Providing enhanced access to remote services

• US 9,455,969 B1
• Filed: 09/14/2012
• Issued: 09/27/2016
• Est. Priority Date: 06/18/2007
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: DeSantis, Peter N., Cabrera, Luis Felipe, Vermeulen, Allan H.
• Primary Examiner(s): Hoang, Hieu
• Application Number:
  US13/619,884
• Time in Patent Office: 1,474 Days
• Field of Search: 709/227, 709/228, 709/229
• US Class Current: 1/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 2209/542 Intercept
• CPC Class Codes: G06F 9/54 Interprogram communication
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/1004 Server selection for load balancing
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04W 12/06 Authentication

Abstract

Techniques are described for providing client computing nodes with enhanced access to remote network-accessible services, such as by providing local capabilities specific to the remote services. In at least some situations, access to remote services by a client computing node may be enhanced by automatically locally performing some activities of the remote services, such as to improve the efficiency of communications that are sent between the client computing node and the remote service and/or to improve the efficiency by the remote service of processing communications from the client computing node. As one example, a node manager system local to a client computing node may perform authentication of communications sent by the client computing node to a remote service and/or may perform other activities specific to the remote service, so that the remote service does not need to perform the authentication and/or other performed activities for the communications.

Claims

1. A non-transitory computer-readable medium having stored contents that configure a computing system hosting multiple virtual machines to:

execute, on a first virtual machine of the multiple virtual machines hosted on the computing system, a first software program for a client;

execute, on the computing system and as part of software that manages operations of the multiple virtual machines, a node manager component separate from the first software program that uses stored information on the computing system specific to a remote service being provided over one or more computer networks by one or more other server computing systems separate from the computing system;

receive, by the executing node manager component on the computing system, a communication sent from the first software program of the client on the computing system that is intended for a first interface of the remote service, wherein the communication requests functionality from the remote service that includes performance by the remote service of multiple activities to provide the functionality;

perform, by the executing node manager component on the computing system, and using the stored information specific to the remote service and additional stored information on the computing system related to the client, a subset of the multiple activities on behalf of the remote service; and

send, by the computing system and after the performing of the subset, one or more other communications over the one or more computer networks to a separate second interface of the remote service on behalf of the client in place of the received communication, wherein the sent one or more other communications initiate performance of the multiple activities other than the performed subset by the remote service on the one or more other server computing systems.

2. The non-transitory computer-readable medium of claim 1 wherein the performing of the subset of activities on behalf of the remote service includes authenticating the received communication based on the stored information specific to the remote service and on the additional stored information related to the client and on further information included in the received communication.

3. The non-transitory computer-readable medium of claim 2 wherein the first interface of the remote service is a default interface for unauthenticated communications, wherein authentication activities are not performed by the remote service for communications received via the separate second interface, and wherein the sending of the one or more other communications includes generating the one or more other communications by modifying the received communication to include at least one of information about the authenticating or information specific to the separate second interface.

4. The non-transitory computer-readable medium of claim 2 wherein the stored contents include software instructions that, when executed, further configure the computing system to update the stored information on the computing system to include information about the client being authenticated, and sending one or more further communications from the executing first software program to the separate second interface of the remote service without performing further authenticating based on the updated stored information.

5. The non-transitory computer-readable medium of claim 1 wherein the functionality requested from the remote service includes obtaining data from the remote service, and wherein the performing of the subset of multiple activities includes providing at least some of the data to the executing first software program of the client from a local data cache on the computing system.

6. A computer-implemented method comprising:

executing a program on a first virtual machine of multiple virtual machines hosted by a host computing system, wherein the host computing system includes an executing software component that manages communications for the multiple virtual machines;

configuring the executing software component on the host computing system to further execute a node manager component that includes information specific to a remote service being provided over one or more computer networks by one or more other server computing systems separate from the host computing system;

receiving, by the executing node manager component on the host computing system, a communication that is sent by the executing program on the first virtual machine and is intended for a first interface of the remote service, wherein the communication requests functionality from the remote service that includes performance of multiple activities;

performing, by the executing node manager component on the host computing system before the communication is sent from the host computing system, and using the information specific to the remote service, a subset of the multiple activities on behalf of the remote service; and

sending, by the host computing system and after the performing of the subset, one or more other communications over the one or more computer networks to a separate second interface of the remote service in place of the received communication, wherein the sent one or more other communications initiate performance of the multiple activities other than the performed subset by the remote service on the one or more other server computing systems.

7. The computer-implemented method of claim 6 wherein the configuring of the executing software component on the host computing system further includes storing information on the host computing system about a user for which the program is executed on the first virtual machine, and wherein the performing of the subset of activities on behalf of the remote service includes authenticating the received communication based at least in part on the stored information about the user.

8. The computer-implemented method of claim 7 wherein the first interface of the remote service is a default interface for unauthenticated communications, wherein authentication activities are not performed by the remote service for communications received via the separate second interface, and wherein the sending of the one or more other communications includes generating the one or more other communications by modifying the received communication to include at least one of information about the authenticating or information for use by the separate second interface.

9. The computer-implemented method of claim 6 wherein the performing of the subset of the multiple activities is based at least in part on information previously received from the remote service in response to a prior communication sent to the remote service from one or more of the multiple hosted virtual machines.

10. The computer-implemented method of claim 6 wherein the receiving of the communication, the performing of the subset of the multiple activities and the sending of the one or more other communications is performed for each of multiple communications from multiple clients associated with the multiple virtual machines.

11. The computer-implemented method of claim 7 further comprising, after the authenticating, updating the stored information on the host computing system to include information about the first virtual machine being authenticated, and sending one or more additional communications from the first virtual machine node to the separate second interface of the remote service without performing further authenticating based on the updated stored information.

12. The computer-implemented method of claim 6 wherein the requested functionality from the remote service includes obtaining data from the remote service, and wherein the performing of the subset of multiple activities includes providing at least some of the data to the first virtual machine by the executing node manager component from a local data cache on the host computing system.

13. A computing system comprising:

one or more hardware processors;

multiple virtual machines hosted on the computing system; and

one or more memories with stored instructions that, when executed by at least one of the one or more hardware processors, execute a virtual machine manager that manages operations of the multiple virtual machines and that uses stored information on the computing system specific to a web service being provided over one or more computer networks by one or more other server computing systems separate from the computing system, the managing of the operations including;

executing, on a first virtual machine of the multiple virtual machines, a first software program for a client, and updating the stored information on the computing system to include identifying information for the client;

obtaining, by the virtual machine manager, a communication from the first virtual machine intended for a web service interface of the web service, wherein the web service is configured to authenticate communications sent to the web service interface;

authenticating, by the virtual machine manager before the obtained communication is sent from the computing system, and using the updated stored information, the obtained communication based at least in part on the information specific to the web service and on the identifying information for the client;

generating, by the virtual machine manager, one or more other communications that are based on the obtained communication and that include information from the authenticating for use by the web service; and

sending the one or more other communications over the one or more computer networks to the web service on behalf of the executing first software program in place of the obtained communication.

14. The computing system of claim 13 wherein the sending of the one or more other communications to the web service includes sending the one or more other communications to a storage node of the web service that stores data specified in the obtained communication.

15. The computing system of claim 13 wherein the obtained communication is sent by the executing first software program to a public web service interface of the web service, and wherein the sending of the one or more other communications includes sending the one or more other communications to a separate private interface of the web service.

16. The computing system of claim 15 wherein the public web service interface of the web service is a default interface for unauthenticated communications, wherein authentication activities are not performed by the web service for communications received via the separate private interface, and wherein the sending of the one or more other communications includes generating the one or more other communications by modifying the obtained communication to include at least one of information about the authenticating or information specific to the separate private interface.

17. The computing system of claim 13 wherein the managing of the operations further includes, after the authenticating, updating the stored information on the computing system to include information about the first virtual machine being authenticated, and sending one or more further communications from the first virtual machine to the web service over the one or more computer networks without performing further authenticating based on the updated stored information.

18. The computing system of claim 13 wherein the obtained communication includes a request for data from the web service, and wherein the managing of the operations further includes, responsive to the obtaining of the communication, providing at least some of the data to the first virtual machine from a local data cache on the computing system.