Abstract: Systems and methods are described for delegating permissions to enable account access. The systems utilize a delegation profile that can be created within a secured account of at least one user. The delegation profile includes a name, a validation policy that specifies principals which may be external to the account and which are permitted to assume the delegation profile, and an authorization policy that indicates the permitted actions within the account for those principals which are acting within the delegation profile. Once the delegation profile is created, it can be provided to external principals or services. These external principals or services can use the delegation profile to obtain credentials for performing various actions in the account using the credentials of the delegation profile.

Abstract: A plurality of virtual computing resources is detected to have been provisioned. Credentials are distributed to the plurality of virtual computing resources. A credentials map that maps the credentials to the plurality of virtual computing resources is updated. The credentials for the plurality of virtual computing resources are activated to enable the plurality of virtual computing resources to use the credentials to authenticate to a second computer system that manages a resource service, with the credentials being inaccessible to resources of the resource service. A virtual computing resource of the plurality of virtual computing resources is detected to been deprovisioned, and the credentials for the virtual computing resource are deactivated.

Abstract: Embodiments are directed to file systems. A replication engine may establish a secure communication channel between a source file system and a target file system. The replication engine may: instantiate a replication job associated with rules; determine changes in the source file system; determine characteristics of the replication job that may be based on the changes; compare the to the characteristics and a black-out schedule; execute the replication job to communicate the changes in the source file system to the target file system based on a result of the comparison. Upon completion of the replication job, the replication engine may automatically instantiating a next replication job to copy subsequent changes in the source file system to the target file system.

Abstract: Systems and methods are described for delegating permissions to enable account access. The systems utilize a delegation profile that can be created within a secured account of at least one user. The delegation profile includes a name, a validation policy that specifies principals which may be external to the account and which are permitted to assume the delegation profile, and an authorization policy that indicates the permitted actions within the account for those principals which are acting within the delegation profile. Once the delegation profile is created, it can be provided to external principals or services. These external principals or services can use the delegation profile to obtain credentials for performing various actions in the account using the credentials of the delegation profile.

Abstract: Systems and methods provide a storage media on a portable physical object associated with a set of credentials that enables access to a set of computing resources associated with a set of Web services. In some embodiments, information including a set of credentials is prepackaged onto the storage media of the portable physical object. A pre-activated subscription to the set of Web services in a distributed system is provisioned. Access to the set of Web services is enabled when the portable physical object is coupled with a computing device and the set of credentials is authenticated. In some embodiments, the portable physical object is purchased by a user on a prepaid basis without requiring the user to register an account with the set of Web services, allowing the user to remain anonymous with respect to interaction with the set of Web services.

Abstract: An apparatus and method for use in treating tinnitus, employs a sound processing unit, a tactile unit, and an interface therebetween. The tactile unit comprises an array of stimulators each of which can be independently actuated to apply a tactile stimulus to a subject, and an input for receiving a plurality of actuation signals from the interface and directing individual actuation signals to individual stimulators. The sound processing unit receives an audio signal at an input, analyses the signal with a digital signal processor to generate the actuation signals which are representative of the audio signal, and provides the plurality of actuation signals to the interface. In a preferred embodiment the digital signal processor divides the audio signal into a series of frames in the time domain, performs a transform on each frame to generate a set of coefficients representing said frame, and maps the set of coefficients to a set of actuation signals to be applied to the array.

Abstract: Systems and methods are described for delegating permissions to enable account access. The systems utilize a delegation profile that can be created within a secured account of at least one user. The delegation profile includes a name, a validation policy that specifies principals which may be external to the account and which are permitted to assume the delegation profile, and an authorization policy that indicates the permitted actions within the account for those principals which are acting within the delegation profile. Once the delegation profile is created, it can be provided to external principals or services. These external principals or services can use the delegation profile to obtain credentials for performing various actions in the account using the credentials of the delegation profile.

Abstract: An apparatus and method for use in treating tinnitus, employs a sound processing unit, a tactile unit, and an interface therebetween. The tactile unit comprises an array of stimulators each of which can be independently actuated to apply a tactile stimulus to a subject, and an input for receiving a plurality of actuation signals from the interface and directing individual actuation signals to individual stimulators. The sound processing unit receives an audio signal at an input, analyses the signal with a digital signal processor to generate the actuation signals which are representative of the audio signal, and provides the plurality of actuation signals to the interface. In a preferred embodiment the digital signal processor divides the audio signal into a series of frames in the time domain, performs a transform on each frame to generate a set of coefficients representing said frame, and maps the set of coefficients to a set of actuation signals to be applied to the array.

Abstract: A tinnitus treatment system comprising a sound processing unit, a haptic stimulus unit and an audio delivery unit. The sound processing unit comprises a processor input for receiving an audio signal; and a digital signal processor operable to analyse said audio signal and generate a plurality of actuation signals therefrom which are representative of said audio signal. The digital signal processor is further operable to spectrally modify said audio signal in accordance with a predetermined modification profile to generate a modified audio signal. The haptic stimulus unit comprises an array of stimulators each of which can be independently actuated to apply a tactile stimulus to a subject; and a stimulus unit input for receiving the plurality of actuation signals generated by said digital signal processor and directing individual actuation signals to individual stimulators.

Abstract: A plurality of virtual computing resources is detected to have been provisioned. Credentials are distributed to the plurality of virtual computing resources. A credentials map that maps the credentials to the plurality of virtual computing resources is updated. The credentials for the plurality of virtual computing resources are activated to enable the plurality of virtual computing resources to use the credentials to authenticate to a second computer system that manages a resource service, with the credentials being inaccessible to resources of the resource service. A virtual computing resource of the plurality of virtual computing resources is detected to been deprovisioned, and the credentials for the virtual computing resource are deactivated.

Abstract: Techniques are described for enabling principals to inject context information into a credential (e.g. session credential). Once the credential has been issued, any arbitrary principal is allowed to inject context information into the existing credential. The injected context is scoped to the principal that made the injection. Subsequently, at authentication time, when the credential is used to request access to a particular resource, the system can verify whether the principal that made the injection is trusted and if the principal is deemed trusted, the context information can be applied to a policy that controls access to one or more resources, or can alternatively be translated into some context residing in a different namespace which can then be applied to the policy. In addition, the system enables arbitrary users to insert additional deny statements into an existing credential, which further restrict the scope of permissions granted by the credential.

Abstract: Systems and methods for managing credentials distribute the credentials to subsets of a set of collectively managed computing resources. The collectively managed computing resources may include one or more virtual machine instances. The credentials distributed to the computing resources may be used by the computing resources to perform one or more actions. Actions may include performing one or more functions in connection with configuration, management, and/or operation of the one or more resources, and/or access of other computing resources. The ability to use credentials may be changed based at least in part on the occurrence of one or more events.

Abstract: Systems and methods for attesting to information about a computing resource involve electronically signed documents. For a computing resource, a document containing information about the resource is generated and electronically signed. The document may be provided to one or more entities as an attestation to at least some of the information contained in the document. Attestation to information in the document may be a prerequisite for performance of one or more actions that may be taken in connection with the computing resource.

Abstract: Systems and methods for authentication generate keys from secret credentials shared between authenticating parties and authenticators. Generation of the keys may involve utilizing specialized information that, as a result of being used to generate the keys, renders the generated keys usable for a smaller scope of uses than the secret credential. Further, key generation may involve multiple invocations of a function where each of at least a subset of the invocations of the function results in a key that has a smaller scope of permissible use than a key produced from a previous invocation of the function. Generated keys may be used as signing keys to sign messages. One or more actions may be taken depending on whether a message and/or the manner in which the message was submitted complies with restrictions of the a key's use.

Abstract: An apparatus and method for use in treating tinnitus, employs a sound processing unit, a tactile unit, and an interface therebetween. The tactile unit comprises an array of stimulators each of which can be independently actuated to apply a tactile stimulus to a subject, and an input for receiving a plurality of actuation signals from the interface and directing individual actuation signals to individual stimulators. The sound processing unit receives an audio signal at an input, analyses the signal with a digital signal processor to generate the actuation signals which are representative of the audio signal, and provides the plurality of actuation signals to the interface. In a preferred embodiment the digital signal processor divides the audio signal into a series of frames in the time domain, performs a transform on each frame to generate a set of coefficients representing said frame, and maps the set of coefficients to a set of actuation signals to be applied to the array.

Abstract: Systems and methods for authentication generate keys from secret credentials shared between authenticating parties and authenticators. Generation of the keys may involve utilizing specialized information that, as a result of being used to generate the keys, renders the generated keys usable for a smaller scope of uses than the secret credential. Further, key generation may involve multiple invocations of a function where each of at least a subset of the invocations of the function results in a key that has a smaller scope of permissible use than a key produced from a previous invocation of the function. Generated keys may be used as signing keys to sign messages. One or more actions may be taken depending on whether a message and/or the manner in which the message was submitted complies with restrictions of the a key's use.

Abstract: Systems and methods are described for delegating permissions to enable account access. The systems utilize a delegation profile that can be created within a secured account of at least one user. The delegation profile includes a name, a validation policy that specifies principals which may be external to the account and which are permitted to assume the delegation profile, and an authorization policy that indicates the permitted actions within the account for those principals which are acting within the delegation profile. Once the delegation profile is created, it can be provided to external principals or services. These external principals or services can use the delegation profile to obtain credentials for performing various actions in the account using the credentials of the delegation profile.

Abstract: An apparatus and method for use in treating tinnitus, employs a sound processing unit, a tactile unit, and an interface therebetween. The tactile unit comprises an array of stimulators each of which can be independently actuated to apply a tactile stimulus to a subject, and an input for receiving a plurality of actuation signals from the interface and directing individual actuation signals to individual stimulators. The sound processing unit receives an audio signal at an input, analyses the signal with a digital signal processor to generate the actuation signals which are representative of the audio signal, and provides the plurality of actuation signals to the interface. In a preferred embodiment the digital signal processor divides the audio signal into a series of frames in the time domain, performs a transform on each frame to generate a set of coefficients representing said frame, and maps the set of coefficients to a set of actuation signals to be applied to the array.

Abstract: Customers accessing resources or services in a distributed environment can obtain assurance that a provider of that environment will only allow requests to access those resources or services when those requests satisfy at least one security policy associated with the customer. A customer can provide a security policy update that might be written in a different representation (e.g., version) than is supported by all relevant policy evaluation engines across the distributed environment. A component or service such as an access management service can evaluate the representation of the policy, as well as the representations supported by the evaluation engines, and can determine if the features of the policy update are supported by the representations of the engines. If so, the policy update can be translated to express the policy document in the supported representation(s), such that the policy can be utilized without having to update the relevant engines.

Abstract: Systems and methods for controlling access to one or more computing resources relate to generating session credentials that can be used to access the one or more computing resources. Access to the computing resources may be governed by a set of policies and requests for access made using the session credentials may be fulfilled depending on whether they are allowed by the set of policies. The session credentials themselves may include metadata that may be used in determining whether to fulfill requests to access the one or more computing resources. The metadata may include permissions for a user of the session credential, claims related to one or more users, and other information.