Virtual communication endpoint services

• US 10,484,433 B2
• Filed: 02/05/2018
• Issued: 11/19/2019
• Est. Priority Date: 11/20/2012
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roth, Gregory Branchek, Baer, Graeme David, Brandwine, Eric Jason
• Primary Examiner(s): Zhao, Don G
• Application Number:
  US15/888,722
• Publication Number:
  US 20190044979A1
• Time in Patent Office: 652 Days
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers

Abstract

Customers can utilize resources of a multi-tenant environment to provide one or more services available to various users. In order to simplify the process for these customers, the multi-tenant environment can include an infrastructure wherein a portion of the resources provide an authentication and/or authorization service that can be leveraged by the customer services. These resources can logically sit in front of the resources used to provide the customer services, such that a user request must pass through the authorization and authentication service before being directed to the customer service. Such resources can provide other functionality as well, such as load balancing and metering.

Claims

1. A system to manage requests for a service, comprising:

at least one processor; and

memory storing instructions that, when executed by the at least one processor, cause the system to;

provide access to an endpoint interface for a service by a virtual load balancer of a multi-tenant environment;

receive a communication to a virtual endpoint for the service from a computing device of a user, the communication including a signature generated using at least one security credential;

determine whether the signature is a valid signature and whether the communication is allowed according to one or more policies associated with the communication; and

forward the communication to the endpoint interface for the service when the signature is a valid signature and the communication is determined to be allowed.

2. The system of claim 1, wherein the multi-tenant environment comprises a plurality of resources that are shared among a plurality of customers, wherein the user is associated with a first customer of the plurality of customers, and wherein the instructions, when executed by the at least one processor, further cause the system to:

allocate a resource associated with a second customer of the plurality of customers for use by the service.

3. The system of claim 1, wherein the instructions, when executed by the at least one processor, further cause the system to:

annotate the communication with authentication and authorization information resulting from determining whether the signature is a valid signature and whether the communication is allowed.

4. The system of claim 1, wherein the instructions, when executed by the at least one processor, further cause the system to:

transmit at least a portion of the communication to a separate authentication and authorization service;

receive information about the communication from the separate authentication and authorization service; and

determine whether the signature is a valid signature based at least in part on the information about the communication from the separate authentication and authorization service.

5. The system of claim 1, wherein the instructions, when executed by the at least one processor, further cause the system to:

receive information about the communication from a local cache; and

determine whether the signature is a valid signature based at least in part on the information about the communication from the local cache.

6. The system of claim 1, wherein the communication is generated using at least one software development kit associated with at least one public protocol.

7. The system of claim 1, wherein the instructions, when executed by the at least one processor, further cause the system to:

retrieve the one or more policies associated with the communication based on at least one of a resource associated with the communication, a customer associated with the resource, or a service associated with the communication.

8. A computer-implemented method, comprising:

receiving, by a virtual load balancer of a multi-tenant environment, a communication to a virtual endpoint from a computing device of a user, the communication including a signature generated using at least one security credential;

determining, by the virtual load balancer of the multi-tenant environment, whether the signature is a valid signature and whether the communication is allowed according to one or more policies associated with the communication; and

forwarding, by the virtual load balancer of the multi-tenant environment, the communication to an endpoint interface for a service when the signature is a valid signature and the communication is determined to be allowed.

9. The computer-implemented method of claim 8, wherein the multi-tenant environment comprises a plurality of resources that are shared among a plurality of customers, wherein the user is associated with a first customer of the plurality of customers, and wherein the computer-implemented method further comprises:

allocating a resource associated with a second customer of the plurality of customers for use by the service.

10. The computer-implemented method of claim 8, further comprising:

annotating the communication with authentication and authorization information resulting from determining whether the signature is a valid signature and whether the communication is allowed.

11. The computer-implemented method of claim 8, further comprising:

transmitting at least a portion of the communication to a separate authentication and authorization service;

receiving information about the communication from the separate authentication and authorization service; and

determining whether the signature is a valid signature based at least in part on the information about the communication from the separate authentication and authorization service.

12. The computer-implemented method of claim 8, wherein the communication is generated using at least one software development kit associated with at least one public protocol.

13. The computer-implemented method of claim 8, further comprising:

retrieving the one or more policies associated with the communication based on at least one of a resource associated with the communication, a customer associated with the resource, or a service associated with the communication.

14. A non-transitory computer-readable storage medium including instructions that, when executed by at least one processor of a computer system, cause the computer system to:

provide access to an endpoint interface for a service by a virtual load balancer of a multi-tenant environment;

receive a communication to a virtual endpoint for the service from a computing device of a user, the communication including a signature generated using at least one security credential;

determine whether the signature is a valid signature and whether the communication is allowed according to one or more policies associated with the communication; and

forward the communication to the endpoint interface for the service when the signature is a valid signature and the communication is determined to be allowed.

15. The non-transitory computer-readable storage medium of claim 14, wherein the multi-tenant environment comprises a plurality of resources that are shared among a plurality of customers, wherein the user is associated with a first customer of the plurality of customers, and wherein the instructions, when executed, further cause the computer system to:

allocate a resource associated with a second customer of the plurality of customers for use by the service.

16. The non-transitory computer-readable storage medium of claim 14, wherein the instructions, when executed, further cause the computer system to:

annotate the communication with authentication and authorization information resulting from determining whether the signature is a valid signature and whether the communication is allowed.

17. The non-transitory computer-readable storage medium of claim 14, wherein the instructions, when executed, further cause the computer system to:

transmit at least a portion of the communication to a separate authentication and authorization service;

receive information about the communication from the separate authentication and authorization service; and

determine whether the signature is a valid signature based at least in part on the information about the communication from the separate authentication and authorization service.

18. The non-transitory computer-readable storage medium of claim 14, wherein the instructions, when executed, further cause the computer system to:

receive information about the communication from a local cache; and

determine whether the signature is a valid signature based at least in part on the information about the communication from the local cache.

19. The non-transitory computer-readable storage medium of claim 14, wherein the communication is generated using at least one software development kit associated with at least one public protocol.

20. The non-transitory computer-readable storage medium of claim 14, wherein the instructions when executed further cause the computer system to:

retrieve the one or more policies associated with the communication based on at least one of a resource associated with the communication, a customer associated with the resource, or a service associated with the communication.