US 9,756,050 B1Granted

Using transient processing containers for security authorization

AssigneeAmazon Technologies, Inc.

InventorEric Jason Brandwine

Life of this patent

Estimating the term…

Loading patent…

Abstract

Authorization decisions can be made in a resource environment using authorization functions which can be provided by customers, third parties, or other such entities. The functions can be implemented using virtual machine instances with one or more transient compute containers. This compute capacity can be preconfigured with certain software and provided using existing compute capacity assigned to a customer, or capacity invoked from a warming pool, to execute the appropriate authorization function. The authorization function can be a lambda function that takes in context and generates the appropriate security functionality inline. The utilization of ephemeral compute capacity enables the functionality to be provided on demand, without requiring explicit naming or identification, and can enable cause state information to be maintained for a customer.

Claims20

Dependent claims

A system, comprising:

at least one processor;
and
memory including instructions that, when executed by the at least one processor, cause the system to:
receive, from a customer, a request for access to a resource in an electronic environment, the electronic environment being provided at least in part by a resource provider, the customer having an account with the resource provider;
determine, based at least in part on information from the request, a policy corresponding to the request;
determine, using the policy, an authorization function to be used in making an authorization decision for the request, the authorization function provided by the customer;
determine an instance of compute capacity, in the electronic environment, to be used in executing the authorization function;
allocate, by the resource provider, the instance of compute capacity on behalf of the customer;
cause the instance of compute capacity to generate the authorization decision using the authorization function and context for the request, the context determined based at least in part upon the information from the request;
receive, from the instance of compute capacity, the authorization decision, the authorization decision indicating that the request for access is authorized;
cause the access to the resource to be provided for the request;
and
de-allocate the instance of compute capacity.

10 more elements

Dependencies are inferred from the claim text.