Service Virtual Components With Scoped Credentials for Secure Resource Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional network-based computing environments face performance and operational issues due to the separate management of multiple service virtual computing components, leading to increased resource consumption and error rates, as each component manages its own set of resources and access credentials, which can compromise the entire application or computing environment if compromised.

Innovation Solution

Implementing service virtual computing components that provide multiple computing services and use differently-scoped access credentials, managed by a supervisor process and credential vending service to optimize resource usage and limit security risks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If separate service virtual computing components are used for each computing service, then service independence and security isolation are improved, but resource consumption and device complexity increase

Engineering Contradiction:

Improvesecurity isolationVSAvoiddevice complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the credential management system into distinct components: service virtual computing components (SVCCs) that provide computing services, a credential vending service that issues credentials, and a supervisor process that coordinates operations. Each SVCC receives narrowly-scoped credentials limited to specific resources, achieving security isolation without requiring full independence for each service component.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The credential vending service acts as an intermediary between the supervisor process and external computing resources. It issues credentials to SVCCs on behalf of the supervisor, enabling centralized credential management while maintaining security boundaries. This intermediary approach reduces the complexity of direct credential management by each individual service component.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If each service virtual computing component manages its own resources and credentials, then service autonomy is improved, but resource consumption increases

Engineering Contradiction:

Improveservice autonomyVSAvoidresource consumption

Core Design Contradiction:

Ease of operationVSUse of energy by moving object

Solution Approach 1:

The supervisor process serves multiple functions: it coordinates SVCC operations, manages credential distribution through the credential vending service, and monitors overall system state. This multi-functional approach consolidates management responsibilities, reducing redundant resource consumption while maintaining service autonomy through the coordinated architecture.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

Each service virtual computing component operates with self-service capabilities within its credential scope, independently accessing authorized resources without requiring manual intervention. The credential vending service automatically issues credentials based on supervisor requests, enabling automated resource management that reduces overhead while preserving service independence.

Inventive Principle:

Principle #25Self-service

3Ease of operation

If broadly-scoped access credentials are used for computing services, then ease of access to resources is improved, but security risk increases

Engineering Contradiction:

Improveease of accessVSAvoidsecurity risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent implements local quality by providing each service virtual computing component with credentials that have narrowly-scoped permissions specific to its functional requirements. Instead of using broad credentials for all services, each SVCC receives credentials tailored to its specific resource access needs, maintaining ease of access to authorized resources while minimizing security risk through limited credential scope.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The credential scope is segmented and distributed to different service virtual computing components based on their specific needs. The credential vending service issues distinct credentials to each SVCC, ensuring that no single component possesses broad access to all resources. This segmentation of credential permissions enables easy access to required resources while containing security risks to specific service boundaries.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12476978B2Management of computing services for applications composed of service virtual computing components

Publication Date: 2025.11.18 AMAZON TECH INC

AI summary

Systems and methods are provided for managing computing services for an application comprising a plurality of virtual computing components executing on one or more host computing devices, wherein a service virtual computing component is to perform application functionality, and wherein a system computing component is to perform system functionality including management of the application virtual computing component; determining the service virtual computing component is to execute using a first access credential to provide a first computing service to the application virtual computing component, and the service virtual computing component is to execute using a second access credential to provide a second computing service to the system computing component, wherein the first access credential is assigned a different set of computing resource access permissions than the second access credential.