Hub-based token generation and endpoint selection for secure channel establishment
AssigneeAmazon Technologies, Inc.
InventorsAllan Henry Vermeulen, Matthew John Campagna, Colm Gearóid MacCárthaigh
Life of this patent
Estimating the term…
Abstract
Systems and processes are described for establishing and using a secure channel. A shared secret may be used for authentication of session initiation messages as well as for generation of a private/public key pair for the session. A number of ways of agreeing on the shared secret are described and include pre-sharing the keys, reliance on a key management system, or via a token mechanism that uses a third entity such as a hub to manage authentication, for example. In some instances, the third party may also perform endpoint selection (e.g., load balancing) by providing a particular endpoint along with the token.
Claims20
A system, comprising:
- a hub service configured to provide authentication and load balancing services;
- a stream client implemented via one or more computing devices and configured to send, over a communication channel, a stream request and security credentials to the hub service;
- and
- a stream provider service, distinct from the hub service, and comprising a plurality of stream providers implemented via one or more computing devices and configured to provide data streams to stream clients;
- wherein the hub service that is distinct from the stream service provider is further configured to:
- receive the stream request and security credentials from the stream client;
- authenticate the stream client based at least in part on the security credentials;
- apply a load balancing mechanism to select a stream provider from among the plurality of stream providers of the stream provider service;
- generate an encrypted token comprising information for establishing a secure channel between the stream client and the selected stream provider over another communication channel that is distinct from the communication channel between the stream client and the hub service;
- and
- return, to the stream client over the communication channel, the encrypted token and an endpoint for the selected stream provider;
- wherein the stream client is configured to receive the encrypted token and the endpoint from the hub service and use the encrypted token to send a secure channel initiation message to the selected stream provider to establish the secure channel over the other communication channel with the selected stream provider at the endpoint;
- and
- wherein the selected stream provider that received the secure channel initiation message from the stream client is configured to stream data, via the endpoint, over the secure channel to the stream client.
A computer-implemented method, comprising:
- performing, by a hub service:
- receiving, over a communication channel from a stream client, security credentials and a request to access a service that is distinct from the hub service;
- authenticating the stream client based at least in part on the security credentials;
- applying a selection mechanism to select an endpoint from among a plurality of endpoints for the service;
- generating an encrypted token comprising information for establishing a secure channel between the client and the selected endpoint for the service, wherein the encrypted token is useable by the stream client to send a secure channel initiation message to the service to establish a secure channel between the stream client and the endpoint for the service over another communication channel that is distinct from the communication channel between the stream client and the hub service;
- and
- returning, over the communication channel to the client, the encrypted token and the selected endpoint.
A non-transitory, computer-readable storage medium storing program instructions that when executed implement a hub service configured to perform:
- receiving, over a communication channel from a client, security credentials and a request to access a service that is distinct from the hub service;
- authenticating the client based at least in part on the security credentials;
- applying a selection mechanism to select an endpoint from among a plurality of endpoints for the service;
- generating an encrypted token comprising information for establishing a secure channel between the client and the selected endpoint for the service, wherein the encrypted token is useable to send a secure channel initiation message to the service to establish a secure channel between the client and the endpoint for the service over another communication channel that is distinct from the communication channel between the client and the hub service;
- and
- returning, over the communication channel to the client, the encrypted token and the selected endpoint.
Dependencies are inferred from the claim text.