Attribute based authorization

A service provider may provide a plurality of companion instances associated with a mobile device in order to facilitate operation of the mobile device. The companion instances and the mobile device may be configured to execute various components of one or more application. Furthermore, an identity firewall may be provided to authorize and route network traffic to the plurality of companion instances based at least in part one or more attributes of the network traffic.

BACKGROUND

The use of network computing and storage has proliferated in recent years. The resources for network computing and storage are often provided by computing resource providers who leverage large-scale networks of computers, servers and storage drives to enable clients, including content providers, online merchants and the like, to host and execute a variety of applications and web services. Content providers and online merchants, who traditionally used on-site servers and storage equipment to host their websites and store and stream content to their customers, often forego on-site hosting and storage and turn to using the resources of the computing resource providers. The usage of network computing allows content providers and online merchants, among others, to efficiently and adaptively satisfy their computing needs, whereby the computing and storage resources used by the content providers and online merchants are added or removed from a large pool provided by a computing resource provider as needed and depending on their needs. Additionally, mobile devices are quickly outgrowing other form factors and the development of mobile applications is growing and becoming more ambitious.

DETAILED DESCRIPTION

Techniques described and suggested herein relate to enhancements for mobile devices and applications executed by mobile devices. A mobile device may be associated with a virtual machine instance referred to herein as a companion instance. The companion instance may be used to consolidate traffic emanating from the associated mobile device and received by the associated mobile device. For example, the companion instance may receive notifications on behalf of the mobile device and push the notifications to the mobile device when able to do so. Additionally, the mobile device may be associated with a container instance. For example, a computing resource service provider may create clusters of software container instances for running software containers for customers (e.g., supporting customers' mobile devices) of a computing resource service provider. The software containers may execute various tasks on behalf of customers' mobile devices. The software container instances may be virtual machine instances configured to support containerization, and the software containers may be registered or deregistered from the cluster as needed to fit the needs of the customer's mobile devices.

Furthermore, at least some of the operations performed by the companion instance or container instances may include dynamically determining authorization and authentication for resources associated with the customer and/or the customer's mobile device based at least in part on one or more attributes of a received request or requestor associated with the received request. The customer's mobile device may also be associated with a set of companion instances where each companion instance of the set of companion instances or subset of companion instances of the set of companion instances may represent a persona or identity of the customer. For example, a request for business information may be directed to the virtual machine associated with the customer's business persona. In another example, the personas may be associated with different types of data, such as a persona for the customer's music and another persona for the customer's photos.

The computing resource service provider may associate an identity firewall with the customer and/or the customer's mobile device. The identity firewall, described in greater detail below, may be configured to determine authorization, authentication, and routing as well as perform other operations on behalf of the customer. For example, the identity firewall may be configured to automatically publish and subscribe to various information streams on behalf of the customer. If a particular customer is capturing images of a marathon using the particular customer's mobile device or other device associated with the identify firewall, the identity firewall may be configured to publish the photo to other customers at the marathon, for example, based on Global Positioning System (GPS) coordinates of the other customers' mobile devices. The identity firewall may provide customers with a single location to define policies for all of the customers' data and/or resources. For example, the customer may provide the identity firewall with a policy and/or rule governing access to the customer's photo. The policy may indicate attributes of a request required to access particular data objects. For example, the customer may limit access to photos taken at the customer's work place to other employees that work at the same workplace.

FIG. 1illustrates an example environment100where an identity firewall110may dynamically determine authorization and authentication for resources associated with the customer and/or the customer's mobile device108based at least in part on one or more attributes120of received requests118. Additionally, identity firewall110may route request118and other network traffic to various personas102. The requests118and network traffic may be routed based at least in part on the one or more attributes or based at least in part on performance and/or load characteristics of the various personas102. For example, a particular persona may be configured to process requests for the set of coworkers of a particular customer, the identity firewall110may determine a particular request is associated a coworker of the particular customer and direct the request to the particular persona associated with coworkers. In another example, the identity firewall110may be configured to balance requests between the personas102such that no one persona becomes overloaded. The identity firewall110may also direct request118based at least in part on a region or geographic location of the request.

The identity firewall110may be a hardware, software, or combination thereof configured to perform the authorization, authentication, and routing operations described in the present disclosure. For example, the identity firewall110may be a virtual machine instance or container instance, as described in greater detail below, configured to execute software on behalf of the customer and/or customer's mobile device. The executed software may implement an attribute based policy set configured control access to customer data and customer resources maintained by a computing resource service provider. In various embodiments, the identity firewall110is configured as a request interface, and the request interface receives request118and determines an appropriate persona102to direct the request to. For example, the identity firewall may receive a request for a video associated with the customer and may direct the request to the persona associated with the customer's videos.

The personas102may be virtual computer system instances and/or container instance supported by computing resources of the computing resource service provider. The personas102may be implemented as companion instance instances described in greater detail below in connection withFIG. 6, may be implemented as container instances described in greater detail below in connection withFIG. 7, or combination of companion instances instance and container instances. The personas102may include or have access to various other computing resources. For example, the personas102may have attached logical volumes configured to store data on behalf of the customer. In another example, the personas102may execute various application, such as a database application, on behalf of the customer.

The mobile devices108may be any suitable computer system, mobile phone, smartphone, tablet, portable computer or combination thereof capable of communicating with the identity firewall110. The mobile devices108may include the customer's mobile device. The request118, transmitted by the mobile devices108, may include various attributes of the request, the mobile device108, or requestor associated with the mobile device, or other attribute suitable for authorization, authentication, and routing of the requests118. For example, the attributes may include interaction with the mobile devices108, such as what applications were executed today by the mobile devices108, when was the last time the mobile devices108were used to message a particular customer, GPS coordinates and other data collected by the mobile devices108, a signature generated by the mobile devices108, and other information obtainable by the mobile devices108. Additionally, the attributes may include information provided by a third party or other device. For example, a base station communicating the request118on behalf of the mobile device may inject a signed certificate indicating that a particular request was transmitted by the mobile device. In another example, an authorization server computer system operated by a service provider may provide an OAuth access token to be included in the requests118.

FIG. 2illustrates an example environment200where one or more mobile devices208, as well as the associated code running thereon, may be associated with a persona220. An identity firewall210may be configured to control incoming and outgoing traffic associated with the persona220. The persona220may execute applications and perform various operations on behalf of the mobile devices208. The persona may be any computer system or virtual computer system configured to execute at least a portion of an application corresponding to an application executed by the mobile device208. The mobile device208may be any suitable computer system, mobile phone, smartphone, tablet, portable computer or combination thereof capable of communicating with a persona220through the identity firewall210implemented by a service provider204.

The mobile device208may contain multiple applications in memory on the mobile device208. In some embodiments, a single persona220may be instantiated per mobile device208. Alternatively, the service provider204may provide a fleet of personas220, including multiple Internet Protocol (IP) addresses, and the identity firewall210may include a Network Address Translation (NAT) gateway configured to route traffic to the IP addresses. In this scenario, each mobile device208may be assigned a particular IP address and traffic or the particular mobile device208may be directed to the corresponding persona120based at least in part on information obtained by the identity firewall210and information provided by the NAT gateway. For example, the identity firewall210may obtain information from the network traffic, such as destination IP address and port number, and determine based at least in part on the obtained information and a policy whether the network traffic authorized. The identity firewall210may determine various attributes of the network traffic and network devices associated with the network traffic and determine authorization and/or routing information based at least in part on the determined attributes and the policy. The policy may be provided by the customer or the service provider204and may define access rights to resources maintained by the personas220, as illustrated inFIG. 2.

The service provider204may operate system hardware, described in greater detail below, used to execute the personas220and enable communication between the mobile device208and the persona220. The persona220may execute one or more applications on behalf of the mobile device208including computing resources, such as data objects, storage device, or other computing resources hosted by the system hardware. Furthermore, the persona220may have a persistent power supply due to the system hardware that is executing the persona220being connected to the power grid. In some embodiments, the mobile device208and the persona220may each execute a copy of the applications and the applications may transmit data used during execution of the application between the mobile device208and the persona220through the identity firewall210. Additionally, separate applications may communicate between each other while being executed by the personas220. For example, a messaging application executed by the persona220may communicate with a photo gallery application executed by the persona220or another persona distinct from the persona220.

Application executed by the persona220may also transmit data to one or more other personas220. For example, the messaging application discussed above may transmit a message directly to one or more other personas220associated with a mobile device208through the identity firewall210. The identity firewall210may determine attributes of the message and authorize and route the message to the appropriate persona220based at least in part on the determined attributes. For example, the identity firewall210may determine a location of the mobile device208and allow the message to be transmitted to the one or more other personas220if the mobile device208is in the same location as the mobile devices associated with the one or more other personas210.

The persona220may enable the recipient mobile device208to receive the message without requiring the recipient mobile device208to be connected to a network. In some embodiments, an agent application, described in greater detail below, may be used to facilitate the transmission and reception of notifications between the mobile device208and the persona220. For example, the persona220may receive a message on behalf of the mobile device208and transmit a notification of the received message to the mobile device208. At some point in time later, the mobile device208may obtain the message from the persona220. In some embodiments, the agent application may provide data corresponding to the state of the mobile device208and/or information collected by one or more sensors of the mobile device208. For example, the agent may transmit GPS coordinates and accelerometer data to the persona220. Additionally, the agent application or other component of the mobile device208may include the information in network traffic transmitted by the mobile device208in order to enable the identity firewall210to obtain information suitable for determining authorization, authentication, and routing information as described above. The persona220may perform a variety of operations based at least in part on the received information. For example, the persona220may notify another persona or other service provider that the mobile device is in a particular location.

FIG. 3illustrates an example environment300where one or more mobile devices308owned and/or associated with a single customer, as well as the associated code running thereon, may be associated with a persona320. The persona320may be implemented as a virtual machine instance as illustrated inFIG. 3. A service provider304may provide a variety of services to the customer and the customer may communicate with the service provider304via an interface executed by the system hardware340, which may be a web services interface or any other type of customer interface. For example, the system hardware340may include a routing fleet configured to receive network traffic, such as requests, associated with the mobile device308and direct the network traffic to the appropriate persona320. The customer may be an organization that may utilize one or more of the services provided by the service provider304to maintain and deliver information to its employees, which may be located in various geographical locations. For example, the organization may provide employee with a mobile device to enable communication between the various geographic locations the organization operates.

Additionally, the customer may be an individual that utilizes the services of the computing resource service provider. The customer may communicate with the service provider304, using the mobile device308, through a network, whereby the network may be a communication network, such as the Internet, an intranet or an Internet service provider (ISP) network. Some communications from the customer to the service provider304may cause the service provider304to operate in accordance with one or more embodiments described herein or a variation thereof.

For example, the customer may, using the customer's mobile device308, execute an application which may cause the service provider304to instantiate a persona302on behalf of the customer. As illustrated inFIG. 3, the customer may be given a single persona associated with one or more of the customer's mobile devices308. For example, the customer may register one or more mobile devices with the service provider308, and the registration process may associate the persona320with the registered mobile devices308. The persona320may provide synchronization between the one or more mobile devices308owned by the customer. For example, the customer may modify the parental control settings for a particular application using a first mobile device308. The persona320may then cause the modification of the parental control settings to be applied to one or more other mobile devices308registered with the customer's account. Additionally, the customer may access one or more of the customer's mobile devices308from another device. For example, the customer's smartphone may not have enough battery power or otherwise may have been rendered inoperable, and the customer may access the applications and other data contained on the smartphone by using another computer system connected to the persona320.

In some embodiments, the persona320may execute software and other applications on behalf of the mobile device308and the mobile device308may execute a receiver application configured to connect to the persona320and render the state of the persona320on a display device connected to the mobile device308. The persona320may enable communication between one or more applications executed by the persona320or one or more other personas as described above in connection withFIG. 1. In some embodiments, the persona320may be configured to alert an operator of a first mobile device of an activity of a second mobile device308. For example, the customer may access a video streaming application on the customer's tablet and may receive a notification on the tablet from the persona320that the customer's smartphone is attempting to access the same or a different application. The persona320may enable the customer to receive notifications corresponding to the activity of the customer's mobile devices308and enable the customer to determine access policies of the customer's mobile devices308. For example, the customer may allow the customer's smartphone to access all of the application executed by the persona320but may restrict certain application form executing on customer's tablet, which may be frequently utilized by children.

FIG. 4shows an illustrative example of the process400which may be used to enable communication between a mobile device and a persona based at least in part on one or more attributes using an identity firewall. The process400may be performed by any suitable system such as the identity firewall described above in connection withFIGS. 1 and 2. Returning toFIG. 4, in an embodiment, the process400includes receiving a request402. The request may include any network traffic as described above in connection withFIG. 2. For example, the request may include a request to access resources of the persona. In another example, the request may include a message directed to a mobile device associated with the persona. The request may be received at the identity firewall or at another network device and directed to the identity firewall. In various embodiments, the identity firewall may be integrated with the persona. For example, the identity firewall may be an application executed by the persona.

The identity firewall may then determine one or more attributes of the received request404. For example, the request may include an OAuth token or electronic signature as described above. Furthermore, the electronic signature may attest to various attributes of the request. For example, the electronic signature may include a signed certificate from the mobile device or other device authenticating a particular attribute of the request or requestor, such as location of the mobile device or blood glucose level of the requestor. The identity firewall may also obtain the one or more attributes from sources other than the request. For example, the identity firewall may query a service of a computing resource service provider for information about a particular persona associated with the request, such as whether the persona is included in a friends list or other data structure authorizing the requestor to transmit requests to a particular recipient.

The identity firewall may then determine the request is authorized based at least in part on the one or more attributes and a rule set and/or policy for processing request406. For example, the customer may define a set of policies for personas associated with the customer mobile device. The policies may indicate whether requests are to be authorized based on various attributes. For example, the customer may indicate in the policy that a requestor may obtain access to various persona resources if the requestor is a member of the same organization as the customer. In another example, the policies may indicate that a requestor may obtain images captured by the customer if the requestor is in the same location the images were captured and within a certain time period from when the images were captured.

If the identity firewall determines that the request is not authorized based at least in part on the rule set, the identity firewall may block the request and/or transmit notification to the customer or requestor that the request has been blocked. Alternatively, once the identity firewall has authorized the request, the identity firewall may determine routing information for the request406. The identity firewall may determine routing information based at least in part on the determined one or more attributes408. For example, if the one or more attributes indicate that the request is associated with the customer business, the request may be routed to the customer business persona. The request may then be routed to the appropriate persona based at least in part on the determined routing information410. For example, the request may be for a particular computing resource maintained by a particular persona associated with the customer's mobile device and the request may be directed to the particular persona. The request may then be fulfilled412by the recipient of the request. As illustrated inFIG. 2, a request may be transmitted to a particular persona and the computing resources of the persona may be used to fulfill the request.

FIG. 5shows a webpage500, which may be displayed by an application executed by a mobile device enabling a customer to purchase or otherwise obtain one or more applications supported by a persona which may be implemented by a companion container instance and/or virtual machine instance. As illustrated inFIG. 5, the webpage500includes various graphical user interface elements that enable navigation throughout a mobile application store of which the webpage500is a part. In various embodiments, the webpage500is implemented by a service provider and the service provider is responsible for receiving customer input into the webpage500and transmitting the received input to various other services of the service provider configured to instantiate a companion container instance or companion instance associated with the application or otherwise possess the customer's input. For example, as described in greater detail below, the customer's input may cause the service provider to enable the customer's mobile device and an associated companion container instance to access an application in order to install the application on the mobile device and the companion container instance. Additionally, the customer input may include policy definitions or other information suitable for use in managing network traffic by the identity firewall as described above.

The webpage500may be displayed by various applications, such as a mobile application or web browser. In this example, the webpage500includes various navigational features. For instance, on the left-hand side of the webpage500, various links510may link to one or more other webpages that contain additional content corresponding to the application store. In this example, the links appear as textual words, which enable the links to be selected using an appropriate input device such as a keyboard, mouse, touchscreen or other input device. Selection of one of the links510may cause an application displaying the webpage500to submit, pursuant to a uniform resource locator (URL) associated with the selected link by the programming of the webpage500, an HTTP request for the content associated with the link to a server that provided the webpage500or another server. In this example, the webpage500also includes a graphical user element configured as a “buy” button. The buy button may be a graphical user interface element of the webpage500where the underlying code of the webpage500is configured such that selection by an input device of the buy button causes information corresponding to the selection to be transmitted to one or more servers of the service provider.

The webpage500may also include a description of the applications and/or other information associated with the applications displayed in webpage500. The description may provide information to the customer including whether the application is associated with a companion container instance or companion instance. In some embodiments, the mobile device may be provided with a persona when an application or particular application is consumed from the application store. For example, a persona may be instantiated and associated with the customer mobile device once the customer has downloaded and/or installed an application of the customer's mobile device that is supported by a persona. In this example, the webpage500contains six applications that the customer may download and/or provide to the customer's mobile device. The applications may be provided by a developer, by the service provider, or any other party capable of posting an application to the webpage500. The executable code of the application may indicate whether the application utilizes a persona.

Furthermore, the applications displayed in the webpage500may correspond to services offered by the service provider or one or more other organizations. For example, the services may include a messaging, delivery service, or other service. The applications displayed on the webpage500may contain a presentation of the application such as a graphical representation of the service or operation associated with the application, which could be text and/or a drawing, photograph, description, identification number, trademark, video clip, audio clip, or any other representation capable of representing the items. Other variations of the user interface displayed inFIG. 5may be used in accordance with the present disclosure. For example, drop-down menus may be included in the user interface to enable the user to select a particular user account or information associated with a customer account to include when provisioning new mobile devices.

FIG. 6illustrates an environment600in which a virtual computer system service providing personas for mobile devices in accordance with at least one embodiment. The virtual computer system service, which may be system hardware640, is used by a service provider604to provide computational and other resources for mobile devices. The system hardware640may include physical hosts642. The physical hosts642may be any device or equipment configured to execute instructions for performing data computation, manipulation or storage tasks, such as a computer or a server. A physical host642may be equipped with any needed processing capability including one or more processors, such as a central processing unit (CPU), a graphics processing unit (GPU) or a digital signal processor (DSP), memory, including static and dynamic memory, buses and input and output ports that are compliant with any handshaking, communications or data transfer protocol. The system hardware640may also include storage devices, such as storage disks and tapes, networking equipment and the like.

A virtualization layer644executing on the physical host642enables the system hardware640to be used to provide computational resources upon which one or more personas620may operate. For example, the virtualization layer644may enable a persona620to access system hardware640on the physical host642through virtual device drivers on the virtual machine620. Furthermore, physical host642may host multiple personas620of the same or different types on the same system hardware640. The personas620may be any device, software or firmware used for providing a computing platform for the mobile device608. For example, the persona may, in some embodiments, be implemented as a physical computer system configured to perform operations on behalf of the mobile device608. Furthermore, the persona620may be generated and/or instantiated as a result of the mobile device608completing a boot operation.

The virtual computing platform may include various virtual computer components, such as one or more virtual CPUs, virtual memory and the like. The personas620may be provided to the customers of the service provider604and the customers may run an operating system or an application on the virtual machines620in support of the mobile device608. Further, the service provider604may use one or more of its own virtual machines620for executing its applications, such as the application management service described above.

In some embodiments, the mobile device608may communicate with the corresponding persona through the virtual machine management service602. For example, the mobile device may transmit commands and other information to the virtual machine management service and the commands may indicate operations to be performed by the persona. The commands and other information may be included in an API call from the virtual machine management service602to the persona620. The virtual machine management service602may enable the mobile device608to manage and operate the personas620.

For example, the mobile device608may transmit a request to the virtual machine management service602to have the persona620process an image. The request may be an API call including information corresponding to the image and the personas620. The virtual machine management service602may determine the corresponding physical host642for the personas620included in the request and transmit the image and/or request to the persona. The virtual machine management service602may maintain a database610with one or more records containing information corresponding to the personas620. For example, the database610may contain a Domain Name System (DNS) entry indicating an IP address useable for communicating with a particular persona. Returning to the example above, the virtual machine management service602may receive a request, from the mobile device, to interact with the corresponding persona620. The virtual machine management service602may locate the persona620in the database610and transmit the request to the persona620.

In another example, the request from the mobile device may include a request to instantiate a persona620. The virtual machine management service602may then determine a physical host642capable of executing the persona620on system hardware640. The virtual machine management service602may then send the command to instantiate the persona620to virtualization layer644on the determined physical host642. The virtualization layer644may then instantiate the persona620. The virtualization layer644may then return information corresponding to the persona620to the virtual machine management service602and the virtual machine management service602may record at least a portion of the information in the database610. For example, the virtualization layer644may return location information corresponding to the persona620which may then be stored in a record in the database associated with the mobile device608.

FIG. 7illustrates an aspect of an environment700in which an embodiment may be practiced. As illustrated inFIG. 7, the environment700may include a customer's mobile device708that sends a task definition file704for software containers718along with a request to launch tasks through a network706to a container service712of a computing resource service provider710. A scheduler, such as the scheduler described in greater detail below in connection withFIG. 7, may determine into which container instance714of a cluster716of container instances that the software containers718specified in the task definition file704should be launched. In some embodiments, the software containers may be configured to share resources720provided by other services722of the computing resource service provider710, such as a storage volume provided by a block-level data storage service of the computing resource service provider710.

The mobile device708may be any suitable computer system, mobile phone, smartphone, tablet, portable computer or combination thereof capable of communicating with the container service712through a service provider710The mobile device708may contain multiple applications, task704, and software containers in memory. In some embodiments, a single companion container instance714may be instantiated per mobile device708. Alternatively, the service provider710may provide a fleet or cluster of companion container instances716including multiple Internet Protocol (IP) addresses and a Network address translation (NAT) gateway configured to route traffic to the IP addresses. In this scenario, each mobile device708may be assigned a particular IP address and traffic for the particular mobile device708or may be directed to the corresponding companion container instance714of the cluster716, based at least in part on information provided by the NAT gateway. In various embodiments, the container service712or other service720may contain the task and/or software container to be executed by the container instance714on behalf of the mobile device708. In such embodiments, the mobile device708may transmit a request to the computing resource service provider to execute one or more tasks and/or software containers indicated in the request.

Furthermore, the resources of the mobile device708may be made available to other users and/or devices. For example, the mobile device708may utilize the container instance714to provide a virtual presence for other users, and these other users may then interact with the mobile device708through the virtual presence provided by the container service712. The mobile device708may communicate with the container service712of the computing resource service provider710through the network706, which may be a communication network, such as the Internet, an intranet, an internet service provider (ISP) network and/or some other such network as described below.

In some examples, a “task definition” or “task definition file” may refer to a file specifying a set of linked containers (i.e., a set of containers that, when running on a host computing system, are associated with each other) that are assigned to start as a group. The task definition file704may further specify disk and network locations that the software containers718are able to share on a single physical machine. The task definition file704may then be utilized for launching the set of containers718. In some implementations, the task definition file704may define and linked software containers718spread across multiple physical machines. One task definition file704may contain and schedule many tasks. In some examples, a “task” may refer to an instantiation of a task definition file704, and may consist of one or more software containers718. Tasks may be modified by applying a new task definition to the task.

The task definition file704may contain all the information needed to place software containers718in containers714of a cluster716, and the cluster716may be managed through application programming interface calls.

The example task definition specifies that a first task, entitled “db,” has a software image located at the path “forest/postgresql.” The first task is allocated processing capacity of 1,000 and 1 gigabyte of memory, and the first task uses port 5432. Similarly, the task definition also specifies that a second task, entitled “web,” has a software image located at the path “hub.web.com/rails:latest.” The second task is allocated processing capacity of 1,000 and 1 gigabyte of memory, and the second task uses ports 8000:8000. The task definition notes that the second task (“web”) is allowed to link to the first task (“db”).

The container service712, described in greater detail below in connection withFIG. 2, may be a service provided by the computing resource service provider710to allow the mobile device708to execute the containers718within the cluster716. The computing resource service provider710, described in greater detail below, may provide one or more computing resource services to its customers individually or as a combination of services of a distributed computer system. The one or more computing resource services of the computing resource service provider710may be accessible over the network706and may include services such as virtual computer system services, block-level data storage services, cryptography services, on-demand data storage services, notification services, authentication services, policy management services, task services and/or other such services. Not all embodiments described include all of the services described and additional services may be provided in addition to, or as an alternative to, services explicitly described.

The mobile devices708supported by the container service712of the computing resource service provider710may communicate with one or more of the services, including the container service, via an interface, which may be a web services interface or any other type of customer interface. Each service provided by a computing resource service provider may have its own interface and subsets of the services may have corresponding individual interfaces in addition to, or as an alternative to, a common interface.

In some examples, a “container instance” may refer to a computer system instance (virtual or non-virtual, such as a physical computer system running an operating system) that is configured to launch and run software containers718. Thus, the container instance714may be configured to run the software containers718within the container instance714in accordance with the task definition file704provided by the mobile device708or other entity, such as a software developer, described above. One or more container instances714may comprise a cluster716. In some examples, “cluster” may refer to a set of one or more container instances714that have been registered with the cluster, described in greater detail below in connection withFIG. 2. Thus, the container instance714may be one of many different container instances714registered with the cluster716, and the other container instances of the cluster716may be configured to run the same or different types of software containers718as the container instance714. The container instances714within the cluster716may be of different instance types or of the same instance type, and the mobile device708may have access to or interact with more than one cluster716. Thus, the mobile device708may launch one or more clusters716and then manage user and application isolation of the software containers718within each cluster716through application programming interface calls.

A software container718may be a lightweight virtualization instance running under a computer system instance that allows processes and data used by the processes within the software container718to be isolated from other processes running in the same computer system instance or container instance714. Thus, the software containers718may each be virtualization instances running under an operating system of the container instance714and executing in isolation from each other. Each of the software containers718may have their own namespace, and applications running within the software containers718are isolated by only having access to resources available within the container namespace. Thus, software containers718may be an effective way to run one or more single applications within their own namespace. A container encapsulation system allows one or more software containers718to run within a single operating instance without overhead associated with starting and maintaining virtual machines for running separate user space instances. An example container encapsulation system is the Docker container engine.

The software containers718may be launched to have only specified resources from resources allocated to the container instance714; that is, a software container718may be launched to have a certain amount of memory and to not utilize more than a specified amount of processing power. The resource allocation for the software containers718may be specified in the task definition file704. Multiple software containers718may be running simultaneously on a single host computer or host container instance, and the resources of the host can be allocated efficiently between the software containers718, container instances714, and/or clusters716of container instances714. In some embodiments, a host may support running software containers718in container instances714from only one mobile device708. In other embodiments, a single host may allow multiple mobile devices708to have container instances714running on the host. In the latter case, the container service710may provide security to ensure that the mobile devices708are unable to access containers, clusters, or container instances of the others.

Different types of tasks may have different resource requirements and may have different lifespans. Thus, the software containers718may be dynamically scheduled to run by a scheduler service in the container service710independent of an underlying operating system of the container instance714, and as such, the underlying operating system of the container instance714may be very basic. Alternatively, the containers718may be scheduled to run by a scheduler installed within the container instance714of the cluster716.

The other services722may be services such as services described above of the computing resource service provider described in greater detail below. Likewise, the other resources720may include resources that can be shared between virtualized instances, such as a storage volume of a block-level data storage service.

FIG. 8is an illustrative, simplified block diagram of an example mobile device800that may be used to practice at least one embodiment of the present disclosure. In various embodiments, the device system800may be used to implement any of the systems illustrated herein and described above. For example, the device system800may be used to implement a mobile device and other applications, such as a browser application, in accordance with various embodiments. As shown inFIG. 8, the device800may include one or more processors802that may be configured to communicate with and are operatively coupled to a number of peripheral subsystems via a bus subsystem804. These peripheral subsystems may include a storage subsystem806, comprising a memory subsystem808and a file storage subsystem810, one or more user interface input devices812, one or more user interface output devices814, a network interface subsystem816, a cryptographic module824, comprising a memory subsystem830, and one or more cryptographic processors832. The peripheral subsystems may also include one or more sensors834in addition to sensors of input devices812. Such sensors may include, but are not limited to, GPS sensors, accelerometers, temperature sensors and others.

The bus subsystem804may provide a mechanism for enabling the various components and subsystems of device system800to communicate with each other as intended. Although the bus subsystem804is shown schematically as a single bus, alternative embodiments of the bus subsystem may utilize multiple busses.

The network interface subsystem816may provide an interface to other device systems and networks. The network interface subsystem816may serve as an interface for receiving data from and transmitting data to other systems from the device system800. For example, the network interface subsystem816may enable transmission of application data and other information, such as electronic requests to access a system (e.g., receive a webpage) and may enable receipt of responses to the requests, such as webpages or other information. The network interface subsystem816may also facilitate the receipt and/or transmission of data on other networks, such as an organization's intranet and/or other networks described below.

The user interface input devices812may include one or more buttons, a keyboard, keypad, pointing devices, such as an integrated mouse, touchpad, or graphics tablet, a scanner, a barcode scanner, a fingerprint scanner, a retinal scanner, a touchscreen incorporated into a display, audio input devices, such as voice recognition systems, microphones, fingerprint readers, retinal scanners and other types of input devices. Further, in some embodiments, input devices may include devices usable to obtain information from other devices, such as long-term or short-term credentials for use in consuming applications, as described above. Input devices may include, for instance, magnetic or other card readers, one or more USB interfaces, near field communications (NFC) devices/interfaces and other devices/interfaces usable to obtain data (e.g., long-term or short-term credentials) from other devices. In general, use of the term “input device” is intended to include all possible types of devices and mechanisms for inputting information to the device system800.

User interface output devices814, if any, may include a display subsystem, or non-visual displays, such as audio and/or tactile output devices, etc. Generally, the output devices814may invoke one or more of any of the five senses of a user. The display subsystem may be a flat-panel device, such as a liquid crystal display (LCD), light emitting diode (LED) display, or a projection or other display device. In general, use of the term “output device” is intended to include all possible types of devices and mechanisms for outputting information from the device system800. The output device(s)814may be used, for example, to present user interfaces to facilitate user interaction with applications performing processes described herein and variations therein, when such interaction may be appropriate. While a device800with user interface output devices is used for the purpose of illustration, it should be noted that the device800may operate without an output device, such as when the device800is operated in a server rack and, during typical operation, an output device is not needed.

The storage subsystem806may provide a computer-readable storage medium for storing the basic programming and data constructs that may provide the functionality of at least one embodiment of the present disclosure. The applications or components thereof (programs, code modules (i.e., programming modules), instructions) that, when executed by one or more processors, may provide the functionality of one or more embodiments of the present disclosure and may be stored in the storage subsystem806. These application modules or instructions may be executed by the one or more processors802. The storage subsystem806may additionally provide a repository for storing data used in accordance with the present disclosure. The storage subsystem806may comprise a memory subsystem808and a file/disk storage subsystem810.

The cryptographic module824, which may be a trusted platform module (TPM), includes a memory subsystem830, including a main random access memory (RAM)828for storage of instructions and data during program execution and a read only memory (ROM)826, in which fixed cryptographic information may be stored, such as a hardware secret stored securely within the device800so as to be non-exportable (i.e., inaccessible through any call to the cryptographic module824). The cryptographic module824, in some embodiments, operates wholly or partly in compliance with Trusted Computing Group's TPM Main Specification level 2, Version 1.2, Revision 116, TPM Main Specification level 2, Version 1.2, Revision 103 and/or ISO/IEC 11889, which are incorporated herein by reference. The device800may also store cryptographic keys in RAM828and/or processor registers for temporary cryptographic processing. The cryptographic information stored in memory may be used in combination with cryptographic information obtained via the network interface816and/or one or more of the user interface input devices812. The one or more cryptographic processors may be used to perform cryptographic operations in the device and may include a random number generator, SHA-2 or other hash generator and an encryption-decryption-signature engine.

The one or more cryptographic processors may also be configured to perform one or more encryption/decryption algorithms in accordance with one or more cryptographic algorithms, such as public key and/or private key cryptographic algorithms. For example, as discussed, numerous variations utilize symmetric and/or asymmetric cryptographic primitives. Symmetric key algorithms may include various schemes for performing cryptographic operations on data including block ciphers, stream ciphers and digital signature schemes. Example symmetric key algorithms include, but are not limited to, the advanced encryption standard (AES), the data encryption standard (DES), triple DES (3DES), Serpent, Twofish, blowfish, CASTS, RC4 and the international data encryption algorithm (IDEA). Symmetric key algorithms may also include those used to generate output of one-way functions and include, but are not limited to, algorithms that utilize hash-based message authentication codes (HMACs), message authentication codes (MACs) in general, PBKDF2 and Bcrypt. Asymmetric key algorithms may also include various schemes for performing cryptographic operations on data. Example algorithms include, but are not limited to, those that utilize the Diffie-Hellman key exchange protocol, the digital signature standard (DSS), the digital signature algorithm, the ElGamal algorithm, various elliptic curve algorithms, password-authenticated key agreement techniques, the pallier cryptosystem, the RSA encryption algorithm (PKCS #1), the Cramer-Shoup cryptosystem, the YAK authenticated key agreement protocol, the NTRUEncrypt cryptosystem, the McEliece cryptosystem, and others. Elliptic curve algorithms include the elliptic curve Diffie-Hellman (ECDH) key agreement scheme, the Elliptic Curve Integrated Encryption Scheme (ECIES), the Elliptic Curve Digital Signature Algorithm (ECDSA), the ECMQV key agreement scheme and the ECQV implicit certificate scheme. Other algorithms and combinations of algorithms are also considered as being within the scope of the present disclosure. Generally, one or more components of the cryptographic module824may be configured to collectively perform various operations used generating cryptographically verifiable information for authentication objects.

As noted above, in various embodiments of the present disclosure, hardware secrets are securely stored within the cryptographic module824. In some embodiments, the cryptographic module is implemented as or may contain a physically unclonable function (PUF), which is a function implemented in physical hardware to use one or more hardware secrets that are based at least in part on physical characteristics of the PUF. As a result, any attempt to obtain a hardware secret may require physical intrusion into the PUF, and physical intrusion may alter the physical characteristics of the PUF, thereby destroying the hardware secret. Example PUFs that may be used include PUFs using explicitly-introduced randomness, optical PUFs, coating PUFs, PUFs using intrinsic randomness, delay PUFs, static random access memory (SRAM) PUFs, butterfly PUFs, bistable ring PUFs, magnetic PUFs, metal resistance PUFs and/or other devices whose physical characteristics encode information usable as or for a hardware secret.