Inbound link handling

• US 10,452,837 B1
• Filed: 09/26/2014
• Issued: 10/22/2019
• Est. Priority Date: 09/26/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory Branchek, DeMoss, Matthew Daniel, Miller, Jonathan Matthew
• Primary Examiner(s): Bates, Kevin T
• Assistant Examiner(s): Huang, Chen-Liang
• Application Number:
  US14/498,870
• Time in Patent Office: 1,852 Days
• Field of Search: 726 22, 726 23, 709201
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A support service application may process a request that contains a hyperlink. The hyperlink may be examined to determine a level of risk associated with accessing a resource referred to by the hyperlink. An execution environment for processing the hyperlink may be identified. The execution environment may comprise a virtual machine drawn from a pool of virtual machines. The resource may be retrieved by a browser process operating within the context of the virtual machine, and a safe version of the resource may be rendered and made available to customer support personnel using the support service application.

Claims

1. A system comprising:

one or more computing nodes that, when activated, operate as a host for a plurality of execution environments, the one or more computing nodes communicatively coupled to a support services application; and

one or more memories having stored thereon computer readable instructions that, upon execution by the one or more computing nodes, cause the system at least to;

receive data indicative of a support service request, the data comprising a first hyperlink indicative of a resource accessible by processing the hyperlink, wherein the resource is associated with responding to the support service request and is stored external to the system;

determine to process the first hyperlink in an execution environment that is separate from the support service application, wherein the determination is based at least in part on a first estimated level of risk associated with accessing the resource;

select an execution environment from the plurality of execution environments, wherein the selected execution environment has access controls configured to permit access to the resource, and wherein the selected execution environment is determined to be available for processing the first hyperlink;

obtain the resource by processing the first hyperlink within the execution environment; and

provide the support service application with access to a version of the resource, wherein the version of the resource is based at least in part on a second estimated level of risk, wherein the second estimated level of risk is based at least in part on the processing of the first hyperlink within the execution environment, and wherein the version of the resource is stored on the system.

2. The system of claim 1, further comprising one or more memories having stored thereon computer readable instructions that, upon execution by the one or more computing nodes, cause the system at least to:

store the version of the resource at a network location accessible to the support service application; and

form a second hyperlink based at least in part on the first hyperlink, wherein the second hyperlink refers to the version of the resource stored at the network location accessible to the support service application;

wherein the providing the support service application with access to the version of the resource comprises providing the support service application with the second hyperlink.

3. The system of claim 1, wherein the access controls are configured to permit access to a subset of resources available to the support services application, wherein the data indicative of the support service request is received from a remote device associated with a user, wherein the data indicative of the support service request comprises data indicative of a support issue, and wherein the first hyperlink is associated with the support issue.

4. The system of claim 1, further comprising one or more memories having stored thereon computer readable instructions that, upon execution by the one or more computing nodes, cause the system at least to:

process the hyperlink based at least in part by providing information indicative of the hyperlink to an instance of an executable process operating on a virtual machine, wherein the instance is selected from a set of instances available for processing the hyperlink.

5. A computer-implemented method comprising:

receiving, by an application executing on a computer and from a remote device, data indicative of a request, wherein the data comprises a first hyperlink indicative of a resource accessible by processing the hyperlink, and wherein the resource is associated with responding to the request and is stored external to the computer;

making a determination to process the first hyperlink in an execution environment separate from the application, wherein the determination is based at least in part on at least one of a first estimated level of risk associated with processing the first hyperlink or a priority for processing the first hyperlink;

identifying, in response to the determination to process the hyperlink, an execution environment available for processing the first hyperlink, wherein the execution environment has access controls sufficient to access the resource;

obtaining the resource by processing the first hyperlink within the execution environment; and

providing the application with access to a version of the resource usable to respond to the request, wherein the version of the resource is selected based at least in part on the processing of the first hyperlink within the execution environment, and wherein the version of the resource is stored on the computer.

6. The method of claim 5, wherein the first estimated level of risk is determined based at least in part on interaction with the resource in the execution environment.

7. The method of claim 5, further comprising:

forming the version of the resource by storing at least one of a bitmap or web page obtained by rendering the resource within the execution environment.

8. The method of claim 5, further comprising:

forming a second hyperlink based at least in part on the first hyperlink, wherein the second hyperlink refers to the version of the resource; and

wherein the providing the application with the access to the version of the resource comprises providing the application with the second hyperlink.

9. The method of claim 5, further comprising:

forming a second hyperlink based at least in part on the first hyperlink, wherein processing the second hyperlink causes the first hyperlink to be processed in the execution environment separate from the application.

10. The method of claim 5, wherein the execution environment comprises a virtual machine, the method further comprising:

maintaining a plurality of virtual machine instances in operable states; and

selecting a virtual machine instance of the plurality of virtual machine instances as the execution environment for processing the first hyperlink.

11. The method of claim 10, further comprising:

determining to maintain a number of virtual machine instances in the plurality of virtual machine instances based at least in part on a rate at which data containing hyperlinks is being received.

12. The method of claim 5, further comprising:

processing the first hyperlink based at least in part on providing information indicative of the first hyperlink to an instance of an executable process operating on a virtual machine, wherein the instance is selected from a set of instances available for processing the first hyperlink.

13. The method of claim 5, wherein the first estimated level of risk is based at least in part on a mapping of at least one of a domain, keyword, grammar, or signature to a risk level.

14. A non-transitory computer-readable storage medium having stored thereon instructions that, upon execution by one or more computing devices, cause the one or more computing devices at least to:

receive data indicative of a request, wherein the data comprises a first hyperlink indicative of a resource accessible by processing the hyperlink, and wherein the resource is usable to respond to the request and is stored on a memory of at least one computing device of the one or more computing devices;

making a determination that the first hyperlink should be processed in a second environment other than a first environment in which the request is processed, wherein the determination is based at least in part on at least one of a first estimated level of risk associated with processing the first hyperlink or a priority for processing the first hyperlink;

identifying, in response to the determination to process the hyperlink, an execution environment available for processing the first hyperlink, wherein the execution environment has access controls sufficient to access the resource and limited based at least in part on the estimated level of risk;

obtain the resource by processing the first hyperlink within the execution environment; and

provide the first environment access to a version of the resource, wherein the version of the resource is based at least in part on a second estimated level of risk associated with utilizing the resource, wherein the second estimated level of risk is determined based at least in part on the processing of the first hyperlink within the execution environment, and wherein the version of the resource is stored on another memory different than the memory coupled to the at least one computing device.

15. The non-transitory computer-readable storage medium of claim 14, comprising further instructions that, upon execution by the one or more computing devices, cause the one or more computing devices to at least:

form a second hyperlink based at least in part on the first hyperlink, wherein the second hyperlink provides access to the version of the resource; and

wherein the instructions that cause the one or more computing devices to provide access to the version of the resource comprise instructions that cause the one or more computing devices to render, in an application associated with responding to the request, a visual indication that the second hyperlink may be safely followed.

16. The non-transitory computer-readable storage medium of claim 14, comprising further instructions that, upon execution by the one or more computing devices, cause the one or more computing devices to at least:

record an interaction between a user of an application associated with responding to the request, wherein the interaction occurs with the execution environment while processing the first hyperlink.

17. The non-transitory computer-readable storage medium of claim 14, wherein the first estimated level of risk is based at least in part on a mapping of domains to risk levels.

18. The non-transitory computer-readable storage medium of claim 14, wherein the execution environment has less access privileges than the first environment.

19. The non-transitory computer-readable storage medium of claim 14, wherein the instructions that cause the one or more computing devices to provide access to the version of the resource comprise instructions that cause the one or more computing devices to at least:

replace the first hyperlink with a second hyperlink, wherein the second hyperlink refers to the version of the resource.

20. The non-transitory computer-readable storage medium of claim 14, wherein the version of the resource comprises a non-interactive rendering of the resource.

21. The non-transitory computer-readable storage medium of claim 14, comprising further instructions that, upon execution by the one or more computing devices, cause the one or more computing devices to at least:

process the first hyperlink based at least in part by providing information indicative of the first hyperlink to an instance of an executable process operating on a virtual machine, wherein the instance is selected from a set of instances available for processing the first hyperlink.

22. The non-transitory computer-readable storage medium of claim 14, comprising further instructions that, upon execution by the one or more computing devices, cause the one or more computing devices to at least:

set the priority for processing the first hyperlink based at least in part on a predicted time of using the version of the resource usable to respond to the request.