respond to an authentication request transmitted by a customer to the computing resource service provider 302. For instance, after a direct connection has been established between a customer and the computing resource service provider 302, the customer may transmit an authentication request to the computing resource service provider in order to verify that the connection is authentic and has not been compromised.
  • the authentication service 312 may process the request and provide authentication proof necessary to verify that the connection is authentic.
  • the authentication service 312 may be configured to access the account service 310 to locate the account information related to the customer and identify the type of authentication proof required to authenticate the connection. In this fashion, the authentication service 312 may provide added security to the connection between a customer and the computing resource service provider 302.
  • the computing resource service provider 302 may additionally maintain one or more other services 314 based on the needs of its customers.
  • the computing resource service provider 302 may maintain a block-level data storage service which may comprise a collection of computing resources that collectively operate to store data for a customer by utilizing block-level data storage volumes.
  • the storage volumes may be configured to behave like raw, unformatted block storage devices with a block level customer interface. Accordingly, a customer, through properly configured API calls to the service, may create a file system on top of the block-level data storage volumes or utilize the volume as a block-level storage device (e.g., a hard drive).
  • Other services include, but are not limited to, object-level archival data storage services, services that manage other services and/or other services.
  • the computing resource service provider may utilize an
  • FIG. 4 is an illustrative example of an environment 400 in which various embodiments can be practiced.
  • a customer may utilize a customer gateway device 402 to communicate with the computing resource service provider 408 through one or more communications networks 404, such as the Internet. While the Internet is used extensively throughout the present disclosure for the purpose of illustration, the present disclosure is not so limited.
  • the gateway device 402 may be used to communicate with the computing resource service provider 408 through a local area network (LAN), intranet, extranet, a wireless network and any combination thereof.
  • LAN local area network
  • intranet intranet
  • extranet extranet
  • wireless network any combination thereof.
  • the customer gateway device 402 may be any device configured to act as an entrance, or "gateway," to a network 404.
  • the customer gateway 402 may be configured to convert data originating in a customer computer system into data packets that may be transmitted over the network 404 to an intended recipient (e.g., in this case, the computing resource service provider 408). Additionally, the customer gateway device 402 may be configured to receive any data packets transmitted through the network 404 and to convert these data packets into data that is readable by a customer computer system.
  • the customer gateway device 402 may be configured to use a suite of communications protocols, such as the Transmission Control Protocol/Internet Protocol (TCP/IP), to transmit data packets to the computing resource service provider 408.
  • TCP/IP Transmission Control Protocol/Internet Protocol
  • the IP component may provide routing from the customer computer system to the computing resource service provider 408 through the Internet. This may be accomplished through the use of IP addresses (e.g., IPv4 or IPv6 addresses) that may correspond to the customer computer system and the computing resource service provider 408 systems.
  • IP addresses e.g., IPv4 or IPv6 addresses
  • the TCP component may be responsible for verifying the correct delivery of data from the customer to the computing resource service provider 408.
  • the customer computer systems and the computing resource service provider 408 computing systems may additionally use an additional network protocol to identify the most efficient or expedient pathway for routing data packets.
  • the various computer systems may utilize a border gateway protocol (BGP) in order to exchange routing information in the network 404.
  • BGP border gateway protocol
  • the customer computer systems and computing resource service provider computer systems may use BGP to determine the available gateway devices (e.g., routers) available to transmit and receive data packets sent over the network 404 (e.g., Internet).
  • the computer systems using BGP may rely on TCP/IP in order to transmit the data packets through the various routers connected to the computer systems and that support the network 404.
  • the protocol used to connect the customer gateway device 402 to the computing resource service provider 408 through the network 404 may include a security protocol necessary to verify that the customer and computing resource service provider are authorized to participate in the secure connection 406.
  • the secure connection 406 may be a virtual private network (VPN) operated through one or more secure tunnels (e.g., Internet Protocol Security (IPsec) tunnels using one or more encryption methods).
  • IPsec Internet Protocol Security
  • the computing resource service provider may transmit an authentication request to the customer to determine whether the customer has the authority to participate in this secure connection 406.
  • the customer through the customer gateway device 402 may transmit a data packet comprising the IP address of an authentication service provided by the computing resource service provider 408 and authentication proof (e.g., password, digital signature, etc.) subject to the security protocol.
  • the authentication service provided by the computing resource service provider 408 receives the data packet from the customer gateway device 402, the
  • the computing resource service provider 408 may transmit a data packet comprising the IP address of the customer computing system and an authentication credential (e.g., digital signature, password, etc.) subject to the security protocol. If the authentication credential received is inadequate, the customer may transmit one or more executable commands to the customer gateway device 402 to limit or terminate the secure connection 406 to the computing resource service provider 408.
  • FIG. 5 is an illustrative example of an environment 500 in which a physical connection is authenticated in accordance with at least one embodiment.
  • a customer may submit a request to a computing resource service provider 504 to establish a direct connection with the computing resource service provider.
  • the computing resource service provider 504 may generate a letter of authority to physically connect a customer router 502 to a computing resource service provider router 506.
  • a data technician may be deployed to establish the physical connection, as illustrated in FIG. 2.
  • the computing resource service provider 504 may utilize an authentication service 508 to verify that the customer
  • the authentication service 508 may be configured to transmit an authentication request through the computing resource service provider router 506.
  • the computing resource service provider router 506 may be configured to transmit this authentication request using a security protocol, as described above, to elicit a response from the customer.
  • the customer router 502 may receive this authentication request and transmit the request to one or more customer computer systems for processing.
  • the one or more customer computer systems may be configured to prepare a data packet comprising the necessary authentication proof (e.g., password, digital signature, etc.) to verify the identity of the customer, along with any other requisite information necessary to access the other services 512 available to the customer.
  • This data packet may be transmitted to the customer router 506, which, in turn, may utilize the security protocol to transmit the data packet comprising the authentication proof.
  • the computing resource service provider router 506 may transmit the received customer data packet to the authentication service 508 for verification.
  • the authentication service 508 may be configured to extract the authentication proof from the data packet.
  • the authentication proof may include a digital signature which may need to be verified using a hash of the received data and a cryptographic key maintained by the computing resource service provider and specific to the customer.
  • the authentication service 508 may be configured to interact with an account service 510 managed by the computing resource service provider 504 to obtain relevant customer information.
  • the account service 510 as illustrated above, may comprise customer account information for each customer of the computing resource service provider 504.
  • the authentication service 508 may use the cryptographic keys from the account service 510, along with data received from the customer, to generate an expected customer digital signature and attempt to match this signature with the customer authentication proof. If there is a resulting match between the digital signatures, the authentication service 508 may transmit one or more executable commands to the computing resource service provider router 506 to allow the customer to access the other services 512 provided by the computing resource service provider 504. However, if no match can be established, the authentication service 508 may transmit an informative message to the customer comprising the reason why access to the other services 512 has been denied.
  • the customer may generate one or more data packets comprising customer information and a digital signature, such as through one or more appropriately configured API calls to the service, which may be used to verify the identity of the customer.
  • These data packets may be transmitted over the physical connection using an authentication protocol to the computing resource service provider router 506.
  • This router 506 may be configured to transfer these data packets to an authentication service 508 for further processing.
  • the authentication service 508 may be configured to interact with an account service 510 in order to obtain one or more cryptographic keys necessary to generate an expected customer digital signature. Accordingly, the authentication service 508 may be configured to hash the cryptographic keys and the received customer data to generate this expected customer digital signature. This signature may be compared with the received customer digital signature to determine if there is a match. If there is a match, the customer transmissions may be deemed authentic, causing the authentication service 508 to transmit one or more executable instructions to the provider router 506 to enable the customer to access the one or more other services 512 provided by the computing resource service provider 504. For instance, if the customer transmissions are deemed to be authentic, the computing resource service provider 504 may allow a customer to provision one or more virtual interfaces to access these other services 512.
  • the customer may now access a variety of services offered by the computing resource service provider.
  • the customer may utilize the one or more services 612 for his/her purposes.
  • the authentication service 608 may transmit an authentication request to the customer, via the computing resource service provider router 606 and the customer router 602, to ensure that the connection has not been compromised (e.g., a third party has intercepted the connection, etc.).
  • the customer may use one or more computer systems maintained and operated by the customer to transmit authentication proof necessary to satisfy the received authentication request.
  • This authentication proof may be transmitted through the customer router 602.
  • the authentication proof may include a password, digital signature or any other credential requested in the authentication request.
  • This authentication proof may be transmitted in one or more data packets configured according to a security protocol to the computing resource service provider 604.
  • the computing resource service provider router 606 may receive this authentication proof and accordingly deliver the proof to the authentication service 608 for verification.
  • the authentication service 608 may be configured to interact with an account service 610 to obtain relevant customer information (e.g., cryptographic keys, customer account credentials, etc.) necessary to evaluate the received authentication proof. If the authentication proof provided by the customer is confirmed to be authentic, the authentication service 608 may allow continued customer access to the other services 612. However, if the provided authentication proof does not comport with the relevant customer information obtained from the account service 610, the authentication service 608 may transmit one or more executable instructions to the computing resource service provider router 606 to limit customer access to the other services 612 provided by the computing resource service provider 604.
  • relevant customer information e.g., cryptographic keys, customer account credentials, etc.
  • the computing resource service provider router 606 may be configured to reduce the available connection bandwidth to the customer or terminate the connection or the virtual interface altogether.
  • the authentication service 608 may be configured to again interact with the account service 610 to identify one or more actions that may be taken in the event of a failed authentication challenge.
  • the customer may specify that the computing resource service provider 604 is to monitor and log all activities related to a user purporting to be the customer that is accessing the other services 612.
  • the computer systems operated by the customer may transmit one or more authentication requests to the computing resource service provider to ensure that the connection has not been compromised.
  • the request may be transmitted to the authentication service 608 for processing.
  • the authentication service 608 may be configured to interact with the account service 610 to obtain the relevant customer information, including, but not limited to, one or more cryptographic keys necessary to generate authentication proof to satisfy the customer authentication request.
  • the authentication service 608 may be configured to use a hash function to hash data and the cryptographic key to generate a digital signature.
  • the authentication service 608 may generate one or more data packets that may comprise the authentication proof (e.g., digital signature) along with other data that may be transmitted to the customer computer systems via the physical connection between the computing resource service provider router 606 and the customer router 602.
  • the authentication proof e.g., digital signature
  • the customer computing systems may be configured to transmit executable commands that may cause the customer router 602 to terminate the connection. This may include generating a request for a data technician to sever the physical connection or the complete ceasing of transmission of one or more signals through the physical connection. However, if the authentication proof is adequate, such that the connection with the computing resource service provider 604 is indeed authentic, the customer may continue to utilize the physical connection to access the one or more other services 612 necessary to support its business.
  • the customer may generate additional data packets comprising cryptographic authentication information, such as through one or more appropriately configured API calls to the service, which may be used to verify the identity of the customer.
  • these data packets may be transmitted over the physical connection using an authentication protocol to the computing resource service provider router 606.
  • This router 606 may be configured to transfer these data packets to an authentication service 608 for further processing.
  • FIG. 7 is an illustrative example of a process 700 for establishing a physical connection between a customer and a computing resource service provider in accordance with at least one embodiment.
  • the process 700 may be performed by a variety of networking and computing components operated by the computing resource service provider, as well as one or more services maintained and operated by the computing resource service provider (e.g., authentication and account services).
  • the computing resource service provider may generate 704 a letter of authority to connect the customer router to the computing resource service provider router.
  • the customer routers and the computing resource service provider routers may be located in a data center or colocation center.
  • the letter of authority may grant a data technician (e.g., employee of the computing resource service provider, customer or contracted third party) permission to establish the connection between the customer router and the computing resource service provider router.
  • the data technician may use one or more cables to connect 706 the physical routers. This may entail identifying the customer and computing resource service provider routers within the colocation center and the corresponding ports required to establish the connection.
  • the data technician may insert one end of a set of cables (e.g., fiber-optic, copper, or other material) in a receiving and transmission port of the customer router and connect the other end of the cables to a receiving and transmission port of the computing resource service provider.
  • a set of cables e.g., fiber-optic, copper, or other material
  • the data technician may connect the cables from the customer router, through the patch panels, and from the final patch panel ports to the computing resource service provider router.
  • the data technician may use a diagnostic tool to ensure proper connectivity or may contact the computing resource service provider to inform the computing resource service provider that the connection has been established.
  • the customer and/or provider may change a network device port used to establish a direct physical connection.
  • the customer may request an upgrade of an existing physical connection (e.g., transition from a one gigabyte port to a ten gigabyte port on a computing resource service provider router) resulting in a different connection between the customer router and the computing resource service provider router.
  • the authentication process may be repeated once the connection has been established without any systemic changes to the process. This may ensure that the authentication process is port independent.
  • the computing resource service provider may use the router to transmit 708 one or more signals to the customer router.
  • the computing resource service provider may operate and maintain an authentication service, which may be configured to transmit authentication requests to a customer in order to verify that the customer is authorized to connect to one or more services provided by the computing resource service provider.
  • the authentication service may be configured to generate one or more data packets subject to a security protocol comprising this authentication request. These data packets may be transmitted by the computing resource service provider router to the customer router via the physical connection established in the colocation center.
  • the customer router may transmit these data packets to the customer computing systems for processing.
  • the customer computer systems may be configured to utilize a hash function and a cryptographic key to generate a digital signature.
  • the digital signature may comprise the authentication proof necessary to satisfy the authentication request. Accordingly, the customer computer systems may be configured to generate one or more data packets comprising the
  • the data packets comprising the customer authentication proof may be transmitted to the computing resource service provider through the physical connection using the customer router. Accordingly, the computing resource service provider may receive 710 the signals comprising the customer data packets from the customer router. The signals originating from the customer router may be received by the computing resource service provider router, which may be configured to decompose the signals from the customer and extract the one or more data packets. The data packets, which may be addressed to the authentication service, may be transmitted to the authentication service for processing.
  • the authentication service may be configured to extract the customer authentication proof (e.g., digital signature) from the received data packets in order to verify the identity of the customer.
  • the authentication service may attempt to authenticate 712 the digital signature received through the physical connection.
  • the authentication service may be configured to interact with an account service in order to obtain relevant customer information.
  • the authentication service may obtain one or more customer cryptographic keys (e.g., a customer key generated using one or more cryptographic methods, such as elliptic-curve cryptography) from the account service in order to verify the authentication proof.
  • the authentication service may be configured to hash the customer data received, along with the cryptographic key, to generate an expected customer digital signature. If this expected customer digital signature matches the received digital signature from the customer, then the signals are authentic and the customer identity is verified.
  • the authentication service may enable 714 the customer to access the one or more services provided by the computing resource service provider.
  • the authentication service may be configured to transmit one or more executable instructions to the computing resource service provider router to re-configure the router to allow the customer to transmit one or more signals to access the one or more services.
  • the computing resource service provider router may be configured to allow any data packets comprising a recipient IP address of one or more services to be delivered to the one or more services.
  • the authentication service may be configured to verify that the customer has the authority to access the one or more services provided by the computing resource service provider after the physical connection between the customer and the computing resource service provider has been established.
  • FIG. 8 is an illustrative example of a process 800 for authenticating a connection for the first time in accordance with at least one embodiment.
  • the computing resource service provider and customer may establish a physical connection through the use of routers located in a co location center. Once the physical connection has been established, there is a risk that an unauthorized third party may interfere with the connection (e.g., attempt to impersonate the customer and access customer information).
  • the computing resource service provider may include an authentication service that may be configured to transmit 802 an authentication request to the customer to verify the customer has the authority to access the requested services.
  • the authentication service may be configured to generate one or more data packets comprising the authentication request which may be sent through the physical connection. These data packets may additionally be configured according to a security protocol in addition to other standard protocols (e.g., TCP/IP, IPsec, etc.) such that the data packets may be processed by the customer computer systems and the transmission is secure. Accordingly, the authentication service may be configured to transmit these data packets to the computing resource service provider router which, in turn, may transmit the data packets to the customer.
  • a security protocol in addition to other standard protocols (e.g., TCP/IP, IPsec, etc.) such that the data packets may be processed by the customer computer systems and the transmission is secure.
  • the authentication service may be configured to transmit these data packets to the computing resource service provider router which, in turn, may transmit the data packets to the customer.
  • the customer may receive these data packets through the customer router that may be physically connected to the computing resource service provider router in the co location center. Accordingly, the data packets may be transmitted to one or more customer computer systems for processing, such that the one or more computer systems may generate one or more data packets in response to the request comprising the necessary authentication proof to verify that the customer has the authority to access the services provided by the computing resource service provider. As is the case with the data packets generated using the authentication service, the one or more customer computer systems may be configured to generate one or more data packets configured according to the security protocol in addition to the other standard protocols. Thus, these data packets may be transmitted from the customer router to the computing resource service provider router for processing.
  • the computing resource service provider may transmit the one or more data packets received from the customer to the authentication service.
  • the authentication service may be configured to receive 804 the authentication proof from the customer. Based on the type of authentication proof requested, the authentication service may be configured to interact with an account service to obtain customer account information necessary to verify the authentication proof. For instance, the authentication service may obtain a cryptographic key associated with the customer account to generate an expected customer digital signature which may be used to determine whether the digital signature received from the customer is authentic.
  • the authentication service may be configured to use the cryptographic key to generate an expected customer digital signature to compare to the received digital signature from the customer to determine whether there is a match. Accordingly, the authentication service may be configured to determine 806 whether the customer
  • authentication service may deny 810 the customer access to the services provided by the computing resource service provider.
  • the authentication service may be configured to transmit one or more executable commands to the computing resource service provider router which may cause the router to reject any data packets from the customer that may be addressed to these one or more services.
  • the configuration of the computing resource service provider router during the initial physical connection includes automatically rejected any data packets addressed to the one or more services, the
  • authentication service may not transmit any additional instructions to the router. Thus, the router may continue to reject these data packets from the customer.
  • FIG. 9 is an illustrative example of a process 900 for authenticating a connection after a connection has been previously established in accordance with at least one embodiment.
  • an authentication service may be configured to transmit 902 an authentication request to a customer. This authentication requested may be transmitted in one or more data packets configured according to one or more communications protocols (e.g., TCP/IP) and a security protocol necessary for the security of the physical connection.
  • communications protocols e.g., TCP/IP
  • the customer may operate one or more computer systems configured to further operations of the customer's business. Accordingly, these one or more computer systems may be configured to process the authentication request and generate one or more data packets comprising the necessary authentication proof to satisfy the request.
  • the authentication proof may include one or more customer credentials (e.g., passwords, digital signatures, etc.).
  • the data packets generated using the customer computing systems may be configured to one or more communications protocols and a security protocol. These data packets may be delivered using a customer router which may be directly (e.g., through physical cables in a colocation center) connected to a computing resource service provider router.
  • the computing resource service provider router may thus be configured to receive 904 the data packets comprising the authentication proof and transmit these data packets to the authentication service operated by the computing resource service provider.
  • the authentication service may be configured to interact with an account service operated by the computing resource service provider to obtain necessary information to verify the authentication proof. This may enable the authentication service to determine 906 whether the customer authentication proof is authentic. For instance, the authentication service may obtain one or more cryptographic keys necessary to generate an expected customer digital signature which may be used to verify the received digital signature from the customer.
  • the authentication service may further determine 908 whether the customer currently has access to the one or more services provided by the computing resource service provider. If the computing resource service provider has previously established a connection between the customer and these services, the authentication service may be configured to continue to allow the customer to access these services. Accordingly, the authentication service may be configured to transmit 902 another authentication request to the customer in order to ensure the connection has not been compromised. These subsequent requests may be made at a later time, based at least in part on the configuration of the authentication service.
  • the authentication service may establish 910 a connection between the customer and these services.
  • the authentication service may be configured to transmit one or more executable instructions to the computing resource service provider router that causes the router to permit any data packets originating from a customer computer system to be transmitted to the one or more services.
  • the authentication service may continue to transmit 902 authentication requests to the customer to ensure the connection has not been compromised. These subsequent requests may be made daily, weekly, monthly or at varying time intervals, dependent upon the configuration of the authentication service.
  • the authentication service may further determine 912 whether to limit the customer's access to the one or more services provided by the computing resource service provider.
  • the computing resource service provider may allow a customer to define what actions may be taken in the event the connection has been compromised.
  • the customer may specify that the connection should be terminated upon a potential breach.
  • a customer may prefer to allow the connection to continue uninterrupted while logging all transmissions between the purported customer (e.g., unauthorized third party, etc.) and the computing resource service provider.
  • the authentication service may transmit one or more executable instructions to the computing resource service provider router to restore the access to the one or more services.
  • the customer and the computing resource service provider may resolve the issue with the connection, be it an unauthorized third party, expiration of a credential or some other issue, and restore the connection.
  • FIG. 10 is an illustrative example of a process 1000 for authenticating a connection in accordance with at least one embodiment.
  • the customer may desire to verify the identity of the party at the other end of the connection prior to transmitting potentially sensitive customer data to the one or more services. Accordingly, the customer may configure one or more computer systems to transmit 1002 an authentication request to the computing resource service provider. As noted above, the customer computing systems may be configured to generate one or more data packets configured according to one or more communications protocols and a security protocol necessary to transmit these data packets over the secure connection. These data packets may comprise an authentication request and customer identification data. Thus, the customer computer systems may transfer these data packets to a customer router which may be configured to transmit these data packets to the computing resource service provider router on the other end of the physical connection. [0091] Accordingly, the authentication request may be delivered to an authentication service operated by the computing resource service provider for processing. The
  • authentication service may be configured to interact with an account service to access the customer account and locate the necessary information to fulfill the request. For example, the authentication service may obtain a cryptographic key from the customer account in order to generate a digital signature which may be used as authentication proof.
  • the authentication service may be configured to generate one or more data packets comprising the information necessary to fulfill the request and transmit these data packets, through the computing resource service provider router to the one or more customer computing systems. In this fashion, the one or more customer computer systems may receive 1004 the authentication proof from the computing resource service provider.
  • a network device comprising: one or more communications ports configured to receive one or more signals from outside of the network device, including a communications port that is connected to a provider network that includes one or more services including an authentication service; one or more processors that are operatively coupled with the one or more
  • memory including instructions executable by the one or more processors that when executed by the one or more processors cause the one or more processors to: forward cryptographic authentication information received over a connection from a customer device connected to one or more communications ports to an authentication service that is operable to authenticate the cryptographic authentication information; receive reconfiguration information, from the authentication service as a result of the authentication service having successfully authenticated the cryptographic information, to enable the network device to forward data from the customer device to one or more services of the computing resource service provider; and reconfigure to forward data from the customer device to the one or more services of the computing resource service provider in accordance with the reconfiguration information.
  • connection is a secure tunnel over a public communications network.
  • FIG. 11 illustrates aspects of an example environment 1100 for implementing aspects in accordance with various embodiments.
  • the environment includes an electronic client device 1102, which can include any appropriate device operable to send and receive requests, messages or information over an appropriate network 1104 and convey information back to a user of the device.
  • client devices include personal computers, cell phones, handheld messaging devices, laptop computers, tablet computers, set-top boxes, personal data assistants, embedded computer systems, electronic book readers and the like.
  • the network can include any appropriate network, including an intranet, the Internet, a cellular network, a local area network or any other such network or combination thereof.
  • the application server can include any appropriate hardware and software for integrating with the data store as needed to execute aspects of one or more applications for the client device, handling some (even a majority) of the data access and business logic for an application.
  • the application server may provide access control services in cooperation with the data store and is able to generate content such as text, graphics, audio and/or video to be transferred to the user, which may be served to the user by the web server in the form of HyperText Markup Language (“HTML”), Extensible Markup Language (“XML”) or another appropriate structured language in this example.
  • HTML HyperText Markup Language
  • XML Extensible Markup Language
  • the handling of all requests and responses, as well as the delivery of content between the client device 1102 and the application server 1108, can be handled by the web server.
  • the data store 1110 is operable, through logic associated therewith, to receive instructions from the application server 1108 and obtain, update or otherwise process data in response thereto.
  • a user through a device operated by the user, might submit a search request for a certain type of item.
  • the data store might access the user information to verify the identity of the user and can access the catalog detail information to obtain information about items of that type.
  • the information then can be returned to the user, such as in a results listing on a web page that the user is able to view via a browser on the user device 1102.
  • Information for a particular item of interest can be viewed in a dedicated page or window of the browser. It should be noted, however, that embodiments of the present disclosure are not necessarily limited to the context of web pages, but may be more generally applicable to processing requests in general, where the requests are not necessarily requests for content.
  • the various embodiments further can be implemented in a wide variety of operating environments, which in some cases can include one or more user computers, computing devices or processing devices which can be used to operate any of a number of applications.
  • User or client devices can include any of a number of general purpose personal computers, such as desktop, laptop or tablet computers running a standard operating system, as well as cellular, wireless and handheld devices running mobile software and capable of supporting a number of networking and messaging protocols.
  • Such a system also can include a number of workstations running any of a variety of commercially-available operating systems and other known applications for purposes such as development and database management.
  • These devices also can include other electronic devices, such as dummy terminals, thin-clients, gaming systems and other devices capable of communicating via a network.
  • the network can be, for example, a local area network, a wide-area network, a virtual private network, the Internet, an intranet, an extranet, a public switched telephone network, an infrared network, a wireless network and any combination thereof.
  • the web server can run any of a variety of server or mid-tier applications, including Hypertext Transfer Protocol ("HTTP") servers, FTP servers, Common Gateway Interface (“CGI”) servers, data servers, Java servers and business application servers.
  • HTTP Hypertext Transfer Protocol
  • CGI Common Gateway Interface
  • the server(s) also may be capable of executing programs or scripts in response to requests from user devices, such as by executing one or more web applications that may be implemented as one or more scripts or programs written in any programming language, such as Java ® , C, C# or C++, or any scripting language, such as Perl, Python or TCL, as well as combinations thereof.
  • the server(s) may also include database servers, including without limitation those commercially available from Oracle ® , Microsoft ® , Sybase ® and IBM ® .
  • the environment can include a variety of data stores and other memory and storage media as discussed above. These can reside in a variety of locations, such as on a storage medium local to (and/or resident in) one or more of the computers or remote from any or all of the computers across the network. In a particular set of embodiments, the information may reside in a storage-area network ("SAN") familiar to those skilled in the art. Similarly, any necessary files for performing the functions attributed to the computers, servers or other network devices may be stored locally and/or remotely, as appropriate.
  • SAN storage-area network
  • each such device can include hardware elements that may be electrically coupled via a bus, the elements including, for example, at least one central processing unit (“CPU” or “processor”), at least one input device (e.g., a mouse, keyboard, controller, touch screen or keypad) and at least one output device (e.g., a display device, printer or speaker).
  • CPU central processing unit
  • input device e.g., a mouse, keyboard, controller, touch screen or keypad
  • output device e.g., a display device, printer or speaker
  • Such a system may also include one or more storage devices, such as disk drives, optical storage devices and solid-state storage devices such as random access memory (“RAM”) or read-only memory (“ROM”), as well as removable media devices, memory cards, flash cards, etc.
  • RAM random access memory
  • ROM read-only memory
  • Such devices can include a computer-readable storage media reader, a communications device (e.g., a modem, a network card (wireless or wired), an infrared communication device, etc.) and working memory as described above.
  • the computer- readable storage media reader can be connected with, or configured to receive, a computer- readable storage medium, representing remote, local, fixed and/or removable storage devices as well as storage media for temporarily and/or more permanently containing, storing, transmitting and retrieving computer-readable information.
  • the system and various devices also typically will include a number of software applications, modules, services or other elements located within at least one working memory device, including an operating system and application programs, such as a client application or web browser.
  • containing are to be construed as open-ended terms (i.e., meaning “including, but not limited to,”) unless otherwise noted.
  • the term "connected,” when unmodified and referring to physical connections, is to be construed as partly or wholly contained within, attached to or joined together, even if there is something intervening. Recitation of ranges of values herein are merely intended to serve as a shorthand method of referring individually to each separate value falling within the range, unless otherwise indicated herein and each separate value is incorporated into the specification as if it were individually recited herein.
  • the use of the term “set” (e.g., “a set of items”) or “subset” unless otherwise noted or contradicted by context, is to be construed as a nonempty collection comprising one or more members.
  • corresponding set does not necessarily denote a proper subset of the corresponding set, but the subset and the corresponding set may be equal.
  • At least one of A, B, and C and “at least one of A, B and C” refers to any of the following sets: ⁇ A ⁇ , ⁇ B ⁇ , ⁇ C ⁇ , ⁇ A, B ⁇ , ⁇ A, C ⁇ , ⁇ B, C ⁇ , ⁇ A, B, C ⁇ .
  • conjunctive language is not generally intended to imply that certain embodiments require at least one of A, at least one of B and at least one of C to each be present.
  • Processes described herein can be performed in any suitable order unless otherwise indicated herein or otherwise clearly contradicted by context.
  • Processes described herein may be performed under the control of one or more computer systems configured with executable instructions and may be implemented as code (e.g., executable instructions, one or more computer programs or one or more applications) executing collectively on one or more processors, by hardware or combinations thereof.
  • the code may be stored on a computer-readable storage medium, for example, in the form of a computer program comprising a plurality of instructions executable by one or more processors.
  • the computer-readable storage medium may be non-transitory.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Environmental & Geological Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)
  • Telephonic Communication Services (AREA)
PCT/US2014/055874 2013-09-17 2014-09-16 Network connection automation Ceased WO2015042046A1 (en)

Priority Applications (6)

Application Number Priority Date Filing Date Title
CN201480050814.4A CN105556894B (zh) 2013-09-17 2014-09-16 用于网络连接自动化的方法和系统
EP14845785.6A EP3047602A4 (en) 2013-09-17 2014-09-16 Network connection automation
JP2016542872A JP6656157B2 (ja) 2013-09-17 2014-09-16 ネットワーク接続自動化
CA2923431A CA2923431C (en) 2013-09-17 2014-09-16 Network connection automation
SG11201601797TA SG11201601797TA (en) 2013-09-17 2014-09-16 Network connection automation
EP19204080.6A EP3654612B1 (en) 2013-09-17 2014-09-16 Network connection automation

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US14/029,496 2013-09-17
US14/029,496 US9692732B2 (en) 2011-11-29 2013-09-17 Network connection automation

Publications (1)

Publication Number Publication Date
WO2015042046A1 true WO2015042046A1 (en) 2015-03-26

Family

ID=52690022

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2014/055874 Ceased WO2015042046A1 (en) 2013-09-17 2014-09-16 Network connection automation

Country Status (7)

Country Link
US (4) US9692732B2 (enExample)
EP (2) EP3047602A4 (enExample)
JP (3) JP6656157B2 (enExample)
CN (1) CN105556894B (enExample)
CA (1) CA2923431C (enExample)
SG (1) SG11201601797TA (enExample)
WO (1) WO2015042046A1 (enExample)

Families Citing this family (42)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10181953B1 (en) 2013-09-16 2019-01-15 Amazon Technologies, Inc. Trusted data verification
US9237155B1 (en) 2010-12-06 2016-01-12 Amazon Technologies, Inc. Distributed policy enforcement with optimizing policy transformations
US8769642B1 (en) 2011-05-31 2014-07-01 Amazon Technologies, Inc. Techniques for delegation of access privileges
US9197409B2 (en) 2011-09-29 2015-11-24 Amazon Technologies, Inc. Key derivation techniques
US9203613B2 (en) 2011-09-29 2015-12-01 Amazon Technologies, Inc. Techniques for client constructed sessions
US9178701B2 (en) 2011-09-29 2015-11-03 Amazon Technologies, Inc. Parameter based key derivation
US8739308B1 (en) 2012-03-27 2014-05-27 Amazon Technologies, Inc. Source identification for unauthorized copies of content
US8892865B1 (en) 2012-03-27 2014-11-18 Amazon Technologies, Inc. Multiple authority key derivation
US9215076B1 (en) 2012-03-27 2015-12-15 Amazon Technologies, Inc. Key generation for hierarchical data access
US9258118B1 (en) 2012-06-25 2016-02-09 Amazon Technologies, Inc. Decentralized verification in a distributed system
US9660972B1 (en) 2012-06-25 2017-05-23 Amazon Technologies, Inc. Protection from data security threats
US9407440B2 (en) 2013-06-20 2016-08-02 Amazon Technologies, Inc. Multiple authority data security and access
US9521000B1 (en) 2013-07-17 2016-12-13 Amazon Technologies, Inc. Complete forward access sessions
US9237019B2 (en) 2013-09-25 2016-01-12 Amazon Technologies, Inc. Resource locators with keys
US9311500B2 (en) 2013-09-25 2016-04-12 Amazon Technologies, Inc. Data security using request-supplied keys
US10243945B1 (en) 2013-10-28 2019-03-26 Amazon Technologies, Inc. Managed identity federation
US9420007B1 (en) * 2013-12-04 2016-08-16 Amazon Technologies, Inc. Access control using impersonization
US9369461B1 (en) 2014-01-07 2016-06-14 Amazon Technologies, Inc. Passcode verification using hardware secrets
US9292711B1 (en) 2014-01-07 2016-03-22 Amazon Technologies, Inc. Hardware secret usage limits
US9374368B1 (en) 2014-01-07 2016-06-21 Amazon Technologies, Inc. Distributed passcode verification system
US9270662B1 (en) 2014-01-13 2016-02-23 Amazon Technologies, Inc. Adaptive client-aware session security
US10771255B1 (en) 2014-03-25 2020-09-08 Amazon Technologies, Inc. Authenticated storage operations
US9258117B1 (en) 2014-06-26 2016-02-09 Amazon Technologies, Inc. Mutual authentication with symmetric secrets and signatures
US10326597B1 (en) 2014-06-27 2019-06-18 Amazon Technologies, Inc. Dynamic response signing capability in a distributed system
US10122692B2 (en) 2015-06-16 2018-11-06 Amazon Technologies, Inc. Handshake offload
US10122689B2 (en) 2015-06-16 2018-11-06 Amazon Technologies, Inc. Load balancing with handshake offload
US10148675B1 (en) 2016-03-30 2018-12-04 Amazon Technologies, Inc. Block-level forensics for distributed computing systems
US10333962B1 (en) * 2016-03-30 2019-06-25 Amazon Technologies, Inc. Correlating threat information across sources of distributed computing systems
US10178119B1 (en) 2016-03-30 2019-01-08 Amazon Technologies, Inc. Correlating threat information across multiple levels of distributed computing systems
US10303623B2 (en) * 2016-04-08 2019-05-28 Cryptography Research, Inc. Non-volatile memory for secure storage of authentication data
US10116440B1 (en) 2016-08-09 2018-10-30 Amazon Technologies, Inc. Cryptographic key management for imported cryptographic keys
WO2018079554A1 (ja) * 2016-10-24 2018-05-03 株式会社アドバンス オーナーチェックシステム
US10135899B1 (en) * 2016-12-16 2018-11-20 Amazon Technologies, Inc. Dynamic archiving of streaming content
US11217344B2 (en) * 2017-06-23 2022-01-04 Abiomed, Inc. Systems and methods for capturing data from a medical device
WO2019113012A1 (en) * 2017-12-05 2019-06-13 RELAY WIRELESS NETWORK, LLC d/b/a AERWAVE Adaptive and dynamic network provisioning
US11075906B2 (en) 2017-12-28 2021-07-27 Shoppertrak Rct Corporation Method and system for securing communications between a lead device and a secondary device
CN109474588A (zh) * 2018-11-02 2019-03-15 杭州迪普科技股份有限公司 一种终端认证方法及装置
JP7551775B2 (ja) * 2020-05-05 2024-09-17 アレックス ブレイト， 信頼されるデジタル製造のためのエンドポイントおよびプロトコル
CN111881431B (zh) 2020-06-28 2023-08-22 百度在线网络技术（北京）有限公司 人机验证方法、装置、设备及存储介质
CN113438242B (zh) * 2021-06-25 2023-08-29 广西三方大供应链技术服务有限公司 服务鉴权方法、装置与存储介质
JP2023056740A (ja) * 2021-10-08 2023-04-20 エヌ・ティ・ティ・コミュニケーションズ株式会社 経路制御システム、経路制御装置、デバイス管理装置、経路制御方法、及びプログラム
US12294855B2 (en) * 2022-06-30 2025-05-06 Verizon Patent And Licensing Inc. Systems and methods for authenticating users for subscribed services

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6198824B1 (en) * 1997-02-12 2001-03-06 Verizon Laboratories Inc. System for providing secure remote command execution network
US20020009092A1 (en) * 2000-03-02 2002-01-24 Seaman Michael J. Broadband tree-configured ring for metropolitan area networks
US20040066769A1 (en) * 2002-10-08 2004-04-08 Kalle Ahmavaara Method and system for establishing a connection via an access network
US20050063400A1 (en) 2003-09-24 2005-03-24 Lum Stacey C. Systems and methods of controlling network access
US7039713B1 (en) * 1999-11-09 2006-05-02 Microsoft Corporation System and method of user authentication for network communication through a policy agent
US20070234054A1 (en) * 2006-03-31 2007-10-04 Alcatel System and method of network equipment remote access authentication in a communications network
WO2013081962A1 (en) 2011-11-29 2013-06-06 Amazon Technologies, Inc. Interfaces to manage direct network peerings

Family Cites Families (95)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5361062A (en) * 1992-11-25 1994-11-01 Security Dynamics Technologies, Inc. Personal security system
US5896511A (en) 1995-07-19 1999-04-20 Fujitsu Network Communications, Inc. Method and apparatus for providing buffer state flow control at the link level in addition to flow control on a per-connection basis
US6311218B1 (en) * 1996-10-17 2001-10-30 3Com Corporation Method and apparatus for providing security in a star network connection using public key cryptography
US7890581B2 (en) * 1996-12-16 2011-02-15 Ip Holdings, Inc. Matching network system for mobile devices
EP1002398A1 (en) 1998-06-08 2000-05-24 Gatespace AB Application and communication platform for connectivity based services
US20030236745A1 (en) 2000-03-03 2003-12-25 Hartsell Neal D Systems and methods for billing in information management environments
US7272643B1 (en) * 2000-09-13 2007-09-18 Fortinet, Inc. System and method for managing and provisioning virtual routers
JP2002108818A (ja) 2000-09-26 2002-04-12 International Network Securitiy Inc データセンター、セキュリティポリシー作成方法及びセキュリティシステム
US8670446B2 (en) * 2001-01-30 2014-03-11 At&T Intellectual Property Ii, L.P. Technique for Ethernet access to packet-based services
US7107312B2 (en) 2001-02-06 2006-09-12 Lucent Technologies Inc. Apparatus and method for use in a data/conference call system for automatically collecting participant information and providing all participants with that information for use in collaboration services
US6639919B2 (en) 2001-05-01 2003-10-28 Adc Dsl Systems, Inc. Bit-level control for dynamic bandwidth allocation
US6842628B1 (en) * 2001-08-31 2005-01-11 Palmone, Inc. Method and system for event notification for wireless PDA devices
US7292577B1 (en) 2001-09-19 2007-11-06 Cisco Technology, Inc. End-to-end preservation of VLAN priority in connection-oriented networks
US20030074443A1 (en) 2001-10-15 2003-04-17 Makonnen Melaku Last mile quality of service broker (LMQB) for multiple access networks
US6831969B2 (en) * 2002-04-04 2004-12-14 Innomedia Pre Ltd. Caller ID display system for telephony over a packet switched network
US7577154B1 (en) 2002-06-03 2009-08-18 Equinix, Inc. System and method for traffic accounting and route customization of network services
US20040003287A1 (en) * 2002-06-28 2004-01-01 Zissimopoulos Vasileios Bill Method for authenticating kerberos users from common web browsers
US7254643B1 (en) * 2002-08-08 2007-08-07 At&T Corp. System and method for providing multi-media services to communication devices over a communications network
US7359322B2 (en) 2002-08-12 2008-04-15 Telcordia Technologies, Inc. Dynamic bandwidth reallocation
US7233999B2 (en) 2003-01-28 2007-06-19 Altaf Hadi System and method for delivering last mile computing over light from a plurality of network edge locations
US20070256094A1 (en) * 2003-03-11 2007-11-01 Thomson Licensing Apparatus and Method for Distributing Signals by Down-Converting to Vacant Channels
JP2004318582A (ja) 2003-04-17 2004-11-11 Nippon Telegraph & Telephone East Corp ネットワークアクセスシステム及び方法、認証装置、エッジルータ、アクセス制御装置、ならびに、コンピュータプログラム
US7327682B2 (en) 2003-06-27 2008-02-05 Cisco Technology, Inc. Methods and devices for flexible bandwidth allocation
JP4009273B2 (ja) 2004-05-19 2007-11-14 松下電器産業株式会社 通信方法
EP1803262B1 (en) 2004-10-14 2010-08-18 Nxp B.V. Dynamic bandwidth sharing
US7644272B2 (en) * 2004-10-22 2010-01-05 Broadcom Corporation Systems and methods for providing security to different functions
US7453825B1 (en) * 2004-12-13 2008-11-18 Garrettcom, Inc. Apparatus and methods for point-to-point links in robust networks
US7743001B1 (en) 2005-06-21 2010-06-22 Amazon Technologies, Inc. Method and system for dynamic pricing of web services utilization
US8214450B2 (en) 2005-08-01 2012-07-03 Limelight Networks, Inc. Dynamic bandwidth allocation
US8429630B2 (en) 2005-09-15 2013-04-23 Ca, Inc. Globally distributed utility computing cloud
US7734516B2 (en) 2005-09-27 2010-06-08 International Business Machines Corporation Method for providing revisional delta billing and re-billing in a dynamic project environment
US8515387B2 (en) 2005-12-08 2013-08-20 At&T Intellectual Property I, Lp Method for segregating billable transactions in a multimode communication device
US7623548B2 (en) 2005-12-22 2009-11-24 At&T Intellectual Property, I,L.P. Methods, systems, and computer program products for managing access resources in an internet protocol network
CN101479984B (zh) * 2006-04-25 2011-06-08 斯蒂芬·L.·博伦 用于身份管理、验证服务器、数据安全和防止中间人攻击的动态分发密钥系统和方法
US20080028445A1 (en) * 2006-07-31 2008-01-31 Fortinet, Inc. Use of authentication information to make routing decisions
KR20090108044A (ko) * 2006-12-21 2009-10-14 심톤 코퍼레이션 서비스 체이닝 방법 및 장치
PL2293526T3 (pl) * 2007-02-05 2015-08-31 Koninklijke Kpn Nv Numeracja VLAN w sieciach dostępowych
JP5365512B2 (ja) * 2007-03-28 2013-12-11 日本電気株式会社 ソフトウェアｉｃカードシステム、管理サーバ、端末、サービス提供サーバ、サービス提供方法及びプログラム
US8230493B2 (en) 2007-05-02 2012-07-24 Cisco Technology, Inc. Allowing differential processing of encrypted tunnels
CN101682519A (zh) 2007-05-04 2010-03-24 阿尔卡特朗讯 用于对诸如推送邮件之类的服务进行计费的方法
US20080298374A1 (en) 2007-06-04 2008-12-04 At&T Knowledge Ventures, L.P. Apparatus for monitoring network connectivity
US7970903B2 (en) 2007-08-20 2011-06-28 Hitachi, Ltd. Storage and server provisioning for virtualized and geographically dispersed data centers
WO2009032957A2 (en) 2007-09-06 2009-03-12 Metabyte, Inc. Promoting a web technology through a virtual service marketplace
US20090112735A1 (en) 2007-10-25 2009-04-30 Robert Viehmann Content service marketplace solutions
US20090192945A1 (en) 2008-01-29 2009-07-30 Lionos GmbH Service marketplace system
US10372490B2 (en) 2008-05-30 2019-08-06 Red Hat, Inc. Migration of a virtual machine from a first cloud computing environment to a second cloud computing environment in response to a resource or services in the second cloud computing environment becoming available
EP2316071A4 (en) 2008-06-19 2011-08-17 Servicemesh Inc CLOUD DATA PROCESSING GATEWAY, CLOUD DATA PROCESSING HYPERVISOR, AND METHOD FOR IMPLEMENTING THEM
US7782884B2 (en) 2008-07-07 2010-08-24 Embarq Holdings Company, Llc System and method for adjusting bandwidth based on a time of day profile
US20100046381A1 (en) * 2008-08-22 2010-02-25 Paritosh Bajpay Method and apparatus for processing of an alarm related to a frame relay encapsulation failure
US8121118B2 (en) 2008-10-31 2012-02-21 At&T Intellectual Property I, L.P. Methods and apparatus to dynamically control connectivity within virtual private networks
US8069242B2 (en) 2008-11-14 2011-11-29 Cisco Technology, Inc. System, method, and software for integrating cloud computing systems
US10025627B2 (en) 2008-11-26 2018-07-17 Red Hat, Inc. On-demand cloud computing environments
US8782233B2 (en) 2008-11-26 2014-07-15 Red Hat, Inc. Embedding a cloud-based resource request in a specification language wrapper
US8411691B2 (en) * 2009-01-12 2013-04-02 Juniper Networks, Inc. Transfer of mobile subscriber context in cellular networks using extended routing protocol
US8243628B2 (en) 2009-01-30 2012-08-14 Embarq Holdings Company, Llc Free market based pricing for bandwidth and network usage
US20100226280A1 (en) 2009-03-03 2010-09-09 Erf Wireless, Inc. Remote secure router configuration
US9104986B2 (en) 2009-03-09 2015-08-11 Centurylink Intellectual Property Llc Customer premise equipment with access to free market based pricing for bandwidth on a communications network
US9501329B2 (en) 2009-05-08 2016-11-22 Rackspace Us, Inc. Methods and systems for cloud computing management
US8527774B2 (en) * 2009-05-28 2013-09-03 Kaazing Corporation System and methods for providing stateless security management for web applications using non-HTTP communications protocols
US20100319004A1 (en) 2009-06-16 2010-12-16 Microsoft Corporation Policy Management for the Cloud
US8244559B2 (en) 2009-06-26 2012-08-14 Microsoft Corporation Cloud computing resource broker
US20110022492A1 (en) * 2009-07-22 2011-01-27 Jeyhan Karaoguz Method and system for selecting services and/or content in a network comprising multiple service and/or content providers
US8966110B2 (en) 2009-09-14 2015-02-24 International Business Machines Corporation Dynamic bandwidth throttling
JP5278272B2 (ja) * 2009-09-29 2013-09-04 沖電気工業株式会社 ネットワーク通信装置及びその自動再接続方法
US8156546B2 (en) 2009-10-29 2012-04-10 Satyam Computer Services Limited Of Mayfair Centre System and method for flying squad re authentication of enterprise users
US20110131647A1 (en) 2009-11-30 2011-06-02 Scott Sanders Virtual Endpoint Solution
US9875671B2 (en) 2009-12-17 2018-01-23 Google Llc Cloud-based user interface augmentation
JP5660050B2 (ja) 2009-12-28 2015-01-28 日本電気株式会社 ユーザ情報活用システム、装置、方法およびプログラム
US8346935B2 (en) 2010-01-15 2013-01-01 Joyent, Inc. Managing hardware resources by sending messages amongst servers in a data center
WO2011091056A1 (en) 2010-01-19 2011-07-28 Servicemesh, Inc. System and method for a cloud computing abstraction layer
US8537815B2 (en) * 2010-06-17 2013-09-17 Apple Inc. Accelerating data routing
US8402530B2 (en) * 2010-07-30 2013-03-19 Microsoft Corporation Dynamic load redistribution among distributed servers
KR101700811B1 (ko) * 2010-09-02 2017-02-01 주식회사 케이티 이동형 사용자 단말 위치에 기반한 콘텐츠 연속 이용 제공 방법 및 서버
EP2630630A2 (en) 2010-10-21 2013-08-28 Net Power And Light, Inc. System architecture and method for composing and directing participant experiences
US10192246B2 (en) 2010-11-24 2019-01-29 Red Hat, Inc. Generating multi-cloud incremental billing capture and administration
US8893027B2 (en) * 2011-03-04 2014-11-18 Cisco Technology, Inc. Providing hosted virtual desktop infrastructure services
US8763097B2 (en) * 2011-03-11 2014-06-24 Piyush Bhatnagar System, design and process for strong authentication using bidirectional OTP and out-of-band multichannel authentication
CA2836194C (en) * 2011-06-03 2017-07-18 Blackberry Limited System and method for accessing private networks
US8832039B1 (en) * 2011-06-30 2014-09-09 Amazon Technologies, Inc. Methods and apparatus for data restore and recovery from a remote data store
CN103067416A (zh) 2011-10-18 2013-04-24 华为技术有限公司 一种虚拟私云接入认证方法及相关装置
US8495199B2 (en) 2011-12-22 2013-07-23 Amazon Technologies, Inc. Interfaces to manage service marketplaces accessible via direct network peerings
US8724642B2 (en) * 2011-11-29 2014-05-13 Amazon Technologies, Inc. Interfaces to manage direct network peerings
US10015083B2 (en) 2011-12-22 2018-07-03 Amazon Technologies, Inc. Interfaces to manage inter-region connectivity for direct network peerings
US8959203B1 (en) 2011-12-19 2015-02-17 Amazon Technologies, Inc. Dynamic bandwidth management using routing signals in networks with direct peerings
JP2013134530A (ja) * 2011-12-26 2013-07-08 Kddi Corp 認証システム、認証方法及び認証プログラム
US9565212B2 (en) * 2012-03-30 2017-02-07 Sncr, Llc Secure mobile framework
CA2788573C (en) * 2012-09-06 2013-07-09 Guest Tek Interactive Entertainment Ltd. Allowing guest of hospitality establishment to utilize multiple guest devices to access network service
US8955055B1 (en) * 2012-09-28 2015-02-10 Juniper Networks, Inc. Customer extendable AAA framework for network elements
US9456253B2 (en) * 2012-12-04 2016-09-27 Virtual Marketing Incorporated Internet protocol television streaming methods and apparatus
US9059977B2 (en) * 2013-03-13 2015-06-16 Route1 Inc. Distribution of secure or cryptographic material
US9344949B2 (en) * 2013-03-14 2016-05-17 T-Mobile Usa, Inc. System and method for optimizing a media gateway selection in mobile switching center pool architecture
US9426154B2 (en) * 2013-03-14 2016-08-23 Amazon Technologies, Inc. Providing devices as a service
US20140279259A1 (en) * 2013-03-15 2014-09-18 Emerald Games Marketing Limited Method and apparatus for connecting vendors with customers through a virtual interface
CN103338150B (zh) * 2013-07-19 2016-06-15 中国人民解放军信息工程大学 信息通信网络体系结构建立方法、装置、服务器和路由器
US9900219B2 (en) * 2015-05-21 2018-02-20 Equinix, Inc. Active panel demarcation

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6198824B1 (en) * 1997-02-12 2001-03-06 Verizon Laboratories Inc. System for providing secure remote command execution network
US7039713B1 (en) * 1999-11-09 2006-05-02 Microsoft Corporation System and method of user authentication for network communication through a policy agent
US20020009092A1 (en) * 2000-03-02 2002-01-24 Seaman Michael J. Broadband tree-configured ring for metropolitan area networks
US20040066769A1 (en) * 2002-10-08 2004-04-08 Kalle Ahmavaara Method and system for establishing a connection via an access network
US20050063400A1 (en) 2003-09-24 2005-03-24 Lum Stacey C. Systems and methods of controlling network access
US20070234054A1 (en) * 2006-03-31 2007-10-04 Alcatel System and method of network equipment remote access authentication in a communications network
WO2013081962A1 (en) 2011-11-29 2013-06-06 Amazon Technologies, Inc. Interfaces to manage direct network peerings

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3047602A4

Also Published As

Publication number Publication date
US20170295150A1 (en) 2017-10-12
JP6656157B2 (ja) 2020-03-04
US11843589B2 (en) 2023-12-12
US9692732B2 (en) 2017-06-27
CA2923431A1 (en) 2015-03-26
US20240089241A1 (en) 2024-03-14
US20150082039A1 (en) 2015-03-19
JP2020064668A (ja) 2020-04-23
EP3047602A4 (en) 2017-05-03
CN105556894A (zh) 2016-05-04
CN105556894B (zh) 2019-05-10
US20210392122A1 (en) 2021-12-16
SG11201601797TA (en) 2016-04-28
EP3654612B1 (en) 2024-12-18
CA2923431C (en) 2020-03-10
EP3654612A1 (en) 2020-05-20
US11122022B2 (en) 2021-09-14
EP3047602A1 (en) 2016-07-27
US12413493B2 (en) 2025-09-09
JP2016532984A (ja) 2016-10-20
JP2018116708A (ja) 2018-07-26

Similar Documents

Publication Publication Date Title
US12413493B2 (en) Network connection automation
US12212552B2 (en) Disposable browsers and authentication techniques for a secure online user environment
US9032217B1 (en) Device-specific tokens for authentication
US9607162B2 (en) Implementation of secure communications in a support system
CA2689847C (en) Network transaction verification and authentication
EP2316097B1 (en) Protocol for device to station association
US20100197293A1 (en) Remote computer access authentication using a mobile device
US10547599B1 (en) Multi-factor authentication for managed directories
EP3895043B1 (en) Timestamp-based authentication with redirection
CN110781465B (zh) 基于可信计算的bmc远程身份验证方法及系统
US11689512B2 (en) Access key retrieval service for clients
US11838270B1 (en) Session control management for virtual private networks using artificial data packets
CN120110749A (zh) 网络访问控制方法、装置及相关设备

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 201480050814.4

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14845785

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2923431

Country of ref document: CA

ENP Entry into the national phase

Ref document number: 2016542872

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2014845785

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2014845785

Country of ref document: EP