Identity proxy to provide access control and single sign on

• US 10,320,801 B2
• Filed: 09/25/2018
• Issued: 06/11/2019
• Est. Priority Date: 01/26/2015
• Status: Active Grant

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: MobileIron, Inc.
• Inventors: Karunakaran, Kumara Das, Pawar, Vijay, Liu, Jian
• Primary Examiner(s): Pham, Luu T
• Assistant Examiner(s): Jackson, Jenise E
• Application Number:
  US16/141,716
• Publication Number:
  US 20190028480A1
• Time in Patent Office: 259 Days
• Field of Search: 726 4
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Techniques to provide secure access to a cloud-based service are disclosed. In various embodiments, a request is received from a client app on a device to connect to a security proxy associated with the cloud-based service. A secure tunnel connection between the device and a node with which the security proxy is associated is used to establish the requested connection to the security proxy. Information associated with the secure tunnel is used to determine that the requesting client app is authorized to access the cloud-based service from the device and to obtain from an identity provider associated with the cloud-based service a security token to be used by the client app to authenticate to the cloud-based service.

Claims

1. A system, comprising:

a processor configured to;

receive a request associated with a first client app on a device to connect to the system, wherein the first client app is associated with a first cloud-based service;

determine that a secure tunnel associated with the device and a second cloud-based service exists, wherein a second client app is associated with the second cloud-based service, wherein the secure tunnel was used to authenticate the second client app to the second cloud-based service;

determine that information associated with the device is cached at the system;

use the determined information to obtain a security token to be used by the first client app to authenticate to the first cloud-based service; and

provide the security token to the first client app, wherein the secure tunnel and the security token are to be used by the client app to access to the first cloud-based service;

monitor a compliance posture of the device; and

block access to the first cloud-based service based at least in part on an indication that the compliance posture of the device has changed; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1, wherein the request is sent by the first client app in response to a redirect message received from the first cloud-based service.

3. The system of claim 2, wherein the redirect message includes a URL or other locator associated with a security proxy.

4. The system of claim 1, wherein a security proxy is associated with the system and the secure tunnel is established between the device and a tunnel server running on the system.

5. The system of claim 1, wherein to establish the secure tunnel, the processor is configured to receive from the device a security certificate.

6. The system of claim 5, wherein the processor is further configured to use information comprising the security certificate to determine one or more of device, app, user, and certificate information.

7. The system of claim 5, wherein the processor is further configured to use information associated with the security certificate to determine that the first client app is authorized to access the first cloud-based service.

8. The system of claim 1, wherein a secure proxy of the system comprises an identity provider proxy configured to have a chained identity provider or other trust-based relationship to the identity provider associated with the second cloud-based service.

9. The system of claim 8, wherein the processor is further configured to determine that the secure tunnel has already been established and to establish the requested connection to the identity provider proxy on behalf of the first client app without requiring any further credential to be provided.

10. The system of claim 1, wherein the security token comprises a Security Assertion Markup Language (SAML) assertion.

11. The system of claim 8, wherein the security proxy comprises a delegated identity provider.

12. The system of claim 8, wherein the security proxy comprises a service provider proxy.

13. The system of claim 12, wherein the processor is configured to sign the security token as and on behalf of an identity provider proxy associated with the first cloud-based service.

18. The method of claim 13, wherein establishing the secure tunnel includes receiving from the device a security certificate.

14. A method, comprising:

receiving a request associated with a first client app on a device to connect to a security proxy server, wherein the first client app is associated with a first cloud-based service;

determining that a secure tunnel associated with the device and a second cloud-based service exists, wherein a second client app is associated with the second cloud-based service, wherein the secure tunnel was used to authenticate the second client app to the second cloud-based service;

determining that information associated with the device is cached at the security proxy server;

using the determined information to obtain a security token to be used by the first client app to authenticate to the first cloud-based service;

providing the security token to the first client app, wherein the secure tunnel and the security token are to be used by the client app to access to the first cloud-based service;

monitoring a compliance posture of the device; and

blocking access to the first cloud-based service based at least in part on an indication that the compliance posture of the device has changed.

15. The method of claim 14, wherein the request is sent by the first client app in response to a redirect message received from the first cloud-based service.

16. The method of claim 15, wherein the redirect message includes a URL or other locator associated with a security proxy.

17. The method of claim 14, wherein a security proxy is associated with the system and the secure tunnel is established between the device and a tunnel server running on the system.

19. A computer program product to provide secure access to a cloud-based service, the computer program product being embodied in a non-transitory computer readable storage device and comprising computer instructions for:

receiving a request associated with a first client app on a device to connect to a security proxy server, wherein the first client app is associated with a first cloud-based service;

determining that a secure tunnel associated with the device and a second cloud-based service exists, wherein a second client app is associated with the second cloud-based service, wherein the secure tunnel was used to authenticate the second client app to the second cloud-based service;

determining that information associated with the device is cached at the security proxy server;

using the determined information to obtain a security token to be used by the first client app to authenticate to the first cloud-based service;

providing the security token to the first client app, wherein the secure tunnel and the security token are to be used by the client app to access to the first cloud-based service;

monitoring a compliance posture of the device; and

blocking access to the cloud-based service based at least in part on an indication that the compliance posture of the device has changed.