Managing authorized execution of code

• US 10,574,646 B2
• Filed: 03/15/2018
• Issued: 02/25/2020
• Est. Priority Date: 03/31/2006
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Sirota, Peter
• Primary Examiner(s): Cribbs, Malcolm
• Application Number:
  US15/922,735
• Publication Number:
  US 20180205719A1
• Time in Patent Office: 712 Days
• CPC Class Codes: G06Q 10/06315 Needs-based resource requirements planning or analysis
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 30/0201 Market modelling; Market analysis; Collecting market data
• CPC Class Codes: G06Q 30/0203 Market surveys; Market polls
• CPC Class Codes: G06Q 30/0621 Item configuration or customization
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Techniques are described for providing customizable sign-on functionality, such as via an access manager system that provides single sign-on functionality and other functionality to other services for use with those services'"'"' users. The access manager system may maintain various sign-on and other account information for various users, and provide single sign-on functionality for those users using that maintained information on behalf of multiple unrelated services with which those users interact. The access manager may allow a variety of types of customizations to single sign-on functionality and/or other functionality available from the access manager, such as on a per-service basis via configuration by an operator of the service, such as co-branding customizations, customizations of information to be gathered from users, customizations of authority that may be delegated to other services to act on behalf of users, etc., and with the customizations that are available being determined specifically for that service.

Claims

1. A computer-implemented method comprising:

performing, by a web-based service implemented by one or more computing systems;

authorizing a website to perform executable code within a web-based service, wherein the authorizing includes;

receiving, from a customer service that implements the website, information specifying circumstances under which to execute indicated executable code; and

determining that the customer service is authorized to initiate executing of the executable code; and

in response to an occurrence of the specified circumstances and based at least in part on the determining that the customer service is authorized, performing the executable code in the web-based service on behalf of a user of the website, wherein the performing of the executable code includes;

executing, in response to an electronic communication received by the one or more computing systems over one or more computer networks, the executable code; and

providing information about results from the executing of the executable code to a recipient over the one or more computer networks;

where the executable code is performed without the user seeking authorization to perform the executable code.

2. The computer-implemented method of claim 1 wherein the performing of the executable code includes receiving a sign-on page to the user.

3. The computer-implemented method of claim 2 wherein the performing of the executable code includes:

receiving sign-on information of the user via the sign-on page; and

providing a credential for the user based at least in part on the sign-on information.

4. The computer-implemented method of claim 1 wherein the web-based service is a network-accessible sign-on service, and wherein the specified circumstances are based at least in part on the user performing a sign on with the sign-on service resulting from initial interactions by the user with the website.

5. The computer-implemented method of claim 1 further comprising implementing at least some functionality of the customer service including, in response to the initial interactions by the user with the customer service, directing the user to perform additional interactions with the sign-on service related to activities for the sign on.

6. The computer-implemented method of claim 1 wherein the web-based service is a network-accessible third-party service affiliated with the customer service, wherein the specified circumstances are based at least in part on the customer service instructing the third-party service to provide specified functionality for the user resulting from initial interactions by the user with the customer service, and wherein the executing of the executable code is further performed on behalf of the customer service as part of providing the specified functionality for the user.

7. The computer-implemented method of claim 6 wherein the specified circumstances include the customer service delegating authority to the third-party service to perform operations associated with the user at a sign-on service, to cause the third-party service to perform further interactions over the one or more computer networks with the sign-on service that include providing, from the third-party service to the sign-on service, a credential received by the third-party service from the customer service to represent the user and that further include the third-party service initiating the operations associated with the user at the sign-on service.

8. The computer-implemented method of claim 1 wherein the electronic communication received by the one or more computing systems over the one or more computer networks is from a client device of the user and is initiated by the website causing a redirect of the client device to interact with the web-based service after one or more initial interactions of the user with the website.

9. A system, comprising:

one or more hardware processors of one or more computing systems; and

one or more memories with stored instructions that, upon execution by at least one of the one or more hardware processors, cause the system to implement a network-accessible web-based service and to;

authorize a customer service that provides a website to perform executable code within the web-based service, wherein the authorizing includes determining that the customer service is authorized to initiate executing of the executable code under specified circumstances; and

perform the executable code in the web-based service on behalf of a user of the website without the user seeking authorization to perform the executable code, wherein the executable code is performed in response to an occurrence of the specified circumstances and based at least in part on the determining that the customer service is authorized.

10. The system of claim 9 wherein to perform the executable code, the stored instructions when executed by the at least one of hardware processor cause the network-accessible web-based service to:

receive a sign-on page to the user;

receive sign-on information of the user via the sign-on page; and

provide a credential for the user based at least in part on the sign-on information.

11. The system of claim 9 wherein the performing of the executable code includes executing, in response to an electronic communication received by the web-based service over one or more computer networks, the executable code, and providing information about results from the executing of the executable code to a recipient over the one or more computer networks.

12. The system of claim 9 wherein the web-based service is a sign-on service, and wherein the specified circumstances are based at least in part on the user performing a sign on with the sign-on service resulting from initial interactions by the user with the website of the customer service.

13. The system of claim 9 wherein the web-based service is a third-party service affiliated with the customer service, wherein the specified circumstances are based at least in part on the customer service instructing the third-party service to provide specified functionality for the user resulting from initial interactions by the user with the customer service, and wherein the executing of the executable code is further performed on behalf of the customer service as part of providing the specified functionality for the user.

14. The system of claim 13 wherein the specified circumstances include the customer service delegating authority to the third-party service to perform operations associated with the user at a sign-on service, to cause the third-party service to perform further interactions over the one or more computer networks with the sign-on service that include providing, from the third-party service to the sign-on service, a credential received by the third-party service from the customer service to represent the user and that further include the third-party service initiating the operations associated with the user at the sign-on service.

15. The system of claim 9 wherein the receiving of the instructions further includes receiving an indication of an image and receiving information about user selection of at least some of the image being the specified circumstances, and wherein the stored instructions further cause the system to:

display the image to the user; and

receiving an indication of the selection by the user of the at least some of the image,

and wherein the executing of the executable code is performed in response to the selection by the user of the at least some of the image.

16. The system of claim 9 wherein the specified circumstances include a user interacting with the website, and wherein the executing of the executable code is further performed on behalf of the customer service as part of generating and providing one or more Web pages to the user in response to the interacting, and includes sending a credential representing the user to the customer service.

17. The system of claim 9 wherein the performing of the executable code includes executing, by the web-based service, the executable code is response to an electronic communication received by the web-based service over the one or more computer networks from a client device of the user that is initiated by the website causing a redirect of the client device to interact with the web-based service after one or more initial interactions of the user with the website.

18. A non-transitory computer-readable medium having stored contents that cause a computing system of a network-accessible web-based service to perform automated operations including at least:

authorizing a website to perform executable code within the web-based service, wherein the authorizing includes determining that a customer service that provides the website is authorized to initiate executing of the executable code under specified circumstances; and

performing the executable code in the web-based service on behalf of a user of the website without the user seeking authorization to perform the executable code, wherein the executable code is performed in response to an electronic communication received from a client device of the user that is not initiated by the user and in response to an occurrence of the specified circumstances and based at least in part on the determining that the customer service is authorized.

19. The non-transitory computer-readable medium of claim 18 wherein the performing of the executable code includes executing, by the computing system, the executable code and providing information about results from the executing of the executable code to a recipient over the one or more computer networks.

20. The non-transitory computer-readable medium of claim 18 wherein the web-based service is a sign-on service, and wherein sending of the electronic communication received from the client device of the user is initiated by the website causing a redirect of the client device to interact with the web-based service after one or more initial interactions of the user with the website.