Providing enhanced access to remote services

• US 10,187,458 B2
• Filed: 09/15/2016
• Issued: 01/22/2019
• Est. Priority Date: 06/18/2007
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Cabrera, Luis Felipe, Vermeulen, Allan H., DeSantis, Peter N.
• Primary Examiner(s): Hoang, Hieu T
• Application Number:
  US15/266,997
• Publication Number:
  US 20170006091A1
• Time in Patent Office: 859 Days
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 2209/542 Intercept
• CPC Class Codes: G06F 9/54 Interprogram communication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1004 Server selection for load balancing
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04W 12/06 Authentication

Abstract

Techniques are described for providing client computing nodes with enhanced access to remote network-accessible services, such as by providing local capabilities specific to the remote services. In at least some situations, access to remote services by a client computing node may be enhanced by automatically locally performing some activities of the remote services, such as to improve the efficiency of communications that are sent between the client computing node and the remote service and/or to improve the efficiency by the remote service of processing communications from the client computing node. As one example, a node manager system local to a client computing node may perform authentication of communications sent by the client computing node to a remote service and/or may perform other activities specific to the remote service, so that the remote service does not need to perform the authentication and/or other performed activities for the communications.

Claims

1. A non-transitory computer-readable medium having stored contents that cause one or more computing systems to:

execute a software program for a client on a computing device;

configure, before any interactions between the computing device and a remote service that is being provided by at least one computing system separated from the computing device by one or more computer networks, the computing device to store information for use in managing interactions with the remote service, wherein the stored information includes information specific to the remote service;

receive, by the computing device, a communication sent from the software program that is intended for the remote service and requests functionality that involves performance by the remote service of multiple activities;

perform, using the stored information, one or more activities by the computing device on behalf of the remote service, wherein the one or more activities are a subset of the multiple activities and include authenticating the received communication based at least in part on the information specific to the remote service and on further information included in the received communication; and

send, by the computing device and based at least in part on the performing of the one or more activities, one or more communications over the one or more computer networks to the remote service on behalf of the client to initiate performance by the remote service on the at least one computing system of one or more additional activities of the multiple activities that are separate from the one or more activities performed by the computing device.

2. The non-transitory computer-readable medium of claim 1 wherein the computing device hosts multiple virtual machines, wherein the software program is executed on one of the multiple virtual machines, wherein the configuring of the computing device includes configuring additional software on the computing device to perform the managing of the interactions with the remote service as part of managing communications for the multiple virtual machines, and wherein the performing of the one or more activities and the sending of the one or more communications are performed under control of the additional software as it executes on the computing device.

3. The non-transitory computer-readable medium of claim 2 wherein the configuring of the additional software includes executing the additional software on the computing device, and wherein the one or more computing systems include the at least one computing system.

4. The non-transitory computer-readable medium of claim 1 wherein the one or more computing systems are part of a program execution service that provides a plurality of computing devices for use in executing programs for multiple clients of the program execution service, wherein the computing device is one of the plurality of computing devices and the client is one of the multiple clients, and wherein the executing of the software program on the computing device is performed by the program execution service and includes selecting the computing device from the plurality of computing devices, and provisioning the computing device for use by the client.

5. The non-transitory computer-readable medium of claim 1 wherein the stored information further includes information specific to the client, and wherein the authenticating of the received communication is further performed based in part on the information specific to the client.

6. The non-transitory computer-readable medium of claim 1 wherein the sending of the one or more communications includes generating the one or more communications by modifying the received communication to include information related to the performing of the one or more activities by the computing device.

7. The non-transitory computer-readable medium of claim 1 wherein the stored contents include software instructions that, when executed, further configure the computing device to update the stored information on the computing device to include information related to the performing of the one or more activities by the computing device, and to send one or more further communications from the executing software program to the remote service without performing further activities on behalf of the remote service based on the updated stored information.

8. The non-transitory computer-readable medium of claim 1 wherein the functionality requested from the remote service includes obtaining data from the remote service, and wherein the performing of the one or more activities includes providing at least some of the data to the executing software program of the client from a local data cache on the computing device.

9. A computer-implemented method comprising:

configuring, before any interactions between a host computing system that hosts a virtual machine and at least one other computing system that is separated from the host computing system by one or more computer networks and that provides a remote service, the host computing system to manage interactions between the virtual machine on the host computing system and the remote service, including storing information on the host computing system specific to the remote service;

receiving, by the host computing system and after the configuring, a communication that is sent by an executing program on the virtual machine and is intended for the remote service, wherein the communication requests functionality from the remote service that includes performance of multiple activities;

performing, by the host computing system and based at least in part on the configuring, one or more activities on behalf of the remote service, wherein the one or more activities are a subset of the multiple activities; and

sending, by the host computing system and after the performing of the one or more activities, one or more communications over the one or more computer networks to the remote service to obtain the requested functionality for the executing program, wherein the sent one or more communications initiate performance by the remote service on the at least one computing system of one or more additional activities of the multiple activities that are separate from the one or more activities performed by the host computing system.

10. The computer-implemented method of claim 9 wherein the configuring of the host computing system further includes storing information on the host computing system about a user associated with the executing program on the virtual machine, and wherein the performing of the one or more activities on behalf of the remote service includes authenticating the received communication based at least in part on the stored information about the user.

11. The computer-implemented method of claim 9 wherein the sending of the one or more communications includes generating the one or more communications by modifying the received communication to include information about the one or more activities performed by the host computing system.

12. The computer-implemented method of claim 9 wherein the performing of the one or more activities is further based at least in part on information previously received from the remote service in response to a prior communication sent to the remote service from another hosted virtual machine.

13. The computer-implemented method of claim 9 further comprising updating the stored information on the host computing system to include information about the performing of the one or more activities by the host computing system, and sending one or more additional communications from the virtual machine to the remote service without performing further activities on behalf of the remote service based on the information included in the updated stored information about the performing of the one or more activities by the host computing system.

14. A system comprising:

one or more hardware processors; and

one or more memories with stored instructions that, when executed by at least one of the one or more hardware processors, cause the system to;

configure, before any interactions between a host computing system executing a software program and at least one other computing system that is remote from the host computing system and that provides a web service, the host computing system to manage interactions between the software program and the web service, including storing information on the host computing system about a client associated with the software program;

obtain a communication that is sent by the software program and is intended for the web service to request functionality from the web service that involves performance of multiple activities;

perform one or more activities by the host computing system on behalf of the web service that include using the stored information to authenticate the communication, wherein the one or more activities are a subset of the multiple activities; and

send one or more communications over one or more computer networks to the web service on behalf of the client to initiate performance by the web service of one or more additional activities on the at least one other computing system that are separate from the one or more activities performed by the host computing system and that do not include authenticating the one or more communications.

15. The system of claim 14 wherein the sending of the one or more communications to the web service includes sending the one or more communications to a storage node of the web service that stores data specified in the obtained communication.

16. The system of claim 14 wherein the obtained communication is sent by the executing software program to a public interface of the web service, and wherein the sending of the one or more communications includes sending the one or more communications to a separate private interface of the web service.

17. The system of claim 16 wherein the sending of the one or more communications includes generating the one or more communications by modifying the obtained communication to include information from authenticating of the obtained communication.

18. The system of claim 14 wherein the stored instructions include software instructions that further cause the system to update the stored information on the host computing system to include information about authenticating of the obtained communication, and to send one or more further communications from the software program to the web service over the one or more computer networks without performing further authenticating based on the updated stored information.

19. The system of claim 14 wherein the obtained communication includes a request for data from the web service, and wherein the stored instructions further cause the system to provide at least some of the data to the software program from a local data cache on the host computing system.