Remote browsing session management

• US 9,137,210 B1
• Filed: 02/21/2012
• Issued: 09/15/2015
• Est. Priority Date: 02/21/2012
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Joglekar, Sachin P., Vosshall, Peter S., Jenkins, Jonathan A.
• Primary Examiner(s): Poltorak, Peter
• Application Number:
  US13/401,763
• Time in Patent Office: 1,302 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 47/83 based on usage prediction
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A browsing process is directed to the generation and management of a browse session at a network computing provider. A client computing device transmits secure requests for network resources to a network computing provider. The network computing provider comprises one or more virtual network computing providers for processing secure communications between a client computing device and a content source. A virtual network computing provider handles the secure communications, decrypting and processing the communications while preventing third parties from accessing the unencrypted communication data. The virtual network computing provider may determine a browse configuration identifying processing actions to perform on the request content. The virtual network computing provider may retrieve the requested content, perform a first set of processing actions to generate a processing result, and provide the processing result to the client computing device, which may perform a second set of processing actions, including display.

Claims

1. A system for trusted browsing comprising:

a network computing provider comprising a plurality of physical network computing devices, wherein individual physical network computing devices comprise hardware configurable to execute specific computing instructions, the network computing provider configurable to host one or more virtual network computing providers, each of the one or more virtual network computing providers logically separate from the rest of the network computing provider,

wherein at least one of the one or more virtual network computing providers is a private virtual network computing provider under control of a content provider separate from the network computing provider, the private virtual network computing provider configured to;

decrypt a first secure network communication received from a client computing device separate from both the network computing provider and the content provider;

communicate with the content provider on behalf of the client computing device by encrypting a second secure network communication for transmission outside of the network computing provider to the content provider, the second secure network communication based at least partly on the first secure network communication; and

redirect a subsequent secure network communication from the client computing device to the content provider without decryption by the private virtual network computing provider.

2. The system of claim 1, wherein secure network communications from the client computing device for content providers other than the content provider managing the private virtual network computing provider are not decrypted.

3. The system of claim 1, wherein secure network communications from the client computing device for content providers other than the content provider managing the private virtual network computing provider are redirected out of the private virtual network computing provider.

4. The system of claim 1, wherein the private virtual network computing provider comprises a network browsing component, the network browsing component in communication with a browsing component on the client computing device, the network browsing component configured to perform a first set of processing actions on a network resource requested by the client computing device in the first secure network communication.

5. The system of claim 4, the private virtual network computing provider further configured to:

transmit a secure response to the client computing device comprising a version of the requested network resource processed by the network browsing component according to the first set of processing actions,

wherein communicating with the content provider on behalf of the client computing device comprises retrieving the requested network resource from the content provider, and

wherein the browsing component on the client computing device is configured to cause display of the version by at least performing a second set of processing actions.

6. The system of claim 1, wherein the first secure network communication comprises an HTTPS request for a network resource, the HTTPS request transmitted by the client computing device.

7. The system of claim 1, wherein the second secure network communication comprises an HTTPS request for a network resource transmitted from the private virtual network computing provider.

8. The system of claim 7, wherein the private virtual network computing provider is further configured to receive, from the content provider, an HTTPS response comprising the network resource requested by the client computing device.

9. The system of claim 8, wherein the network resource is one of a web page, image, video, applet, or document.

10. The system of claim 1, wherein the secure network communications comprise tunneled communications.

11. A system for trusted browsing comprising:

a network computing provider comprising a plurality of physical network computing components, wherein individual physical network computing components comprise hardware configurable to execute specific computing instructions, the network computing provider configurable to host one or more virtual network computing providers, each of the one or more virtual network computing providers logically separate from the rest of the network computing provider,

wherein at least one of the one or more virtual network computing providers is a private virtual network computing provider managed by an operator of one or more client computing devices, the private virtual network computing provider configured to;

decrypt a first secure network communication received from a first client computing device of the one or more client computing devices, the first client computing device separate from both the network computing provider and a content provider;

communicate with the content provider on behalf of the first client computing device by encrypting a second secure network communication for transmission outside of the network computing provider to the content provider, the second secure network communication based at least partly on the first secure network communication; and

redirect a subsequent secure network communication from the client computing device to the content provider without decryption by the private virtual network computing provider.

12. The system of claim 11, wherein secure network communications from client computing devices other than the one or more client computing devices operated by the manager of the private virtual network computing provider are not decrypted.

13. The system of claim 12, wherein secure network communications from client computing devices other than the one or more client computing devices operated by the manager of the private virtual network computing provider are redirected out of the private virtual network computing provider.

14. The system of claim 11, wherein the private virtual network computing provider comprises a network browsing component, the network browsing component in communication with a browsing component on the first client computing device, the network browsing component configured to perform a set of processing actions on a network resource requested by the first client computing device in the first secure network communication.

15. The system of claim 14, the private virtual network computing provider further configured to:

transmit a secure response to the first client computing device comprising a version of the requested network resource processed by the network browsing component according to the set of processing actions,

wherein communicating with the content provider on behalf of the first client computing device comprises retrieving the requested network resource from the content provider, and

wherein the browsing component on the first client computing device is configured to cause display of the version by at least performing a second set of processing actions.

16. The system of claim 11, wherein the first secure network communication comprises an HTTPS request for a network resource.

17. The system of claim 11, wherein the second secure network communication comprises an HTTPS request for a network resource transmitted from the private virtual network computing provider.

18. The system of claim 17, wherein the private virtual network computing provider is further configured to receive, from the content provider, an HTTPS response comprising the network resource requested by the first client computing device.

19. The system of claim 17, wherein the network resource is one of a web page, image, video, applet, or document.

20. The system of claim 11, wherein the secure network communications comprise tunneled communications.