Custom authorization of network connected devices using signed credentials
Systems and methods are disclosed herein for enforcing digital signature on a token useable by a network-addressable device to invoke service calls on services of a service provider. A device platform service of the service provider may receive service calls from the network-addressable device and cause one or more operations to be performed by other services of the service provider in response to receiving a notification that the request is authentic. An authentication service analyses a fingerprint associated with a request submitted by the device and determines whether it is a match to a fingerprint generated from cryptographic authentication information provided by the user in connection with registering the network-addressable device.
1. A computer-implemented method, comprising:
receiving, at a first service of a computing resource service provider, a request with a token indicative of a registered network-addressable device of a customer, an encrypted fingerprint of the token, and an identifier registered by the customer of the computing resource service provider in association with a public key, wherein the identifier indicates an authorizing mechanism;
determining, at the first service and based at least in part on the identifier, the authorizing mechanism is registered in a data store of the first service and the public key from a plurality of public keys, wherein the plurality of public keys associated with a plurality of registered network-addressable devices, and wherein the data store includes a plurality of active authorizing mechanisms, provided by the customer, registered at the first service for verifying the request, the data store including the authorizing mechanism;
decrypting the encrypted fingerprint using the public key to produce a first fingerprint;
calculating a second fingerprint by applying a hash function to the token;
verifying that the first fingerprint and the second fingerprint match; and
as a result of successful verification that the first fingerprint and second fingerprint match, transmitting at least the token to a second service to cause the second service to perform a routine to determine whether fulfillment of the request is authorized.
2. The computer-implemented method of claim 1 , wherein determining the public key is based at least in part upon a determination that the identifier matches an identifier in a record of authorized identifiers provided by a user.
3. The computer-implemented method of claim 1 , the method further comprising:
obtaining, from a cache, a list of authorized identifiers provided by a user; and
determining the public key is a result of a determination that the identifier is included in the list of authorized identifiers.
4. The computer-implemented method of claim 1 , wherein the request is received from a network-addressable device of the customer, and the first service is for interfacing the network-addressable device with other services of the computing resource service provider.
5. The computer-implemented method of claim 1 , wherein the data store is a cache.
6. A system, comprising:
one or more processors; and
memory that stores computer-executable instructions that, as a result of execution by the one or more processors, cause the system to:
receive, at a first service of a computing resource service provider, a request with a token and a digital signature, wherein the request includes an identifier indicative of an authorizing mechanism among a plurality of different active authorizing mechanisms provided by a requestor;
determine, at the first service based at least in part on the identifier in the request, the authorizing mechanism registered in a database and a cryptographic key registered by a customer of the computing resource service provider in association with the identifier indicating a registered network-addressable device with the computing resource service provider, wherein the database includes a set of identifiers indicative of various authorizing mechanisms registered for verifying the request, the set including the identifier;
verify, based on the authorizing mechanism registered in the database, the digital signature based at least in part on the token and the cryptographic key; and
as a result of successful verification of the digital signature, transmit the token to a second service to cause the second service to perform an authorization routine to determine whether fulfillment of the request is authorized.
7. The system of claim 6 , wherein verification of the digital signature includes generating a first fingerprint based at least in part on applying a hash function to the token.
8. The system of claim 6 , wherein verification of the digital signature includes comparing a first fingerprint with a second fingerprint.
9. The system of claim 8 , wherein the first fingerprint is obtained by at least applying the cryptographic key to the digital signature, and the second fingerprint is obtained by at least applying a hash function to the token.
10. The system of claim 6 , wherein determining that the identifier is a match to an identifier in a record of identifiers is a condition precedent to determining the cryptographic key.
11. The system of claim 6 , wherein the identifier is defined by a customer in association with obtaining the token in a registration process.
12. The system of claim 6 , wherein the cryptographic key is a public key of a public/private key pair generated using an asymmetric key generation algorithm for generating cryptographic keys.
13. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
receive, at a first service of a computing resource service provider, a request with a token, an authorizing mechanism, and a digital signature;
determine, at the first service based at least in part on an identifier in the request and the authorizing mechanism being in a record stored by the first service, a cryptographic key registered by a customer of the computing resource service provider in association with the identifier indicating a registered network-addressable device with the computing resource service provider, wherein the record includes a plurality of active authorizing mechanisms provided by the customer, the plurality including the authorizing mechanism;
verify the digital signature based at least in part on the token, the request being in the record, and the cryptographic key; and
as a result of successful verification of the digital signature, transmit the token to a second service to cause the second service to perform an authorization routine to determine whether fulfillment of the request is authorized.
14. The non-transitory computer-readable storage medium of claim 13 , wherein the request is submitted by a network-addressable device that operates independently of the customer.
15. The non-transitory computer-readable storage medium of claim 13 , wherein verification of the digital signature includes applying a hash function to the token, wherein an indicator of the hash function performed is provided by the customer.
16. The non-transitory computer-readable storage medium of claim 15 , wherein a result of applying the hash function to the token is compared with a result of applying the cryptographic key to the digital signature.
17. The non-transitory computer-readable storage medium of claim 13 , wherein customer-defined policy information is retrieved as a result of successful verification of the digital signature, the policy information specifying permissions for performing one or more operations in fulfillment of the request.
18. The non-transitory computer-readable storage medium of claim 13 , wherein the token generated by a credential generating service in connection with registration, by the customer, of the identifier with the first service of a service provider.
19. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions cause the computer system to maintain a record of identifiers approved by the customer for submitting requests to the second service for causing performance of the authorization routine.
20. The non-transitory computer-readable storage medium of claim 13 , wherein the digital signature is generated using a private key of a cryptographic key pair and a public key of the cryptographic key pair is used to verify the digital signature.