Secure time service

1. A system, comprising:

a time server; and

a service endpoint to respond to requests formatted according to one or more application programming interfaces (APIs) supported by a service implemented at a provider network, the service endpoint configured to:

receive a client request for a secure timestamp from a client of the service, the request comprising an indication of one or more timestamp properties and a data object for encryption by the time server, wherein the one or more timestamp properties comprise at least one of a requested timestamp precision, accuracy, or latency requirement;

send, to the time server, a timestamp request comprising a representation of at least a portion of the request, the representation comprising the one or more timestamp properties and the data object;

receive, from the time server, an encrypted response comprising an encryption of (a) the data object included in the request and (b) a timestamp value from the time server generated in accordance with the one or more timestamp properties; and

transmit, to the client, the encrypted response.

2. The system of claim 1 , wherein the time server comprises a cryptographic engine, a time source, and a cryptographic key.

3. The system of claim 2 , wherein the time server is configured to generate and send the encrypted response to the service endpoint in response to receiving the representation of at least a portion of the request.

4. The system of claim 1 , wherein the service endpoint is further configured to:

receive, from a second client, an instantiation request to instantiate a second service endpoint; and

initiate an instantiation of the second service endpoint responsive to the instantiation request.

5. The system of claim 4 , wherein the instantiation request indicates a category, and wherein the second service endpoint is instantiated in accordance with the indicated category.

6. The system of claim 4 , wherein the second service endpoint is configured with a network address of a private network associated with the second client, wherein the private network comprises a plurality of resources of the provider network, and wherein the network address is indicated in the instantiation request.

7. A method, comprising:

instantiating (a) a time server and (b) a service endpoint to respond to requests formatted according to one or more application programming interfaces (APIs) supported by a service implemented at a provider network;

receiving a client request for a secure timestamp from a client of the service, the request comprising an indication of one or more timestamp properties and a data object for encryption by the time server, wherein the one or more timestamp properties comprise at least one of a requested timestamp precision, accuracy, or latency requirement;

sending, to the time server, a timestamp request comprising a representation of at least a portion of the request, the representation comprising the one or more timestamp properties and the data object;

receive, from the time server, an encrypted response comprising an encryption of (a) the data object included in the request and (b) a timestamp value from the time server generated in accordance with the one or more timestamp properties; and

transmitting, to the client, the encrypted response.

8. The method of claim 7 , further comprising:

receiving, from a second client, an instantiation request to instantiate a second service endpoint; and

initiating an instantiation of the second service endpoint responsive to the instantiation request.

9. The method of claim 8 , wherein the instantiation request comprises identification metadata, and wherein the second service endpoint is configured to include at least a portion of the identification metadata in responses provided by the second service endpoint.

10. The method of claim 7 , wherein the time server comprises a cryptographic engine, a time source, and a cryptographic key.

11. The method of claim 10 ,

wherein the timestamp value is generated using output from the time source;

wherein the encrypted response is generated by the cryptographic engine using the cryptographic key.

12. The method of claim 7 , further comprising:

configuring the service endpoint with a network address accessible from the public Internet.

13. The method of claim 7 , further comprising:

configuring the service endpoint with a private network address accessible only from a portion of the provider network.

14. A non-transitory, computer-readable storage medium storing instructions that, when executed by one or more processors, cause the one or more processors to:

implement an application programmatic interface defined by a service implemented at a provider network;

receive, via the application programmatic interface, a client request for a secure timestamp from a client of the service, the request comprising an indication of one or more timestamp properties and a data object for encryption by the time server, wherein the one or more timestamp properties comprise at least one of a requested timestamp precision, accuracy, or latency requirement;

send, to the time server, a timestamp request comprising a representation of at least a portion of the request, the representation comprising the one or more timestamp properties and the data object; and

in response to receiving, from the time server, an encrypted response comprising an encryption of (a) the data object indicated in the request and (b) a timestamp value from a time server of the service generated in accordance with the one or more timestamp properties, transmit, to the client, the encrypted response.

15. The non-transitory, computer-readable storage medium of claim 14 , wherein the instructions further cause the one or more processors to:

receive, from a second client, an instantiation request to instantiate a second service endpoint; and

initiate an instantiation of the second service endpoint responsive to the instantiation request.

16. The non-transitory, computer-readable storage medium of claim 14 , wherein the instructions further cause the one or more processors to:

determine whether the time server has failed or has become unresponsive; and

based on a determination that the time server has failed or has become unresponsive, identify a second time server, wherein the time server and the second time server are configured as a failover pair within an availability container.

17. The non-transitory, computer-readable storage medium of claim 16 , wherein the instructions further cause the one or more processors to:

transmit, to the second time server, the representation of at least the portion of the request; and

receive, from the second time server, the timestamp value generated based at least in part on output from a time source of the second time server.

18. The non-transitory, computer-readable storage medium of claim 16 , wherein the time server and the second time server share a cryptographic key.

19. The non-transitory, computer-readable storage medium of claim 14 , wherein the instructions further cause the one or more processors to:

determine a quantity of additional time servers and corresponding locations of the additional time servers, based at least in part on a simulation model, an analytic model, quality-of-service requirements, or any combination thereof; and

instantiate the additional time servers in accordance with the quantity and the locations of the additional time servers.

20. The non-transitory, computer-readable storage medium of claim 14 , wherein the encrypted response further comprises response metadata indicating branding information.