Amazon Technologies, Inc.

Malcolm Russell Ah Kun

Deepak Suryanarayanan

Eugene Michael Farrell

David Everard Brown

Nathan Bartholomew Thomas

Colin Harrison Brace

Ajit Nagendra Padukone

Prasanna Subash

Gaurang Pankaj Mehta

Shon Kiran Shah

Vivek Lakshmanan

Chirag Pravin Pandya

Sameer Palande

Krithi Rai

Guruprakash Bangalore Rao

Anshuk Chakraborty

Gopala Krishna Ambareesh

Zhenghong Sun

Varun Verma

Erik Jonathon Tellvik

Osman Surkatty

Salman Aftab Paracha

Divij Vaidya

Jeffery David Wells

Nakul Namdeo Dhande

Hakimuddin Hanif

Brian Scott Waters

Supreeth Koushik Sheshadri

Harshit Kumar Tiwari

Lihao Wang

Anand Krishnamoorthy

Venkatesh Velaga

Himesh Pandya

Alexey A Nikitin

Chao Li

James Henry Baker, Iii

David Everhard Brown

Stephen William Luszcz

Ankur Goyal

Erik Jonathan Telvik

Uday Bheema

A computer server controls access to a hosted service using digital certificates that are requested from each client attempting to access the service. When a particular client accesses the hosted service, the host service requests a digital certificate from the particular client and issues a challenge message. The particular client signs the challenge message and provides a client digital certificate to the hosted service. The hosted service confirms that the signature on the challenge message matches the client digital certificate, and that the client digital certificate is signed by a trusted entity. Trusted entities are defined by an administrator by uploading, to the hosted service, one or more trusted digital certificates associated with a trusted entities. Using the trusted digital certificates, the hosted service confirms that the digital certificate provided by the particular client is signed by at least one of the trusted entities.

Certificate-based service authorization

Virtual workspaces can be provided using a shared resource environment. A workspace accessed under a customer account can perform an upgrade or downgrade of the operating system by building a new workspace instance instead of modifying an existing workspace instance. A workspace bundle can be obtained that includes a machine image for the target operating system, as well as configuration information and information for default applications installed for the workspace. A new workspace instance can be created using the workspace bundle and user-specific configuration information. A workspace agent can perform a simplified install of the applications using information from the prior workspace. One or more new data volumes can be created using a snapshot from the prior workspace. Once configured, the new workspace instance can be made available to the user. The process can be repeated using the prior workspace bundle if an operating system downgrade is requested.

Operating system management for virtual workspaces

Virtual workspaces can be provided using shared resources and network-attached storage. A workspace client can access a virtual workspace created under a customer account. For specific types of data, such as pixel data used to render the display component of the workspace on the workspace client, the data can be prevented from being transmitted over a public network. Private security gateway interfaces can be created in the customer environment that can be attached to respective security gateways in the workspace environment. Routing rules are configured such that pixel data for a workspace is only transmitted to the workspace client through a security gateway and over a secure connection to the corresponding private gateway interface in the customer environment, which can direct the pixel data to the workspace client.

Secure data flow for virtual workspaces

Systems and methods are presented for enabling a user to provide rules for the placement of computing resources at a data center for an entity that employs or is associated with the user. The data center can use the placement rules to select a data center computer system to host computing resources for a user. The rules can be used to establish diversity in computing resource placement at the data center thereby reducing the number of users who lose access to computing resources when a specific data center computer suffers a failure. Further, the placement rules can be used to facilitate configuration of the computer resources for the user based, for example, on the user's employment responsibilities.

Automated desktop placement

Virtual workspaces can be provided using shared resources and network-attached storage. A workspace accessed under a customer account has a unique key generated using a combination of a customer master key and an encryption context. The encryption context is specific to the workspace, such as may include a hash of specific values for the workspace. When a new instance is generated, a first data volume is generated using a machine image and data snapshot encrypted under a current encryption key. The snapshot is copied to a new snapshot, and a new encryption key obtained that is based on the customer master key and the current encryption context. The snapshot is used to create a new data volume encrypted under the new encryption key. The new volume is attached to the workspace instance such that data transmitted between the workspace and the new volume is encrypted under the volume-specific encryption key.

Data encryption for virtual workspaces

Systems and methods are presented for accessing an application available from a data center of a program execution service. The metadata associated with a user computing device may be used to determine whether the user computing device is authorized to access the application through a virtual desktop instance. At least a portion of the application may be executed by the virtual desktop instance and provided to the user. Applications may be purchased, licensed, or rented by a user.

Application marketplace for virtual desktops

Systems and methods are presented for automatically selecting a data center that can communicate with a user computing system over a connection that provides reduced or minimal latency. In some cases, the system can select the data center based on the calculation of one or more latency factors that correlate, at least in part, to the latency of a communication channel between the data center and the user computing system. Further, the selected data center may be identified from a set of data centers that include one or more computing resources the user has identified as desiring to access.

Automated data center selection

A computing system that provides virtual computing services may generate and manage remote computing sessions between client computing devices and virtual desktop instances hosted on the service provider's network. Each virtual desktop instance may include a network interface for communication between the virtual desktop instance and client computing devices, and a second interface that connects the virtual desktop instance to entities on other networks (e.g., Internet destinations, or shared resources on an internal network). An administrative component or client application may detect a condition indicating that the second interface should be disconnected or its operation modified in order to prevent or curtail malicious use of the virtual desktop instance, such as inactivity, server type activity or other suspicious activity, suspension or closing of a remote computing session, or a timeout condition, or may proactively disconnect the interface or modify its operation based on observed or expected usage patterns.

Securing workspaces in a cloud computing environment

A virtual computing environment service may receive a request from a customer to provision a virtual computing environment and join the virtual computing environment to a managed directory. The virtual computing environment service may provision the virtual computing environment and uses a set of administrator credentials from the customer and a set of credentials corresponding to the environment to access the managed directory and request joining of the environment to the managed directory. In response, the managed directory may create a computer account corresponding to the environment and which enables the environment to be used to access the managed directory. The virtual computing environment service may then enable the customer to specify one or more users that may utilize the virtual computing environment to access the managed directory.

Domain join and managed directory support for virtual computing environments

Growing community of inventors

Bellevue, WA, United States of America

Malcolm Russell Ah Kun