# US 10,484,433 B2 · Virtual communication endpoint services > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,433 B2 - Document ID: US10484433B2 - Status: Granted - Kind: B2 - Application number: 15/888,722 - Filed: 2018-02-05 - Published: 2019-02-07 - Granted: 2019-11-19 - Earliest claimed: 2012-11-20 - Assignees: Amazon Technolgies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Gregory Branchek Roth; Graeme David Baer; Eric Jason Brandwine - Web page: https://patentgrep.com/patent/US10484433B2 ## CPC - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 63/0272: {Virtual private networks} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/123: {received data contents, e.g. message integrity} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/1001: for accessing one among a plurality of replicated servers - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L 63/1458: {Denial of Service} - H04L 63/168: {above the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Customers can utilize resources of a multi-tenant environment to provide one or more services available to various users. In order to simplify the process for these customers, the multi-tenant environment can include an infrastructure wherein a portion of the resources provide an authentication and/or authorization service that can be leveraged by the customer services. These resources can logically sit in front of the resources used to provide the customer services, such that a user request must pass through the authorization and authentication service before being directed to the customer service. Such resources can provide other functionality as well, such as load balancing and metering. ## Claims ### Claim 1 A system to manage requests for a service, comprising: at least one processor; and memory storing instructions that, when executed by the at least one processor, cause the system to: provide access to an endpoint interface for a service by a virtual load balancer of a multi-tenant environment; receive a communication to a virtual endpoint for the service from a computing device of a user, the communication including a signature generated using at least one security credential; determine whether the signature is a valid signature and whether the communication is allowed according to one or more policies associated with the communication; and forward the communication to the endpoint interface for the service when the signature is a valid signature and the communication is determined to be allowed. ### Claim 2 (depends on 1) The system of claim 1, wherein the multi-tenant environment comprises a plurality of resources that are shared among a plurality of customers, wherein the user is associated with a first customer of the plurality of customers, and wherein the instructions, when executed by the at least one processor, further cause the system to: allocate a resource associated with a second customer of the plurality of customers for use by the service. ### Claim 3 (depends on 1) The system of claim 1, wherein the instructions, when executed by the at least one processor, further cause the system to: annotate the communication with authentication and authorization information resulting from determining whether the signature is a valid signature and whether the communication is allowed. ### Claim 4 (depends on 1) The system of claim 1, wherein the instructions, when executed by the at least one processor, further cause the system to: transmit at least a portion of the communication to a separate authentication and authorization service; receive information about the communication from the separate authentication and authorization service; and determine whether the signature is a valid signature based at least in part on the information about the communication from the separate authentication and authorization service. ### Claim 5 (depends on 1) The system of claim 1, wherein the instructions, when executed by the at least one processor, further cause the system to: receive information about the communication from a local cache; and determine whether the signature is a valid signature based at least in part on the information about the communication from the local cache. ### Claim 6 (depends on 1) The system of claim 1, wherein the communication is generated using at least one software development kit associated with at least one public protocol. ### Claim 7 (depends on 1) The system of claim 1, wherein the instructions, when executed by the at least one processor, further cause the system to: retrieve the one or more policies associated with the communication based on at least one of a resource associated with the communication, a customer associated with the resource, or a service associated with the communication. ### Claim 8 A computer-implemented method, comprising: receiving, by a virtual load balancer of a multi-tenant environment, a communication to a virtual endpoint from a computing device of a user, the communication including a signature generated using at least one security credential; determining, by the virtual load balancer of the multi-tenant environment, whether the signature is a valid signature and whether the communication is allowed according to one or more policies associated with the communication; and forwarding, by the virtual load balancer of the multi-tenant environment, the communication to an endpoint interface for a service when the signature is a valid signature and the communication is determined to be allowed. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, wherein the multi-tenant environment comprises a plurality of resources that are shared among a plurality of customers, wherein the user is associated with a first customer of the plurality of customers, and wherein the computer-implemented method further comprises: allocating a resource associated with a second customer of the plurality of customers for use by the service. ### Claim 10 (depends on 8) The computer-implemented method of claim 8, further comprising: annotating the communication with authentication and authorization information resulting from determining whether the signature is a valid signature and whether the communication is allowed. ### Claim 11 (depends on 8) The computer-implemented method of claim 8, further comprising: transmitting at least a portion of the communication to a separate authentication and authorization service; receiving information about the communication from the separate authentication and authorization service; and determining whether the signature is a valid signature based at least in part on the information about the communication from the separate authentication and authorization service. ### Claim 12 (depends on 8) The computer-implemented method of claim 8, wherein the communication is generated using at least one software development kit associated with at least one public protocol. ### Claim 13 (depends on 8) The computer-implemented method of claim 8, further comprising: retrieving the one or more policies associated with the communication based on at least one of a resource associated with the communication, a customer associated with the resource, or a service associated with the communication. ### Claim 14 A non-transitory computer-readable storage medium including instructions that, when executed by at least one processor of a computer system, cause the computer system to: provide access to an endpoint interface for a service by a virtual load balancer of a multi-tenant environment; receive a communication to a virtual endpoint for the service from a computing device of a user, the communication including a signature generated using at least one security credential; determine whether the signature is a valid signature and whether the communication is allowed according to one or more policies associated with the communication; and forward the communication to the endpoint interface for the service when the signature is a valid signature and the communication is determined to be allowed. ### Claim 15 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the multi-tenant environment comprises a plurality of resources that are shared among a plurality of customers, wherein the user is associated with a first customer of the plurality of customers, and wherein the instructions, when executed, further cause the computer system to: allocate a resource associated with a second customer of the plurality of customers for use by the service. ### Claim 16 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the instructions, when executed, further cause the computer system to: annotate the communication with authentication and authorization information resulting from determining whether the signature is a valid signature and whether the communication is allowed. ### Claim 17 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the instructions, when executed, further cause the computer system to: transmit at least a portion of the communication to a separate authentication and authorization service; receive information about the communication from the separate authentication and authorization service; and determine whether the signature is a valid signature based at least in part on the information about the communication from the separate authentication and authorization service. ### Claim 18 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the instructions, when executed, further cause the computer system to: receive information about the communication from a local cache; and determine whether the signature is a valid signature based at least in part on the information about the communication from the local cache. ### Claim 19 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the communication is generated using at least one software development kit associated with at least one public protocol. ### Claim 20 (depends on 14) The non-transitory computer-readable storage medium of claim 14, wherein the instructions when executed further cause the computer system to: retrieve the one or more policies associated with the communication based on at least one of a resource associated with the communication, a customer associated with the resource, or a service associated with the communication.