Desktop application fulfillment platform with multiple authentication mechanisms

• US 10,367,802 B2
• Filed: 05/25/2018
• Issued: 07/30/2019
• Est. Priority Date: 11/10/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Koushik, Sheshadri Supreeth, Shah, Jaimin Paresh, Lin, Yang, Shrivastava, Abhinav, Sahijwani, Vikram Vijay, Peng, Hao, Pessis, David
• Primary Examiner(s): Tabor, Amare F
• Application Number:
  US15/990,417
• Publication Number:
  US 20180278602A1
• Time in Patent Office: 431 Days
• Field of Search: 726 9, 726 7
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 8/60 Software deployment
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A service provider system may include an application fulfillment platform that delivers desktop applications to desktops on physical computing devices or virtual desktop instances. A computing resource instance may be registered with the platform, which generates a unique identifier and a security token for the computing resource instance using multiple authentication mechanisms. An end user of a customer organization may be registered with the platform, which generates a unique identifier and a security token for the end user using multiple authentication mechanisms. An application delivery agent may submit service requests to the platform on behalf of itself or the given user. The identity and security credentials included in the requests may be dependent on the request type and the entities on whose behalf they are submitted. A proxy service on the platform may receive the requests and validate the credentials, then dispatch the requests to other services on the platform.

Claims

1. A system, comprising:

one or more computing devices that implement a fulfillment platform for a service provider, wherein the fulfillment platform is configured to;

receive a request from an agent installed on a computing resource instance of a user, wherein the computing resource instance comprises a virtualized computing resource instance or a virtual desktop instance implemented on one or more resources of the service provider, and wherein the request comprises a request to subscribe to an application, a request to unsubscribe from an application, or a request to install, uninstall, or reinstall an application on the computing resource instance;

validate an identity of the computing resource instance and a credential for the computing resource instance, or validate an identity of the user and a credential for the user; and

in response to validation of the identity and the credential for the computing resource instance or for the user, process the request.

2. The system of claim 1, wherein the fulfillment platform is configured to:

generate the credential for the computing resource instance;

or

generate the credential for the user.

3. The system of claim 2,

wherein the fulfillment platform is configured to:

receive a request to register the computing resource instance with the fulfillment platform; and

generate the credential for the computing resource instance in response to receiving the request to register the computing resource instance with the fulfillment platform.

4. The system of claim 2,

wherein the fulfillment platform is configured to:

receive a request to register the user with the fulfillment platform or an indication that the user has logged into the computing resource instance; and

generate the credential for the user in response to receiving the request to register the user with the fulfillment platform or the indication that the user has logged into the computing resource instance.

5. The system of claim 1,

wherein the request was submitted by the agent on behalf of the agent;

and

wherein the request comprises the identity of the computing resource instance and the credential for the computing resource instance.

6. The system of claim 1,

wherein the request was submitted by the agent on behalf of the user;

and

wherein the request comprises the identity of the user and the credential for the user.

7. The system of claim 1,

wherein the fulfillment platform comprises a plurality of control plane services, including a proxy service;

wherein the request is received by the proxy service; and

wherein in response to receiving the request, the proxy service is configured to;

validate a security token included in the request; and

dispatch the request to another one of the control plane services.

8. A method, comprising:

performing, by a fulfillment platform implemented by one or more computers of a service provider;

receiving a request from an agent installed on a computing resource instance of a user, wherein the computing resource instance comprises a virtualized computing resource instance or a virtual desktop instance implemented on one or more resources of the service provider, and wherein the request comprises a request to subscribe to an application, a request to unsubscribe from an application, or a request to install, uninstall, or reinstall an application on the computing resource instance;

validating an identity of the computing resource instance and a credential for the computing resource instance, or validating an identity of the user and a credential for the user; and

in response to validating the identity and the credential for the computing resource instance or for the user, processing the request.

9. The method of claim 8, further comprising, prior to the receiving:

generating the credential for the computing resource instance;

or

generating the credential for the user.

10. The method of claim 9, wherein the method further comprises:

prior to receiving the request, receiving a request to register the computing resource instance with the fulfillment platform; and

generating the credential for the computing resource instance in response to receiving the request to register the computing resource instance with the fulfillment platform.

11. The method of claim 9,

wherein the method further comprises, prior to receiving the request, receiving a request to register the user with the fulfillment platform or an indication that the user has logged into the computing resource instance;

and

wherein generating the credential for the user is performed in response to receiving the request to register the user with the fulfillment platform or the indication that the user has logged into the computing resource instance.

12. The method of claim 8, wherein the request comprises the credential for the computing resource instance or the credential for the user.

13. The method of claim 8,

wherein the request was submitted by the agent on behalf of the user;

and

wherein the request comprises one or more of;

the identity of the user, or

the credential for the user.

14. The method of claim 8,

wherein the request was submitted by the agent on behalf of the agent;

and

wherein the request comprises one or more of;

the identity of the computing resource instance, or

the credential for the computing resource instance.

15. A non-transitory computer-readable storage medium storing program instructions that when executed on one or more computers cause the one or more computers to implement a fulfillment platform, wherein the fulfillment platform is configured to perform:

receiving a request from an agent installed on a computing resource instance of a user, wherein the computing resource instance comprises a virtualized computing resource instance or a virtual desktop instance implemented on one or more resources of a service provider, and wherein the request comprises a request to subscribe to an application, a request to unsubscribe from an application, or a request to install, uninstall, or reinstall an application on the computing resource instance;

validating an identity of the computing resource instance and a credential for the computing resource instance, or validating an identity of the user and a credential for the user; and

in response to validating the identity and the credential for the computing resource instance or for the user, processing the request.

16. The non-transitory computer-readable storage medium of claim 15, wherein the fulfillment platform is configured to perform:

generating the credential for the computing resource instance;

or

generating the credential for the user.

17. The non-transitory computer-readable storage medium of claim 16, wherein the fulfillment platform is further configured to perform:

receiving a request to register the computing resource instance with the fulfillment platform; and

generating the credential for the computing resource instance in response to receiving the request to register the computing resource instance with the fulfillment platform.

18. The non-transitory computer-readable storage medium of claim 16, wherein the fulfillment platform is further configured to perform:

receiving a request to register the user with the fulfillment platform or an indication that the user has logged into the computing resource instance; and

generating the credential for the user in response to receiving the request to register the user with the fulfillment platform or the indication that the user has logged into the computing resource instance.

19. The non-transitory computer-readable storage medium of claim 15,

wherein the request was submitted by the agent on behalf of the user;

and

wherein the request comprises the identity of the user and the credential for the user.

20. The non-transitory computer-readable storage medium of claim 15,

wherein the request was submitted by the agent on behalf of the agent;

and

wherein the request comprises the identity of the computing resource instance and the credential for the computing resource instance.