What does key, key pair and signature mean here?

Question

I was reading How are possible uses for X.509 (SSL) certificates denoted? on IT SE. It begins with:

X.509 certificates can be used for servers, clients, email, code signing and more applications.http://twitpic.com/6gdxaq indicates that a certificate...

The image refers specifically to an incident in 2011, where a rogue google.com certificate from Diginotar had code-signing capability. I wanted to remove dependence on external service Twitpic for the sake of URL persistence. In trying to do so, I noticed something I've seen often, and don't understand. In this context, it refers to cloudfront.net. I'm guessing that is because Twitpic uses Cloudfront as their content delivery network (CDN)?

I can't (easily) upload the image to IT SE, as Twitpic only offers a 150px square thumbnail http://twitpic.com/show/thumb/6gdxaq.jpg. I don't know if Twitpic does this for security, or for SEO purposes. If the latter, it would ensure that viewers visit the Twitpic site in order to see a larger version. To view the full sized image in my browser, there is a Cloudfront domain URL http://d3j5vwomefv46c.cloudfront.net/photos/large/390320594.jpg?with several portions appended. This is my question: What do key, Key-Pair-ID and Signature mean?

1. key=409511&Expires=1358170888&
2. Key-Pair-Id=APKAIYVGSUJFNRFZBBTA&
3. Signature=ZLwi3pS71nfx0MzKMdFMQZYwYtKjzxnoIgLxDa6X16o3K7pjtywH-Sqm7rvZqe3XH0ELZb4fQffF5lWG2h2PF4ONGCoCL6zQKfr~Ep9raiUPM1pO1LbrUDZEJBoYSURAecyNJsctRd9wJgKoFnEkHnSfvsNexYx-Y91cTVmYPQc_

Is there a standardized nomenclature, and is it analogous to what is used for certificates, such as X.509 (SSL) which contain a keys and a signature? That was why I included so much information about the prior question, in case there were any actual or conceptual similarities.

Or does this pertain to authentication, instead of authorization?

Answer 1

It seems that Amazon is using this mechanism for authenticating requests to the CloudFront Servers. Read more here and here.

You generate a key pair using your Amazon account and sign certain URLs that point to private resourcesa and you distribute this signed URLs to the people you want to access your site. The parameters help identify the key that signed the URL(your private key) and the time until the URL can be accessed using this link.

This is how Amazon checks that you authorize the connection at that specific time.