Abstract: A technology is provided for delivering a data object to a device. Data delivery instructions to distribute a data object to a device may be received at a delivery service and indicate a storage location of the data object, a messaging topic, and a size of data receivable by the device. The data object is then divided into blocks corresponding to the size of data receivable by the device. A messaging topic is identified to which the device is subscribed via a messaging service. The blocks are sent to the device using the messaging topic and a network protocol available to the device.

Abstract: A network protocol provides mutual authentication of network-connected devices that are parties to a communication channel in environments where the amount of memory and processing power available to the network-connected devices is constrained. When a new device is added to a network, the device contacts a registration service and provides authentication information that proves the authenticity of the device. After verifying the authenticity of the device, the registration service generates a token that can be used to by the device to authenticate with other network entities, and provides the token to the device. The registration service publishes the token using a directory service. When the device connects to another network entity, the device provides the token to the other network entity, and the other network entity authenticates the device by verifying the token using the directory service.

Abstract: A network protocol provides mutual authentication of network-connected devices that are parties to a communication channel in environments where the amount of memory and processing power available to the network-connected devices is constrained. When a new device is added to a network, the device contacts a registration service and provides authentication information that proves the authenticity of the device. After verifying the authenticity of the device, the registration service generates a token that can be used to by the device to authenticate with other network entities, and provides the token to the device. The registration service publishes the token using a directory service. When the device connects to another network entity, the device provides the token to the other network entity, and the other network entity authenticates the device by verifying the token using the directory service.

Abstract: A communication system and method for the utilization of messaging protocols to provide computing devices executable code. An administrative component can include executable code or instructions within the publication of content. Computing devices registered to receive this content can receive and execute the code (or instructions) and utilize the same messaging protocol to publish a result of the processing to be delivered to the admin device.

Abstract: A technology is described for device communication with computing regions. An example method may include receiving a request for an identity token at a first computing region, where the identity token enables a device to communicate with a second computing region. In receiving the request, the device associated with the request may be authenticated using authentication credentials for the device. A determination may be made that the device is authorized to communicate with the second computing region and an identity token may be generated to indicate that the device is authorized to communicate with the second computing region. The identity token may be provided to the device and the device may present the identity token to the second computing region, allowing the device to communicate with the second computing region.

Abstract: Techniques are disclosed for provisioning device-specific credentials to an Internet of Things device that accesses a cloud-based IoT service. The IoT service receives, from the IoT device, a request for device-specific credentials. The request comprises a provisioning certificate including information identifying a group of devices associated with the IoT device. The provisioning certificate is authenticated by evaluating the information with expected information. The device-specific credentials are generated based, at least in part, on the information provided in the provisioning certificate. The device-specific credentials are sent to the IoT device, and the IoT device installs and activates the device-specific credentials. The device-specific credentials are associated with the IoT device in a registry of the IoT service.

Abstract: A technology is described for device communication with computing regions. An example method may include receiving at a first computing region a request for a computing resource. In response to receiving the request, a device associated with the request may be authenticated using authentication credentials for the device. An identity token that indicates permission for the device to access the computing resource in a second computing region may be generated and the identity token and instructions to connect to the second computing region may be provided to the device. The device may present the identity token to the second computing region in order to access the computing resource in the second computing region.

Abstract: A technology is provided for delivering a data object to device. Data delivery instructions to distribute a data object to a device may be received at a delivery service and include a storage location of the data object, a messaging topic, and a size of data receivable by the device. The data object is then divided into blocks corresponding to the size of data receivable by the device. A messaging topic is identified to which the device is subscribed via a messaging service. The blocks are sent to the device using the messaging topic and a network protocol installed on the device.

Abstract: Systems and methods are disclosed herein for enforcing digital signature on a token useable by a network-addressable device to invoke service calls on services of a service provider. A device platform service of the service provider may receive service calls from the network-addressable device and cause one or more operations to be performed by other services of the service provider in response to receiving a notification that the request is authentic. An authentication service analyses a fingerprint associated with a request submitted by the device and determines whether it is a match to a fingerprint generated from cryptographic authentication information provided by the user in connection with registering the network-addressable device.

Abstract: Systems and methods are disclosed herein for enforcing digital signature on a token useable by a network-addressable device to invoke service calls on services of a service provider. A device platform service of the service provider may receive service calls from the network-addressable device and cause one or more operations to be performed by other services of the service provider in response to receiving a notification that the request is authentic. An authentication service analyses a fingerprint associated with a request submitted by the device and determines whether it is a match to a fingerprint generated from cryptographic authentication information provided by the user in connection with registering the network-addressable device.

Abstract: A network protocol provides mutual authentication of network-connected devices that are parties to a communication channel in environments where the amount of memory and processing power available to the network-connected devices is constrained. When a new device is added to a network, the device contacts a registration service and provides authentication information that proves the authenticity of the device. After verifying the authenticity of the device, the registration service generates a token that can be used to by the device to authenticate with other network entities, and provides the token to the device. The registration service publishes the token using a directory service. When the device connects to another network entity, the device provides the token to the other network entity, and the other network entity authenticates the device by verifying the token using the directory service.

Abstract: A communication system and method for the utilization of authentication protocols to authenticate computing devices. An authentication service provider can authenticate a computing device after a first authentication by an authentication protocol. Computing devices can use the authentication to receive additional credential to access one or more service providers.

Abstract: A technology is provided for delivering a data object to device. Data delivery instructions to distribute a data object to a device may be received at a delivery service and include a storage location of the data object, a messaging topic, and a size of data receivable by the device. The data object is then divided into blocks corresponding to the size of data receivable by the device. A messaging topic is identified to which the device is subscribed via a messaging service. The blocks are sent to the device using the messaging topic and a network protocol installed on the device.

Abstract: A network protocol provides mutual authentication of network-connected devices that are parties to a communication channel in environments where the amount of memory and processing power available to the network-connected devices is constrained. When a new device is added to a network, the device contacts a registration service and provides authentication information that proves the authenticity of the device. After verifying the authenticity of the device, the registration service generates a token that can be used to by the device to authenticate with other network entities, and provides the token to the device. The registration service publishes the token using a directory service. When the device connects to another network entity, the device provides the token to the other network entity, and the other network entity authenticates the device by verifying the token using the directory service.

Abstract: A lightweight network protocol provides mutual authentication and encryption of a communication channel in environments where the amount of computing resources available to the networked devices is constrained. When a new device is added to a network, the device contacts a registration service and provides information that is published via a device directory. The network entity locates the device via information provided by the device directory, and establishes an encrypted network connection with the device. A shared secret is established between the device and the network entity using a key-exchange protocol. Consecutive messages that are sent or received are encrypted or decrypted with a sequence of cryptographic keys generated based at least in part on the shared secret. Key-exchange parameters are added to message exchanges between the device and the network entity to facilitate regenerating the shared secret.

Abstract: Techniques are disclosed for provisioning device-specific credentials to an Internet of Things device that accesses a cloud-based IoT service. The IoT service receives, from the IoT device, a request for device-specific credentials. The request comprises a provisioning certificate including information identifying a group of devices associated with the IoT device. The provisioning certificate is authenticated by evaluating the information with expected information. The device-specific credentials are generated based, at least in part, on the information provided in the provisioning certificate. The device-specific credentials are sent to the IoT device, and the IoT device installs and activates the device-specific credentials. The device-specific credentials are associated with the IoT device in a registry of the IoT service.

Abstract: A three-way pairing handshake may include an internet-of-things (IoT) service sending an encrypted token to an IoT device in response to a request for a token from that IoT device. The encrypted token may store a service managed client identifier and a device identifier. The IoT device may share the encrypted token with a companion application on a mobile device. In turn, the companion application sends a pairing request to the IoT service which includes the encrypted token, along with a copy of the device identifier and the client identifier. The IoT service may validate the pairing request by decrypting the encrypted token included in the pairing request and verifying that the device identifier and the client identifier recovered from the decrypted token matches the device identifier and client identifier received in the pairing request.

Abstract: A technology is provided for certificate authentication for registering a certificate in computing service environment. A request may be received to register a certificate authority (CA) certificate. A registration token associated with a customer account in a service provider environment may be generated to enable association of the customer account with the CA certificate and to authenticate a registration of the CA certificate. The registration token may be sent to a requester desiring to register the CA certificate. A verification certificate that contains the registration token and that is signed by a certificate authority (CA) of the CA certificate and the CA certificate that is signed by the CA may be received to register the CA certificate with the customer account within a service provider environment The CA certificate is persisted with the service provider environment after verifying the registration token is associated with the customer account and the CA certificate is signed by the CA.

Abstract: A communication system and method for the utilization of messaging protocols to provide computing devices executable code. An administrative component can include executable code or instructions within the publication of content. Computing devices registered to receive this content can receive and execute the code (or instructions) and utilize the same messaging protocol to publish a result of the processing to be delivered to the admin device.

Abstract: A technology is provided for delivering a data object to device. Data delivery instructions to distribute a data object to a device may be received at a delivery service and include a storage location of the data object, a messaging topic, and a size of data receivable by the device. The data object is then divided into blocks corresponding to the size of data receivable by the device. A messaging topic is identified to which the device is subscribed via a messaging service. The blocks are sent to the device using the messaging topic and a network protocol installed on the device.