Identity proxy to provide access control and single sign on
First Claim
1. A system, comprising:
- a processor configured to;
receive a request associated with a client app on a device to connect to the system, wherein the system is associated with a cloud-based service, wherein the system is remote from the cloud-based service;
establish a secure tunnel between the device and the system;
determine that the requesting client app is authorized to access the cloud-based service;
obtain a security token trusted by the cloud-based service;
provide the security token to the client app, wherein the security token is to be used by the client app to access to the cloud-based service and cached by the device, wherein the cached security token allows one or more other client apps on the device to be authenticated to one or more corresponding cloud-based services using the secure tunnel;
monitoring a compliance posture of the device; and
blocking access to the cloud-based service based at least in part on an indication that the compliance posture of the device has changed; and
a memory coupled to the processor and configured to provide the processor with instructions.
3 Assignments
0 Petitions
Accused Products
Abstract
Techniques to provide secure access to a cloud-based service are disclosed. In various embodiments, a request is received from a client app on a device to connect to a security proxy associated with the cloud-based service. A secure tunnel connection between the device and a node with which the security proxy is associated is used to establish the requested connection to the security proxy. Information associated with the secure tunnel is used to determine that the requesting client app is authorized to access the cloud-based service from the device and to obtain from an identity provider associated with the cloud-based service a security token to be used by the client app to authenticate to the cloud-based service.
-
Citations
20 Claims
-
1. A system, comprising:
-
a processor configured to; receive a request associated with a client app on a device to connect to the system, wherein the system is associated with a cloud-based service, wherein the system is remote from the cloud-based service; establish a secure tunnel between the device and the system; determine that the requesting client app is authorized to access the cloud-based service; obtain a security token trusted by the cloud-based service; provide the security token to the client app, wherein the security token is to be used by the client app to access to the cloud-based service and cached by the device, wherein the cached security token allows one or more other client apps on the device to be authenticated to one or more corresponding cloud-based services using the secure tunnel; monitoring a compliance posture of the device; and blocking access to the cloud-based service based at least in part on an indication that the compliance posture of the device has changed; and a memory coupled to the processor and configured to provide the processor with instructions. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14)
-
-
15. A method of providing secure access to a cloud-based service, comprising:
-
receiving a request associated with a client app on a device to connect to a security proxy server associated with the cloud-based service, wherein the security proxy server is remote from the cloud-based service; and establishing a secure tunnel between the device and the security proxy server; determining by the security proxy server that the requesting client app is authorized to access the cloud-based service; obtaining, by the security proxy server from an identity provider associated with the cloud-based service, a security token trusted by the cloud-based service; providing, by the security proxy server, the security token to the client app, wherein the security token is to be used by the client app to access to the cloud-based service and cached by the device, wherein the cached security token allows one or more other client apps on the device to be authenticated to one or more corresponding cloud-based services using the secure tunnel; and monitoring, by the security proxy server, a compliance posture of the device; and blocking access to the cloud-based service based at least in part on an indication that the compliance posture of the device has changed. - View Dependent Claims (16, 17, 18, 19)
-
-
20. A computer program product to provide secure access to a cloud-based service, the computer program product being embodied in a non-transitory computer readable storage device and comprising computer instructions for:
-
receiving a request associated with a client app on a device to connect to a security proxy server associated with a cloud-based service, wherein the security proxy server is remote from the cloud-based service; establishing a secure tunnel between the device and the security proxy server; determining, by the security proxy server, that the requesting client app is authorized to access the cloud-based service from the device obtaining, by the security proxy server from an identity provider associated with the cloud-based service, a security token signed by the identity provider; providing, by the security proxy server, the security token to the client app, wherein the security token is to be used by the client app to access to the cloud-based service and cached by the device, wherein the cached security token allows one or more other client apps on the device to be authenticated to one or more corresponding cloud-based services using the secure tunnel; and monitoring, by the security proxy server, a compliance posture of the device; and blocking access to the cloud-based service based at least in part on an indication that the compliance posture of the device has changed.
-
Specification