US 11,146,569 B1Granted

Escalation-resistant secure network services using request-scoped authentication information

AssigneeAmazon Technologies, Inc.

InventorsMarc John Brooker, Ajay Nair, Colm MacCárthaigh

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and methods are described for providing escalation-resistant network-accessible services by providing the service through a set of service instances, each executing in an environment with privileges scoped based on a user requesting to access the service. Each service instance can be implemented by code on a serverless code system, executed in response to a user request to access the service. Because the code is executed in an environment with privileges scoped to those of a requesting user, the code itself need not attempt to limit the privileges or a requesting user. For that reason, potential for privilege escalations of the service are reduced, even if vulnerabilities in the code might otherwise allow for such escalations.

Claims14

Dependent claims

A system to implement privilege-escalation-resistant service instances via execution of a code on an on-demand code execution system, wherein executions of the code implement instances of a network-accessible service, the system comprising:

a physical data store storing the code;
and
one or more computing devices configured with specific computer-executable instructions to:
receive transmissions corresponding to interactions with the network-accessible service, wherein each transmission includes authentication information of a user interacting with the network-accessible service, and wherein each user is associated with privileges denoting actions on the network-accessible service allowed to be taken by the user;
for each transmission corresponding to an interaction with the network-accessible service:
generate a virtualized execution environment with privileges scoped to privileges of the user interacting with the network-accessible service at least partly by limiting the virtualized execution environment based on the authentication information included within the transmission corresponding to the interaction with the network-accessible service;
and
execute the code within the virtualized execution environment to provide a privilege-escalation-resistant instance of the network-accessible service with privileges scoped to the privileges of the user interacting with the network-accessible service, wherein the instance of the network-accessible service processes the transmission to conduct the interactions;
wherein, for at least a second transmission of the transmissions, generating the virtualized execution environment comprises:
removing the authentication information of a user corresponding to a prior transmission from the virtualized execution environment;
and
provisioning the virtualized execution environment with the authentication information of a user corresponding to the second transmission.

9 more elements

A computer-implemented method comprising:

receiving transmissions corresponding to interactions with a network-accessible service, wherein network-accessible service is implemented via execution of code on an on-demand code execution system, wherein each transmission includes authentication information of a user interacting with the network-accessible service, and wherein each user is associated privileges denoting actions on the network-accessible service allowed to be taken by the user;
for each transmission corresponding to an interaction with the network-accessible service:
generating a virtualized execution environment on the on-demand code execution system with privileges scoped to privileges of the user interacting with the network-accessible service at least partly by limiting the virtualized execution environment to the authentication information included within the transmission corresponding to the interaction with the network-accessible service;
and
executing the code within the virtualized execution environment to provide an instance of the network-accessible service with privileges scoped to the privileges of the user interacting with the network-accessible service, wherein the instance of the network-accessible service processes the transmission to conduct the interaction;
wherein, for at least a second transmission of the transmissions, generating the virtualized execution environment comprises:
removing the authentication information of a user corresponding to a prior transmission from the virtualized execution environment;
and
provisioning the virtualized execution environment with the authentication information of a user corresponding to the second transmission.

6 more elements

Non-transitory computer-readable media comprising instructions executable on a computing system to:

receive transmissions corresponding to interactions with a network-accessible service, wherein network-accessible service is implemented via execution of code on an on-demand code execution system, wherein each transmission identifies authentication information of a user interacting with the network-accessible service, and wherein each user is associated privileges denoting actions on the network-accessible service allowed to be taken by the user;
for each transmission corresponding to an interaction with the network-accessible service:
generate a virtualized execution environment on the on-demand code execution system with privileges scoped to privileges of the user interacting with the network-accessible the service at least partly by limiting the virtualized execution environment to the authentication information included within the transmission corresponding to the interaction with the network-accessible service;
and
execute the code within the virtualized execution environment to provide an instance of the network-accessible service with privileges scoped to the privileges of the user interacting with the network-accessible service, wherein the instance of the network-accessible service processes the transmission to conduct the interaction;
wherein, for at least a second transmission of the transmissions, generating the virtualized execution environment comprises:
removing the authentication information of a user corresponding to a prior transmission from the virtualized execution environment;
and
provisioning the virtualized execution environment with the authentication information of a user corresponding to the second transmission.

6 more elements

Dependencies are inferred from the claim text.