Proxy authentication for single sign-on

• US 10,554,624 B2
• Filed: 09/25/2014
• Issued: 02/04/2020
• Est. Priority Date: 09/25/2013
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Ott, Alexey, Homann, Ulrich, Schnellbaecher, Jan F.
• Primary Examiner(s): Schmidt, Kari L
• Application Number:
  US14/912,453
• Publication Number:
  US 20160205089A1
• Time in Patent Office: 1,958 Days
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

In an example, a web gateway is described, including an authentication proxy engine (PAE). The PAE authenticates a user device via, for example, a username and password, biometric data, or two-factor authentication. The web gateway then provides seamless and transparent single sign-on (SSO) for one or more web services. When the user requests a web page from the web service, the PAE inserts custom code that detects a login action. When the user logs in, a one-time token may be provided to auto-fill the username and password field. When the user submits the form, the PAE provides the actual credentials to the web service. The PAE may also provide authentication via authentication headers.

Claims

1. A computing apparatus for providing a network gateway, comprising:

a hardware platform comprising at least a processor;

a service database comprising authentication credentials, wherein the authentication credentials are owned by the network gateway and not by an end user;

a first network interface configured to communicatively couple the gateway to a network service;

a second network interface configured to communicatively couple the gateway to a client device; and

one or more logic elements implemented on the hardware platform and comprising an authentication proxy engine configured to;

intercept via the second network interface a request from the client device to access the network service;

determine that the intercepted request requires form-based authentication of the client device or a user of the client device;

receive a data page requiring form-based authentication from the network service;

inject a script into a modified data page from the network service, the script configured to detect a login action;

receive the detected login action from the script, the login action including profile login data and authentication for the client device or a user of the client device;

extract the authentication credentials from the service database, the authentication credentials comprising a password for the user or the client device; and

provide authentication data to the network service via the first network interface comprising filling in the form-based authentication.

2. The computing apparatus of claim 1, wherein the proxy engine is further configured to:

receive an authentication validation from the network service via the first network interface; and

provide the authentication validation to the client device via the second network interface.

3. The computing apparatus of claim 1, wherein the proxy engine is further configured to:

receive a request for a data page from the client device via the second network interface;

receive the data page from the network service via the first network interface; and

forward the data page to the client device via the second network interface.

4. The computing apparatus of claim 3, wherein the proxy engine is further configured to modify the data page request by inserting an authentication header into the data page.

5. The computing apparatus of claim 3, wherein the proxy engine is further configured to modify the data page before forwarding the data page.

6. The computing apparatus of claim 5, wherein modifying the data page comprises inserting instructions for detecting and intercepting a login action.

7. The computing apparatus of claim 5, wherein the data page comprises a username or password field, and wherein modifying the data page comprises inserting a one-time random or pseudo-random token into the username or password field.

8. The computing apparatus of claim 1, wherein the proxy engine is further configured to authenticate the client device via the second network interface.

9. The computing apparatus of claim 8, wherein authenticating the client device comprises receiving biometric authentication data from the client device.

10. The computing apparatus of claim 8, wherein authenticating the client device comprises two-factor authentication.

11. The computing apparatus of claim 1, wherein the proxy engine is further configured to provide a token to the client device via the second network interface, wherein the token is different from the form-based authentication data.

12. The computing apparatus of claim 11, wherein the token comprises a pseudo-username or pseudo-password.

13. The computing apparatus of claim 1, wherein the proxy engine is further configured to provide a learning mode.

14. One or more non-transitory computer-readable mediums having stored thereon executable instructions for providing a proxy engine configured to:

intercept a request for a network service from a client device to access the network service;

determine that the intercepted request requires form-based authentication of the client device or a user of the client device;

receive a data page requiring form-based authentication from the network service;

inject a script into a modified data page from the network service, the script configured to detect a login action;

receive the detected login action from the script, the login action including profile login data and authentication for the client device or a user of the client device;

extract authentication credentials from a service database, the authentication credentials comprising a password for the user or the client device, wherein the authentication credentials are owned by a network gateway and not by an end user;

provide authentication data to the network service via a first network interface comprising filling in the form-based authentication;

receive an authentication validation from a network service via a first network interface; and

provide the authentication validation to the client device via a second network interface.

15. The one or more non-transitory computer-readable mediums of claim 14, wherein the proxy engine is further configured to:

receive a request for a data page from the client device via the second network interface;

receive the data page from the network service via the first network interface; and

forward the data page to the client device via the second network interface.

16. The one or more non-transitory computer-readable mediums of claim 15, wherein the proxy engine is further configured to modify the data page request, comprising inserting an authentication header into the data page.

17. The one or more non-transitory computer-readable mediums of claim 15, wherein the proxy engine is further configured to modify the data page before forwarding the data page.

18. The one or more non-transitory computer-readable mediums of claim 17, wherein modifying the data page comprises inserting instructions for detecting and intercepting a login action.

19. The one or more non-transitory computer-readable mediums of claim 17, wherein the data page comprises a username or password field, and wherein modifying the data page comprises inserting a one-time random or pseudo-random token into the username or password field.

20. The one or more non-transitory computer-readable mediums of claim 14, wherein the proxy engine is further configured to authenticate the client device via the second network interface.

21. The one or more non-transitory computer-readable mediums of claim 20, wherein authenticating the client device comprises receiving biometric authentication data from the client device or two-factor authentication.

22. The one or more non-transitory computer-readable mediums of claim 14, wherein the proxy engine is further configured to provide a token to the client device via the second network interface, wherein the token is different from the form-based authentication data.

23. The one or more non-transitory computer-readable mediums of claim 22, wherein the token comprises a pseudo-username or pseudo-password.

24. A method of providing a proxy engine, comprising:

communicatively coupling to a network service via a first network interface;

authenticating a client device via a second network interface;

receiving a login request from the client device via the second network interface;

intercepting via the second network interface a request from the client device to access the network service;

determining that the intercepted request requires form-based authentication of the client device or a user of the client device;

receiving a data page requiring form-based authentication from the network service;

injecting a script into a modified data page from the network service, the script configured to detect a login action;

receiving the detected login action from the script, the login action including profile login data and authentication for the client device or a user of the client device;

extracting authentication credentials from a service database, the authentication credentials comprising a password for the user or the client device, wherein the authentication credentials are owned by a network gateway and not by an end user; and

providing authentication data to the network service via the first network interface comprising filling in the form-based authentication.

25. The method of claim 24, wherein authenticating the client device comprises biometric authentication or two-factor authentication.