Inbound link handling

Patent metadata

Field	Value
Publication number	US-10452837-B1
Application number	US-201414498870-A
Country	US
Kind code	B1
Filing date	Sep 26, 2014
Priority date	Sep 26, 2014
Publication date	Oct 22, 2019
Grant date	Oct 22, 2019

Abstract

A support service application may process a request that contains a hyperlink. The hyperlink may be examined to determine a level of risk associated with accessing a resource referred to by the hyperlink. An execution environment for processing the hyperlink may be identified. The execution environment may comprise a virtual machine drawn from a pool of virtual machines. The resource may be retrieved by a browser process operating within the context of the virtual machine, and a safe version of the resource may be rendered and made available to customer support personnel using the support service application.

First claim

What is claimed is:

1. A system comprising:
one or more computing nodes that, when activated, operate as a host for a plurality of execution environments, the one or more computing nodes communicatively coupled to a support services application; and
one or more memories having stored thereon computer readable instructions that, upon execution by the one or more computing nodes, cause the system at least to:
receive data indicative of a support service request, the data comprising a first hyperlink indicative of a resource accessible by processing the hyperlink, wherein the resource is associated with responding to the support service request and is stored external to the system;
determine to process the first hyperlink in an execution environment that is separate from the support service application, wherein the determination is based at least in part on a first estimated level of risk associated with accessing the resource;
select an execution environment from the plurality of execution environments, wherein the selected execution environment has access controls configured to permit access to the resource, and wherein the selected execution environment is determined to be available for processing the first hyperlink;
obtain the resource by processing the first hyperlink within the execution environment; and
provide the support service application with access to a version of the resource, wherein the version of the resource is based at least in part on a second estimated level of risk, wherein the second estimated level of risk is based at least in part on the processing of the first hyperlink within the execution environment, and wherein the version of the resource is stored on the system.

2. The system of claim 1 , further comprising one or more memories having stored thereon computer readable instructions that, upon execution by the one or more computing nodes, cause the system at least to:
store the version of the resource at a network location accessible to the support service application; and
form a second hyperlink based at least in part on the first hyperlink, wherein the second hyperlink refers to the version of the resource stored at the network location accessible to the support service application;
wherein the providing the support service application with access to the version of the resource comprises providing the support service application with the second hyperlink.

3. The system of claim 1 , wherein the access controls are configured to permit access to a subset of resources available to the support services application, wherein the data indicative of the support service request is received from a remote device associated with a user, wherein the data indicative of the support service request comprises data indicative of a support issue, and wherein the first hyperlink is associated with the support issue.

4. The system of claim 1 , further comprising one or more memories having stored thereon computer readable instructions that, upon execution by the one or more computing nodes, cause the system at least to:
process the hyperlink based at least in part by providing information indicative of the hyperlink to an instance of an executable process operating on a virtual machine, wherein the instance is selected from a set of instances available for processing the hyperlink.

5. A computer-implemented method comprising:
receiving, by an application executing on a computer and from a remote device, data indicative of a request, wherein the data comprises a first hyperlink indicative of a resource accessible by processing the hyperlink, and wherein the resource is associated with responding to the request and is stored external to the computer;
making a determination to process the first hyperlink in an execution environment separate from the application, wherein the determination is based at least in part on at least one of a first estimated level of risk associated with processing the first hyperlink or a priority for processing the first hyperlink;
identifying, in response to the determination to process the hyperlink, an execution environment available for processing the first hyperlink, wherein the execution environment has access controls sufficient to access the resource;
obtaining the resource by processing the first hyperlink within the execution environment; and
providing the application with access to a version of the resource usable to respond to the request, wherein the version of the resource is selected based at least in part on the processing of the first hyperlink within the execution environment, and wherein the version of the resource is stored on the computer.

6. The method of claim 5 , wherein the first estimated level of risk is determined based at least in part on interaction with the resource in the execution environment.

7. The method of claim 5 , further comprising:
forming the version of the resource by storing at least one of a bitmap or web page obtained by rendering the resource within the execution environment.

8. The method of claim 5 , further comprising:
forming a second hyperlink based at least in part on the first hyperlink, wherein the second hyperlink refers to the version of the resource; and
wherein the providing the application with the access to the version of the resource comprises providing the application with the second hyperlink.

9. The method of claim 5 , further comprising:
forming a second hyperlink based at least in part on the first hyperlink, wherein processing the second hyperlink causes the first hyperlink to be processed in the execution environment separate from the application.

10. The method of claim 5 , wherein the execution environment comprises a virtual machine, the method further comprising:
maintaining a plurality of virtual machine instances in operable states; and
selecting a virtual machine instance of the plurality of virtual machine instances as the execution environment for processing the first hyperlink.

11. The method of claim 10 , further comprising:
determining to maintain a number of virtual machine instances in the plurality of virtual machine instances based at least in part on a rate at which data containing hyperlinks is being received.

12. The method of claim 5 , further comprising:
processing the first hyperlink based at least in part on providing information indicative of the first hyperlink to an instance of an executable process operating on a virtual machine, wherein the instance is selected from a set of instances available for processing the first hyperlink.

13. The method of claim 5 , wherein the first estimated level of risk is based at least in part on a mapping of at least one of a domain, keyword, grammar, or signature to a risk level.

14. A non-transitory computer-readable storage medium having stored thereon instructions that, upon execution by one or more computing devices, cause the one or more computing devices at least to:
receive data indicative of a request, wherein the data comprises a first hyperlink indicative of a resource accessible by processing the hyperlink, and wherein the resource is usable to respond to the request and is stored on a memory of at least one computing device of the one or more computing devices;
making a determination that the first hyperlink should be processed in a second environment other than a first environment in which the request is processed, wherein the determination is based at least in part on at least one of a first estimated level of risk associated with processing the first hyperlink or a priority for processing the first hyperlink;
identifying, in response

Assignees

• Amazon Tech Inc

Inventors

• Roth Gregory Branchek
• Demoss Matthew Daniel
• Miller Jonathan Matthew

Classifications

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title

• G06F2009/45595

  Network integration; Enabling network access in virtual machine instances · CPC title