Account management services for load balancers

Patent metadata

Field	Value
Publication number	US-9900350-B2
Application number	US-201615243612-A
Country	US
Kind code	B2
Filing date	Aug 22, 2016
Priority date	Nov 18, 2013
Publication date	Feb 20, 2018
Grant date	Feb 20, 2018

Abstract

A configurable load balancer can be utilized in a multi-tenant environment, where the load balancer can incorporate, or utilize, an account management service operable to perform security tasks such as authentication, authorization, and session management. Customers can utilize the load balancer to control access that users have to resources associated with those customers, without having to build and maintain a dedicated user management system. By implementing security functionality at the load balancer level, traffic can be managed before reaching the resources, which can help to reduce traffic and load on the resources, and can also help to prevent attacks and secure sensitive information. Visibility into the traffic through the load balancer also allows for behavior and usage monitoring, which is helpful for tasks such as billing and usage limit enforcement.

First claim

What is claimed is:

1. A system, comprising:
an interface enabling one or more pools of accounts to be defined for a customer, each pool of accounts associated with a respective policy indicating one or more criteria for providing access to one or more resources of at least a subset of a plurality of electronic resources; and
a load balancer including a memory coupled to a processor, the memory including instructions that upon execution cause the load balancer to:
determine that a user, corresponding to a request, corresponds to a determined pool of the one or more pools of accounts of the customer;
verify that the user is authorized, according to the respective policy associated with the determined pool of accounts, to obtain the access;
determine, using at least one load balancing algorithm of the load balancer, the one or more resources of the subset of the plurality of electronic resources for processing the request, the at least one load balancing algorithm causing the load balancer to distribute processing tasks over the subset of the plurality of electronic resources based at least in part on the at least one load balancing algorithm; and
transmit information for the request to the one or more resources of the subset of the plurality of electronic resources.

2. The system of claim 1 , wherein the interface is an application programming interface (API) that further enables the customer to manage one or more aspects of the one or more pools of accounts.

3. The system of claim 2 , wherein the one or more aspects includes at least one of a type of authentication to be performed, a type of authorization to be performed, a type of registration to be performed, a method or password establishment, a method of password recovery, a type of resource access, or an amount of resource access for at least one pool of the one or more pools of accounts.

4. The system of claim 1 , wherein the plurality of electronic resources are offered in a multi-tenant environment, and wherein each resource of the plurality of electronic resources is capable of being accessed in association with an account of at least one customer.

5. The system of claim 1 , wherein each account of the one or more pools of accounts is associated with one or more users.

6. The system of claim 1 , wherein the memory further comprises instructions that upon execution cause the load balancer to:
authenticate the user according to the respective policy, to obtain the access to the one or more resources.

7. A computer-implemented method, comprising:
receiving, via a load balancer of a multi-tenant computing resource environment, a request initiated by a user, the multi-tenant computing resource environment including a plurality of electronic resources, the load balancer distributing processing tasks over at least a subset of the plurality of electronic resources based at least in part on a load balancing algorithm;
determining an account pool associated with the user, the account pool being determined from a set of account pools established by at least one customer of the multi-tenant computing resource environment, each account of the set of account pools being associated with one or more users;
determining, via the load balancer, a policy specified for the account pool, the policy indicating one or more criteria for processing the request using one or more resources of the subset of the plurality of electronic resources;
determining that the request satisfies the one or more criteria;
selecting, via the load balancer, the one or more resources of the subset of the plurality of electronic resources to process the request based at least in part on the load balancing algorithm; and
transmitting information for the request to the one or more resources of the subset of the plurality of electronic resources.

8. The computer-implemented method of claim 7 , further comprising:
receiving a request from the customer to modify the set of account pools, the request specifying at least one task corresponding to at least one of adding a new account pool, deleting an existing account pool, modifying a type of user associated with the existing account pool, modifying a type of authentication to be used for the existing account pool, or modifying a type of resource access granted for the existing account pool.

9. The computer-implemented method of claim 7 , wherein the one or more criteria includes the request being associated with a user having been authenticated to the load balancer or having permission to access a resource type of the selected resource.

10. The computer-implemented method of claim 7 , further comprising:
authenticating the user before determining that the user is authorized, according to the respective policy, to obtain the access to the one or more resources.

11. The computer-implemented method of claim 7 , wherein the resources include at least one of data servers, application servers, data stores, or virtual machines.

12. The computer-implemented method of claim 7 , further comprising:
denying the request at the load balancer in response to determining that the request is not authorized to access the one or more resources.

13. The computer-implemented method of claim 7 , further comprising:
causing sensitive information for the user to be stored in a data store separate from the plurality of electronic resources and accessible by the load balancer, wherein a party gaining unauthorized access to a subset of the plurality of electronic resources is unable to access to the sensitive information.

14. The computer-implemented method of claim 7 , wherein the load balancer includes a memory coupled to a processor, the memory including instructions that upon execution cause the load balancer to perform a task for the request, the task being determined based at least in part upon the determined pool of accounts associated with the user, the task including at least one of session creation, user account creation, multi-factor authentication (MFA), password establishment and recovery, protection against denial of service (DoS) attacks, federation integration, mobile integration, sign-out across a resource cluster, single sign-in across applications, automatic bot mitigation, support for multiple sign-in technologies and password alternatives, business analytics, or advertising.

15. A system, comprising:
at least one processor; and
memory including instructions that, when executed by the at least one processor, cause the at least one processor to:
receive, via a load balancer of a multi-tenant computing resource environment, a request initiated by a user, the multi-tenant computing resource environment including a plurality of electronic resources, the load balancer distributing processing tasks over at least a subset of the plurality of electronic resources based at least in part on a load balancing algorithm;
determine an account pool associated with the user, the account pool being determined from a set of account pools established by at least one customer of the multi-tenant computing resource environment, each account of the set of account pools being associated with one or more users;
determine, via the load balancer, a policy specified for the account pool, the policy indicating one or more criteria for processing the request using one or more resources of the subset of the plurality of electronic resources;
cause, by the load balancer, the policy to be evaluated in order to determine that the request satisfies the one or more criteria;
select the one or more resources of the subset of the plurality of electronic resources to process the re

Assignees

• Amazon Tech Inc

Inventors

• Roth Gregory Branchek
• Nguyen Quynh Khac

Classifications

• G06F21/45 Primary

  Structures or tools for the administration of authentication · CPC title

• H04L67/1002

  Electricity · mapped topic

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/205 Primary

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04L67/1001

  for accessing one among a plurality of replicated servers · CPC title