US 12,425,409 B2
Trust-based dynamic access control system
Shovan Kumar Das, Medina, WA (US); Jessica Kira Szmajda, Washington, DC (US); Bashuman Deb, Aldie, VA (US); Sujan Bolisetti, Bothell, WA (US); Shridhar Kulkarni, Seattle, WA (US); Baihu Qian, Chicago, IL (US); Brandon Michael LaRue, Herndon, CA (US); and Stephen A. Saville, Seattle, WA (US)
Assigned to Amazon Technologies, Inc., Seattle, WA (US)
Filed by Amazon Technologies, Inc., Seattle, WA (US)
Filed on Nov. 22, 2022, as Appl. No. 18/058,168.
Prior Publication US 2024/0171583 A1, May 23, 2024
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/102 (2013.01) [H04L 63/0236 (2013.01); H04L 63/101 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system comprising:
computer-readable memory storing executable instructions; and
at least one computing device in communication with the computer-readable memory and programmed by the executable instructions to:
receive, from a device of a user, a request to access a network application;
receive, associated with the request, trust information generated by one or more trust providers, wherein the trust information represents at least:
first identity information regarding the user; and
second identity information regarding the device;
create a trust information data structure using the first identity information and the second identity information;
access a network application policy, wherein the network application policy maps the trust information data structure to one or more of (i) an access level of the network application, (ii) an access level to a network segment of a cloud provider network, (iii) routing instructions to a network firewall, or (iv) routing instructions to a network router;
transform the request based on the trust information data structure, wherein the transformation comprises a change to at least one of role, security context, and destination Internet protocol address;
determine access or routing information based at least in part on the network application policy and the trust information; and
perform an access or routing action based at least partly on the access or routing information.