Back to results
US 11,700,280 B2Granted
Multi-tenant authentication framework
AssigneeAmazon Technologies, Inc.
InventorsPiyush Pramod Yawalkar, Sandeep Archana Vasudevan
Life of this patent
Estimating the term…
Abstract
Disclosed are various embodiments for a multi-tenant authentication framework. In one embodiment, a particular user class to which a client device belongs is determined based at least in part on location-identifying information of the client device, and the client device is authenticated for access to a network resource using a particular authentication service corresponding to the particular user class.
Claims18
A method, comprising:
- receiving, via at least one of one or more computing devices, a request for a network resource from a client device;
- determining, via at least one of the one or more computing devices, a particular user class to which the client device belongs based at least in part on location-identifying information included in a header of the request, the particular user class being one of a plurality of user classes and the location-identifying information comprising a network address of the client device;
- after determining the particular user class, forwarding, via at least one of the one or more computing devices, the request to a network resource server via an internal network;
- authenticating, via at least one of the one or more computing devices, the client device for access to the network resource using a particular authentication service corresponding to the particular user class, the particular authentication service being one of a plurality of authentication services usable for authentication for access to the network resource;
- after authenticating the client device, determining, via at least one of the one or more computing devices, a different user class to which the client device belongs based at least in part on different location-identifying information of the client device, the different user class being another one of the plurality of user classes;
- and
- blocking, via at least one of the one or more computing devices, access of the client device to the network resource based at least in part on the different user class to which the client device belongs.
4 more elements
A system, comprising:
- at least one computing device;
- and
- instructions executable in the at least one computing device, wherein when executed the instructions cause the at least one computing device to at least:
- receive a request for a network resource from a client device;
- determine a particular user class to which the client device belongs based at least in part on location-identifying information included in a header of the request, the particular user class being one of a plurality of user classes and the location-identifying information comprising a network address of the client device;
- after determining the particular user class, forward the request to a network resource server via an internal network;
- authenticate the client device for access to the network resource using a particular authentication service corresponding to the particular user class, the particular authentication service being one of a plurality of authentication services usable for authentication for access to the network resource;
- after authenticating the client device, determine a different user class to which the client device belongs based at least in part on different location-identifying information of the client device, wherein the different user class is another one of the plurality of user classes;
- and
- block access of the client device to the network resource based at least in part on the different user class to which the client device belongs.
7 more elements
A non-transitory computer-readable medium embodying at least one program executable in at least one computing device, wherein when executed the at least one program causes the at least one computing device to at least:
- receive a request for a network resource from a client device;
- determine a particular user class to which the client device belongs based at least in part on location-identifying information included in a header of the request, the particular user class being one of a plurality of user classes and the location-identifying information comprising a network address of the client device;
- after determining the particular user class, forward the request to a network resource server via an internal network;
- automatically select a particular authentication service corresponding to the particular user class, the particular authentication service being one of a plurality of authentication services usable for authentication for access to the network resource;
- authenticate the client device for access to the network resource using the particular authentication service;
- after authenticating the client device, determine a different user class to which the client device belongs based at least in part on different location-identifying information of the client device, wherein the different user class is another one of the plurality of user classes;
- and
- block access of the client device to the network resource based at least in part on the different user class to which the client device belongs.
5 more elements
Dependencies are inferred from the claim text.