Authentication proxy agent

• US 10,104,079 B2
• Filed: 05/11/2017
• Issued: 10/16/2018
• Est. Priority Date: 06/28/2013
• Status: Active Grant

• Current Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Original Assignee: BMC Software Incorporated (KKR & Co., Inc.)
• Inventors: Miller, Karl Frederick
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US15/593,232
• Publication Number:
  US 20170250984A1
• Time in Patent Office: 523 Days
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/065 Continuous authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

An authentication engine may be configured to receive an authentication request and credentials from a client. The authentication engine may then generate a proxy agent configured to interact with an identity provider to authenticate the client on behalf of the client, using the credentials. In this way, the authentication engine may receive an assertion of authentication of the client from the identity provider, by way of the proxy agent.

Claims

1. A server comprising:

an authentication engine configured to cause at least one processor of the server to receive, at the server, an authentication request and credentials from a client;

store the credentials at the server;

generate, at the server, a proxy agent;

send, from the proxy agent, the credentials to an identity provider to authenticate the client on behalf of the client, using the credentials;

receive, at the proxy agent, an assertion of authentication of the client from the identity provider;

create a session for the client, based on the assertion; and

delete the stored credentials at the server.

2. The server of claim 1, wherein the authentication engine is implemented by a mobile server providing services to the client, and the client includes a mobile client.

3. The server of claim 1, wherein the authentication engine is configured to cause the at least one processor, in response to the receipt of the authentication request and credentials, to resolve a previously-stored authentication configuration, including identifying the identity provider from among a plurality of identity providers as being associated with the client.

4. The server of claim 1, wherein the proxy agent is configured to store configuration data governing content, format, and timing of interactions with the identity provider.

5. The server of claim 1, wherein the proxy agent includes a virtual browser manager configured to implement a virtual browser used to relay the credentials to the identity provider on behalf of the client.

6. The server of claim 5, wherein the virtual browser manager is configured to access a virtual browser pool storing a plurality of available virtual browsers, and to select the virtual browser therefrom.

7. The server of claim 1, wherein the proxy agent is configured to execute the Security Assertion Markup Language (SAML) standard with the identity provider, including receiving the assertion therefrom, on behalf of the client.

8. The server of claim 1, wherein the server includes a mobile server, and the authentication engine is provided by the mobile server, and wherein the session provides access to multiple services of the mobile server to the client.

9. A method comprising:

receiving, at a server, an authentication request and credentials from a client;

storing the credentials at the server;

generating, at the server, a proxy agent;

sending, from the proxy agent, the credentials to an identity provider to authenticate the client on behalf of the client, using the credentials;

receiving, at the proxy agent, an assertion of authentication of the client from the identity provider;

creating a session for the client, based on the assertion; and

deleting the stored credentials at the server.

10. The method of claim 9, wherein receiving the authentication request and credentials further comprises resolving a previously-stored authentication configuration, including identifying the identity provider from among a plurality of identity providers as being associated with the client.

11. The method of claim 9, wherein the proxy agent is configured to store configuration data governing content, format, and timing of interactions with the identity provider.

12. The method of claim 9, wherein the proxy agent includes a virtual browser manager configured to implement a virtual browser used to relay the credentials to the identity provider on behalf of the client.

13. The method of claim 9, wherein the proxy agent is configured to execute the Security Assertion Markup Language (SAML) standard with the identify provider, including receiving the assertion therefrom, on behalf of the client.

14. The method of claim 9, wherein the server includes a mobile server, and wherein the session provides access to multiple services of the mobile server to the client.

15. A computer program product including instructions recorded on a non-transitory computer readable storage medium and configured to cause at least one processor to:

receive, at a server, an authentication request and credentials from a client;

store the credentials at the server;

generate, at the server, a proxy agent;

send, from the proxy agent, the credentials to an identity provider to authenticate the client on behalf of the client, using the credentials;

receive, at the proxy agent, an assertion of authentication of the client from the identity provider;

create a session for the client, based on the assertion; and

delete the stored credentials at the server.

16. The computer program product of claim 15, wherein the instructions, when executed, are further configured, in response to the receipt of the authentication request and credentials, to resolve a previously-stored authentication configuration, including identifying the identity provider from among a plurality of identity providers as being associated with the client.

17. The computer program product of claim 15, wherein the proxy agent is configured to store configuration data governing content, format, and timing of interactions with the identity provider.

18. The computer program product of claim 15, wherein proxy agent includes a virtual browser manager configured to implement a virtual browser used to relay the credentials to the identity provider on behalf of the client.

19. The computer program product of claim 18, wherein the virtual browser manager is configured to access a virtual browser pool storing a plurality of available virtual browsers, and to select the virtual browser therefrom.

20. The computer program product of claim 15, wherein the proxy agent is configured to execute the Security Assertion Markup Language (SAML) standard with the identify provider, including receiving the assertion therefrom, on behalf of the client.