Abstract: A system and method for providing data such as credentials to a third-party service while protecting the data from exposure to intermediate services. The system receives a first request containing encrypted data, generates a second request by replacing the encrypted data from the first request with unencrypted data, and transmits the second request to the third-party service.

Abstract: A computing resource service provider may operate a secure proxy fleet within a content delivery network. The secure proxy fleet may protect sensitive data communicated between a client device and a backend service over one or more networks, for example, over the content delivery network to a computing resource service provider environment. The secure proxy fleet may protect sensitive data by encrypting the sensitive data before it is forwarded to a destination.

Abstract: Techniques are described for delivering one or more first resources of a page using a first security level, and delivering one or more second resources of a page using a second, different security level. A page is generated to include elements identifying resources to be presented in the page, and the elements may include security level identifiers indicating a security level to be employed in communicating the corresponding resource. Each security level may be associated with a set of security measures that ensure the integrity or confidentiality of the resource while it is communicated. The use of multiple security levels to communicate multiple resources may provide appropriate security for each resource, reducing latency and overhead in page generation, communication, and rendering.

Abstract: A computing device can obtain a session key for encrypting data that is communicated between a client device and the computing device. The computing device can receive, from the client device, an encrypted request for data. The encrypted request can be encrypted by the client device using the session key. The data requested can be stored on a second computing device. The computing device can send, to the second computing device, a copy of the session key and the encrypted request for data. The second computing device can decrypt the data using the session key and can also encrypt data responsive to the request using the session key.

Abstract: A computing resource service provider may operate a secure proxy fleet within a content delivery network. The secure proxy fleet may protect sensitive data communicated between a client device and a backend service over one or more networks, for example, over the content delivery network to a computing resource service provider environment. The secure proxy fleet may protect sensitive data by encrypting the sensitive data before it is forwarded to a destination.

Abstract: A computing resource service provider may operate a secure proxy fleet responsible for directing network traffic to one or more backend services. The network traffic may be received over a cryptographically protected communications session at a secure proxy device. The secure proxy device may detect sensitive data included in the network traffic and encrypt the sensitive data to protect the sensitive data during transmission to the backend service.

Abstract: A computing resource service provider may operate a secure proxy fleet responsible for directing network traffic from one or more backend services to one or more client devices. The network traffic may be encrypted or otherwise obfuscated to protect sensitive data. The secure proxy device may detect encrypted data and may decrypt the data prior to forwarding the data to the one or more client devices.

Abstract: Techniques are described for delivering one or more first resources of a page using a first security level, and delivering one or more second resources of a page using a second, different security level. A page is generated to include elements identifying resources to be presented in the page, and the elements may include security level identifiers indicating a security level to be employed in communicating the corresponding resource. Each security level may be associated with a set of security measures that ensure the integrity or confidentiality of the resource while it is communicated. The use of multiple security levels to communicate multiple resources may provide appropriate security for each resource, reducing latency and overhead in page generation, communication, and rendering.

Abstract: A computing device can obtain a session key for encrypting data that is communicated between a client device and the computing device. The computing device can receive, from the client device, an encrypted request for data. The encrypted request can be encrypted by the client device using the session key. The data requested can be stored on a second computing device. The computing device can send, to the second computing device, a copy of the session key and the encrypted request for data. The second computing device can decrypt the data using the session key and can also encrypt data responsive to the request using the session key.

Abstract: A computing device can obtain a session key for encrypting data that is communicated between a client device and the computing device. The computing device can receive, from the client device, an encrypted request for data. The encrypted request can be encrypted by the client device using the session key. The data requested can be stored on a second computing device. The computing device can send, to the second computing device, a copy of the session key and the encrypted request for data. The second computing device can decrypt the data using the session key and can also encrypt data responsive to the request using the session key.

Abstract: Technologies are described herein for managing the IP addresses of outbound e-mail messages based on sender reputation. A range of reputation scores is divided into a number of reputation segments, each covering a span of the reputation scores. The available IP addresses are distributed evenly among the reputation segments. The span of reputation scores for each of the reputation segments may be periodically adjusted based on historical data regarding a volume of e-mail messages sent by sender reputation score. In order to select a source IP address for a particular outbound e-mail message, the reputation segment encompassing a sender reputation score regarding the sender of the e-mail message is determined. An IP address is selected from the IP addresses assigned to the reputation segment and returned to be utilized as the source IP address in sending the outbound e-mail message.

Abstract: Technologies are described herein for managing the IP addresses of outbound e-mail messages based on sender reputation. A range of reputation scores is divided into a number of reputation segments, each covering a span of the reputation scores. The available IP addresses are distributed evenly among the reputation segments. The span of reputation scores for each of the reputation segments may be periodically adjusted based on historical data regarding a volume of e-mail messages sent by sender reputation score. In order to select a source IP address for a particular outbound e-mail message, the reputation segment encompassing a sender reputation score regarding the sender of the e-mail message is determined. An IP address is selected from the IP addresses assigned to the reputation segment and returned to be utilized as the source IP address in sending the outbound e-mail message.