Remote browsing session management

• US 10,567,346 B2
• Filed: 09/14/2015
• Issued: 02/18/2020
• Est. Priority Date: 02/21/2012
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Joglekar, Sachin P., Vosshall, Peter S., Jenkins, Jonathan A.
• Primary Examiner(s): Poltorak, Piotr
• Application Number:
  US14/853,769
• Publication Number:
  US 20160006697A1
• Time in Patent Office: 1,618 Days
• Field of Search: None
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 47/83 based on usage prediction
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A browsing process is directed to the generation and management of a browse session at a network computing provider. A client computing device transmits secure requests for network resources to a network computing provider. The network computing provider comprises one or more virtual network computing providers for processing secure communications between a client computing device and a content source. A virtual network computing provider handles the secure communications, decrypting and processing the communications while preventing third parties from accessing the unencrypted communication data. The virtual network computing provider may determine a browse configuration identifying processing actions to perform on the request content. The virtual network computing provider may retrieve the requested content, perform a first set of processing actions to generate a processing result, and provide the processing result to the client computing device, which may perform a second set of processing actions, including display.

Claims

1. A computer-implemented method comprising:

as implemented by one or more computing devices executing a server-side browser application configured to communicate with client-side browser applications,

receiving a first encrypted communication from a client-side browser application executing on a client computing device, the first encrypted communication comprising an encrypted request for a network resource;

decrypting the first encrypted communication to recover the request for the network resource;

encrypting the request for the network resource to create a second encrypted communication, the second encrypted communication encrypted with a different key than the first encrypted communication;

retrieving the network resource from a content source using the second encrypted communication, wherein the network resource is configured to be rendered for display by performing a plurality of content rendering actions, and wherein the plurality of content rendering actions comprises at least one of;

parsing a markup document, generating a document object model, generating a structural representation of a display style, executing embedded script code, or generating a display layout;

determining, subsequent to receiving the request and based at least partly on a context of the request for the network resource, a position in a sequence of the plurality of content rendering actions at which to split performance of the plurality of content rendering actions into a first subset of the plurality of content rendering actions to be performed by the server-side browser application and a second subset of the plurality of content rendering actions to be performed by the client-side browser application, wherein the position in the sequence of the plurality of content rendering actions at which to split performance of the plurality of content rendering actions is different than a second position determined based at least partly on a second context of a second request; and

performing the first subset of a plurality of content rendering actions on the network resource to generate an initial processing result, wherein the server-side browser application and client-side browser application are both operable to perform the plurality of content rendering actions.

2. The computer-implemented method of claim 1, wherein retrieving the network resource comprises:

receiving a third encrypted communication from the content source, the third encrypted communication comprising the network resource; and

decrypting the third encrypted communication to recover the network resource.

3. The computer-implemented method of claim 2, wherein at least one of the first encrypted communication, second encrypted communication, or third encrypted communication is an HTTPS communication.

4. The computer-implemented method of claim 1 further comprising:

encrypting a third encrypted communication, the third encrypted communication comprising the initial processing result; and

transmitting the third encrypted communication to the client computing device.

5. The computer-implemented method of claim 1, wherein the network resource comprises one of a web page, image, video, applet, or document.

6. The computer-implemented method of claim 1, wherein determining, subsequent to receiving the request and based at least partly on the context of the request for the network resource, the portion in the sequence of the plurality of content rendering actions at which to split performance of the plurality if processing actions comprises:

determining the first subset of the plurality of content rendering actions based on at least one of;

a processing capability of the client computing device, or a processing capability of the server-side browser application.

7. The computer-implemented method of claim 1, further comprising determining, based at least partly on the second context of the second request, a third subset of the plurality of content rendering actions to be performed by the server-side browser application and a fourth subset of the plurality of content rendering actions to be performed by the client-side browser application, wherein the third subset is different than the first subset, and wherein the fourth subset is different than the second subset.

8. A system comprising:

a computer-readable memory storing executable instructions; and

one or more computer processors in communication with the computer-readable memory, the one or more computer processors programmed by the executable instructions to execute a server-side browser application configured to at least;

receive a first encrypted network resource request from a client-side browser application executing on a client computing device, the first encrypted network resource request comprising a request for a network resource hosted by a remote content source;

decrypt the first encrypted network resource request using a first decryption key to obtain the request for the network resource, wherein the first decryption key corresponds to a first encryption key used to encrypt the first encrypted network resource request;

generate a second encrypted network resource request using a second encryption key different than the first encryption key;

obtain the network resource from the remote content source using the second encrypted network resource request, wherein the network resource is configured to be rendered for display using a plurality of content rendering actions, and wherein the plurality of content rendering actions comprises at least one of;

parsing a markup document, generating a document object model, generating a structural representation of a display style, executing embedded script code, or generating a display layout;

determine, subsequent to receiving the request and based at least partly on a context of the request for the network resource, a position in a sequence of the plurality of content rendering actions at which to split performance of the plurality of content rendering actions into a first subset of the plurality of content rendering actions to be performed by the server-side browser application and a second subset of the plurality of content rendering actions to be performed by the client-side browser application, wherein the position in the sequence of the plurality of content rendering actions at which to split performance of the plurality of content rendering actions is different than a second position determined based at least partly on a second context of a second request; and

perform the first subset of the plurality of content rendering actions on the network resource to generate an initial processing result, wherein the server-side browser application and client-side browser application are both operable to perform the plurality of content rendering actions.

9. The system of claim 8, wherein the network resource comprises one of a web page, image, video, applet, or document.

10. The system of claim 8, wherein the one or more computer processors are further programmed by the executable instructions to at least decrypt the network resource received from the remote content source to recover a decrypted network resource.

11. The system of claim 8, wherein the one or more computer processors are further programmed by the executable instructions to at least:

encrypt a response to the client computing device, the response comprising the initial processing result; and

transmit the response to the client computing device.

12. The system of claim 8, wherein the one or more computer processors are further programmed by the executable instructions to at least execute a private virtual network computing provider comprising the server-side browser application, wherein the private virtual network computing provider is under control of one of:

an owner of the remote content source, or an owner of the client computing device.

13. The system of claim 8, wherein the executable instructions to determine, subsequent to receiving the request and based at least partly on the context of the request for the network resource, the position in the sequence of the plurality of content rendering actions at which to split performance of the plurality of processing actions comprise executable instructions to:

determine the first subset of the plurality of content rendering actions based on at least one of;

a processing capability of the client computing device, or a processing capability of the server-side browser application.

14. Non-transitory computer storage having stored thereon an executable server-side browser application configured to execute a process on a server system, the process comprising:

receiving a first encrypted communication from a client-side browser application executing remotely from the server system, wherein the first encrypted communication comprises a request for a network resource hosted by a content provider separate from the server system;

decrypting the first encrypted communication to recover the request for the network resource;

encrypting the request for the network resource to create a second encrypted communication, the second encrypted communication encrypted with a different key than the first encrypted communication;

transmitting the second encrypted communication, comprising the request for the network resource, to the content provider to obtain the network resource on behalf of the client-side browser application, wherein the network resource is configured to be rendered for display using a plurality of content rendering actions, and wherein the plurality of content rendering actions comprises at least one of;

parsing a markup document, generating a document object model, generating a structural representation of a display style, executing embedded script code, or generating a display layout;

determining, subsequent to receiving the request and based at least partly on a context of the request for the network resource, a position in a sequence of the plurality of content rendering actions at which to split performance of the plurality of content rendering actions into a first subset of the plurality of content rendering actions to be performed by the server-side browser application and a second subset of the plurality of content rendering actions to be performed by the client-side browser application, wherein the position in the sequence of the plurality of content rendering actions at which to split performance of the plurality of content rendering actions is different than a second position determined based at least partly on a second context of a second request; and

performing the first subset of the plurality of content rendering actions on the network resource to generate an initial processing result, wherein the server-side browser application and client-side browser application are both operable to perform the plurality of content rendering actions.

15. The non-transitory computer storage of claim 14, wherein the network resource is received in a third encrypted communication from the content provider.

16. The non-transitory computer storage of claim 15, wherein the process further comprises decrypting the third encrypted communication to recover the network resource.

17. The non-transitory computer storage of claim 14, the process further comprising:

encrypting a third encrypted communication, the third encrypted communication comprising the initial processing result; and

transmitting the third encrypted communication to the client-side browser application.

18. The non-transitory computer storage of claim 14, wherein the network resource comprises one of a web page, image, video, applet, or document.

19. The non-transitory computer storage of claim 14, wherein determining, subsequent to receiving the request and based at least partly on the context of the request for the network resource, the position in the sequence of the plurality of content rendering actions at which to split performance of the plurality of processing actions comprises:

determining the first subset of the plurality of content rendering actions based on at least one of;

a processing capability of a client computing device executing the client-side browser application, or a processing capability of the server-side browser application.