Abstract: A computer server controls access to a hosted service using digital certificates that are requested from each client attempting to access the service. When a particular client accesses the hosted service, the host service requests a digital certificate from the particular client and issues a challenge message. The particular client signs the challenge message and provides a client digital certificate to the hosted service. The hosted service confirms that the signature on the challenge message matches the client digital certificate, and that the client digital certificate is signed by a trusted entity. Trusted entities are defined by an administrator by uploading, to the hosted service, one or more trusted digital certificates associated with a trusted entities. Using the trusted digital certificates, the hosted service confirms that the digital certificate provided by the particular client is signed by at least one of the trusted entities.

Abstract: Virtual workspaces can be provided using a shared resource environment. A workspace accessed under a customer account can perform an upgrade or downgrade of the operating system by building a new workspace instance instead of modifying an existing workspace instance. A workspace bundle can be obtained that includes a machine image for the target operating system, as well as configuration information and information for default applications installed for the workspace. A new workspace instance can be created using the workspace bundle and user-specific configuration information. A workspace agent can perform a simplified install of the applications using information from the prior workspace. One or more new data volumes can be created using a snapshot from the prior workspace. Once configured, the new workspace instance can be made available to the user. The process can be repeated using the prior workspace bundle if an operating system downgrade is requested.

Abstract: Virtual workspaces can be provided using shared resources and network-attached storage. A workspace client can access a virtual workspace created under a customer account. For specific types of data, such as pixel data used to render the display component of the workspace on the workspace client, the data can be prevented from being transmitted over a public network. Private security gateway interfaces can be created in the customer environment that can be attached to respective security gateways in the workspace environment. Routing rules are configured such that pixel data for a workspace is only transmitted to the workspace client through a security gateway and over a secure connection to the corresponding private gateway interface in the customer environment, which can direct the pixel data to the workspace client.

Abstract: Systems and methods are presented for enabling a user to provide rules for the placement of computing resources at a data center for an entity that employs or is associated with the user. The data center can use the placement rules to select a data center computer system to host computing resources for a user. The rules can be used to establish diversity in computing resource placement at the data center thereby reducing the number of users who lose access to computing resources when a specific data center computer suffers a failure. Further, the placement rules can be used to facilitate configuration of the computer resources for the user based, for example, on the user's employment responsibilities.

Abstract: Virtual workspaces can be provided using shared resources and network-attached storage. A workspace accessed under a customer account has a unique key generated using a combination of a customer master key and an encryption context. The encryption context is specific to the workspace, such as may include a hash of specific values for the workspace. When a new instance is generated, a first data volume is generated using a machine image and data snapshot encrypted under a current encryption key. The snapshot is copied to a new snapshot, and a new encryption key obtained that is based on the customer master key and the current encryption context. The snapshot is used to create a new data volume encrypted under the new encryption key. The new volume is attached to the workspace instance such that data transmitted between the workspace and the new volume is encrypted under the volume-specific encryption key.

Abstract: Systems and methods are presented for accessing an application available from a data center of a program execution service. The metadata associated with a user computing device may be used to determine whether the user computing device is authorized to access the application through a virtual desktop instance. At least a portion of the application may be executed by the virtual desktop instance and provided to the user. Applications may be purchased, licensed, or rented by a user.

Abstract: Systems and methods are presented for automatically selecting a data center that can communicate with a user computing system over a connection that provides reduced or minimal latency. In some cases, the system can select the data center based on the calculation of one or more latency factors that correlate, at least in part, to the latency of a communication channel between the data center and the user computing system. Further, the selected data center may be identified from a set of data centers that include one or more computing resources the user has identified as desiring to access.

Abstract: A computing system that provides virtual computing services may generate and manage remote computing sessions between client computing devices and virtual desktop instances hosted on the service provider's network. Each virtual desktop instance may include a network interface for communication between the virtual desktop instance and client computing devices, and a second interface that connects the virtual desktop instance to entities on other networks (e.g., Internet destinations, or shared resources on an internal network).

Abstract: A virtual computing environment service may receive a request from a customer to provision a virtual computing environment and join the virtual computing environment to a managed directory. The virtual computing environment service may provision the virtual computing environment and uses a set of administrator credentials from the customer and a set of credentials corresponding to the environment to access the managed directory and request joining of the environment to the managed directory. In response, the managed directory may create a computer account corresponding to the environment and which enables the environment to be used to access the managed directory. The virtual computing environment service may then enable the customer to specify one or more users that may utilize the virtual computing environment to access the managed directory.

Abstract: A virtual computing environment service may receive a request from a customer to provision a virtual computing environment and join the virtual computing environment to a managed directory. The virtual computing environment service may provision the virtual computing environment and uses a set of administrator credentials from the customer and a set of credentials corresponding to the environment to access the managed directory and request joining of the environment to the managed directory. In response, the managed directory may create a computer account corresponding to the environment and which enables the environment to be used to access the managed directory. The virtual computing environment service may then enable the customer to specify one or more users that may utilize the virtual computing environment to access the managed directory.

Abstract: Systems and methods are presented for enabling a user to provide rules for the placement of computing resources at a data center for an entity that employs or is associated with the user. The data center can use the placement rules to select a data center computer system to host computing resources for a user. The rules can be used to establish diversity in computing resource placement at the data center thereby reducing the number of users who lose access to computing resources when a specific data center computer suffers a failure. Further, the placement rules can be used to facilitate configuration of the computer resources for the user based, for example, on the user's employment responsibilities.

Abstract: A virtual computing environment service may receive a request from a customer to provision a virtual computing environment and join the virtual computing environment to a managed directory. The virtual computing environment service may provision the virtual computing environment and uses a set of administrator credentials from the customer and a set of credentials corresponding to the environment to access the managed directory and request joining of the environment to the managed directory. In response, the managed directory may create a computer account corresponding to the environment and which enables the environment to be used to access the managed directory. The virtual computing environment service may then enable the customer to specify one or more users that may utilize the virtual computing environment to access the managed directory.

Abstract: Systems and methods are presented for enabling a user to provide rules for the placement of computing resources at a data center for an entity that employs or is associated with the user. The data center can use the placement rules to select a data center computer system to host computing resources for a user. The rules can be used to establish diversity in computing resource placement at the data center thereby reducing the number of users who lose access to computing resources when a specific data center computer suffers a failure. Further, the placement rules can be used to facilitate configuration of the computer resources for the user based, for example, on the user's employment responsibilities.

Abstract: Systems and methods are presented for enabling a user to provide rules for the placement of computing resources at a data center for an entity that employs or is associated with the user. The data center can use the placement rules to select a data center computer system to host computing resources for a user. The rules can be used to establish, diversity in computing resource placement at the data center thereby reducing the number of users who lose access to computing resources when a specific data center computer suffers a failure. Further, the placement rules can be used to facilitate configuration of the computer resources for the user based, for example, on the user's employment responsibilities.

Abstract: Systems and methods are presented for enabling a user to provide rules for the placement of computing resources at a data center for an entity that employs or is associated with the user. The data center can use the placement rules to select a data center computer system to host computing resources for a user. The rules can be used to establish diversity in computing resource placement at the data center thereby reducing the number of users who lose access to computing resources when a specific data center computer suffers a failure. Further, the placement rules can be used to facilitate configuration of the computer resources for the user based, for example, on the user's employment responsibilities.

Abstract: Systems and methods are presented for enabling a user to provide rules for the placement of computing resources at a data center for an entity that employs or is associated with the user. The data center can use the placement rules to select a data center computer system to host computing resources for a user. The rules can be used to establish diversity in computing resource placement at the data center thereby reducing the number of users who lose access to computing resources when a specific data center computer suffers a failure. Further, the placement rules can be used to facilitate configuration of the computer resources for the user based, for example, on the user's employment responsibilities.

Abstract: Systems and methods are presented for enabling a user to provide rules for the placement of computing resources at a data center for an entity that employs or is associated with the user. The data center can use the placement rules to select a data center computer system to host computing resources for a user. The rules can be used to establish diversity in computing resource placement at the data center thereby reducing the number of users who lose access to computing resources when a specific data center computer suffers a failure. Further, the placement rules can be used to facilitate configuration of the computer resources for the user based, for example, on the user's employment responsibilities.

Abstract: A dressing for covering a wound of a patient comprises a sheet member adapted to be adhered to the patient's skin in use to provide an airtight seal around the wound, wherein the skin-adhesion is provided by a hydrogel layer 10 on the skin-facing face of the sheet member, wherein the sheet member defines in use a substantially enclosed space 5 above the wound, and wherein a plurality of mutually spaced-apart flutter valves formed by holes 5 in a thin film 13 overlying an upper face of a layer 12 of the sheet member permit one-way air, blood and/or other fluid flow communication from the space 5 above the wound to the exterior of the dressing.

Abstract: A dressing for covering a wound of a patient comprises a sheet member adapted to be adhered to the patient's skin in use to provide an airtight seal around the wound, wherein the skin-adhesion is provided by a hydrogel layer 10 on the skin-facing face of the sheet member, wherein the sheet member defines in use a substantially enclosed space 5 above the wound, and wherein a plurality of mutually spaced-apart flutter valves formed by holes 5 in a thin film 13 overlying an upper face of a layer 12 of the sheet member permit one-way air, blood and/or other fluid flow communication from the space 5 above the wound to the exterior of the dressing.

Abstract: A position marking arrangement for a slidable vehicle seat 10, 12. The seat includes a first component 18 which is slidable relative to a fixed, second component 16. The seat component 18 has a datum mark 24 thereon and the fixed seat slide 16 has a surface 22 such that relative movement takes place between the datum mark and the surface when the seat slides. The surface has holes 28 for mounting thereon a marker 30 in a range of different positions, and the seat can be moved to any one of the different positions, with the positions being marked by one or more markers 30.