Credential-free user login to remotely executed applications

• US 10,594,678 B2
• Filed: 06/20/2018
• Issued: 03/17/2020
• Est. Priority Date: 06/02/2015
• Status: Active Grant

• Current Assignee: Altr Solutions, Inc.
• Original Assignee: Altr Solutions, Inc.
• Inventors: Beecham, James Douglas, Goldfarb, Scott Nathaniel
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US16/013,478
• Publication Number:
  US 20180302390A1
• Time in Patent Office: 636 Days
• Field of Search: 726 7
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/53 using third party service providers
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Provided is a process including: receiving, with an intermediary server, a request to access web content at a web server; submitting, from the intermediary server a value by which possession of an access credential is demonstrated, wherein the value is withheld from the client web browser; receiving, by the intermediary web browser, instructions to store in web browser memory an access token; and sending, from the intermediary server, to the client web browser executing on the client computing device, instructions to store the access token in browser memory of the client web browser, thereby authenticating the client web browser without the client web browser having access to the value by which possession of the access credential is demonstrated.

Claims

1. A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:

receiving, with one or more processors executing a permission-management application, a first request to manage permissions of one or more users to access resources with client computing devices, wherein;

the permission-management application is configured to manage permissions for users of an organization to access a plurality of network-accessible applications;

the plurality of different network-accessible applications have different permission-management application program interfaces; and

the permission-management application is configured to manage permissions for users to access respective instances of a plurality of different native applications executing on the client computing devices;

determining, with the permission-management application, that the first request specifies a first user is to be de-permissioned for a first native application among the plurality of different native applications and, in response, sending via a network, with the permission-management application, instructions to a first client computing device to revoke the first user'"'"'s authority to access the first native application;

receiving, with the permission-management application, a second request to manage permissions of one or more users to access resources with client computing devices; and

determining, with the permission-management application, that the second request specifies a second user is to be de-permissioned for a first network-accessible application among the plurality of network-accessible applications and, in response, sending via a network, with the permission-management application, instructions to an intermediary server to revoke the second user'"'"'s authority to access the first network-accessible application,

wherein the intermediary server is configured to automate control of login information for the first network-accessible application for the users of the organization.

2. The medium of claim 1, wherein the operations comprise:

logging a record indicative of the first request to an immutable data store.

3. The medium of claim 2, wherein logging the record indicative of the first request to the immutable data store comprises:

logging the record to a tamper-evident, immutable data store.

4. The medium of claim 2, wherein logging the record indicative of the first request to the immutable data store comprises:

segmenting the record into a plurality of segments and logging the segments to a plurality of blockchains.

5. The medium of claim 4, wherein logging the segments to a plurality of blockchains comprises:

storing the segments in leaf nodes of Merkle trees in the blockchains.

6. The medium of claim 1, wherein:

the permission-management application is configured to provide a centralized interface to manage permissions of a heterogenous set of monolithic native applications and hosted software-as-a-service applications with a uniform interface.

7. The medium of claim 6, wherein:

the uniform interface includes a drag-and-drop graphical user interface by which the first request and the second request are initiated from one or more client computing devices.

8. The medium of claim 6, wherein:

the drag-and-drop user interface includes one or more graphical regions representing one or more users and one or more graphical regions representing at least some of the set of monolithic native applications and hosted software-as-a-service applications.

9. The medium of claim 8, wherein:

the operations comprise sending instructions to render the graphical user interface to the one or more client computing devices from which the first and second requests are sent to the permission-management application; and

the instructions are configured to be rendered in a web browser to cause the web browser to present the graphical user interface.

10. The medium of claim 1, wherein:

the permission-management application is configured to translate a permission-grant request or de-permission request in a unified format by which permission-grant requests or de-permission requests for a plurality of different network-accessible applications are communicated to the permission-management system into a network-application-specific format compliant with an application program interface of a selected one of the plurality of different network-accessible applications.

11. The medium of claim 10, wherein:

the network-application-specific format is not compliant with an application program interface of an unselected one of the plurality of different network-accessible applications.

12. The medium of claim 1, wherein sending instructions to the first client computing device to revoke the first user'"'"'s authority to access the first native application comprises:

sending the instructions to revoke the first user'"'"'s authority to access the first native application to an agent executing on the first client computing device.

13. The medium of claim 12, wherein the operations comprise:

receiving, with the agent executing on the first client computing device, the instructions to revoke the first user'"'"'s authority to access the first native application; and

in response to receiving the instructions to revoke the first user'"'"'s authority to access the first native application, changing or deleting a value stored on the first client computer effective to prevent the first user from accessing the first native application on the first client computing device.

14. The medium of claim 13, wherein:

the first native application is an offline application; and

the changed or deleted value is effective to prevent the first user from accessing the first native application on the first client computing device in the absence of network access.

15. The medium of claim 1, wherein the operations comprise:

receiving, with the permission-management application, a third request to manage permissions of one or more users to access resources with client computing devices; and

determining, with the permission-management application, that the third request specifies a third user is to be granted permission for a second native application and, in response, sending, via a network, with the permission-management application, instructions to a third client computing device to grant the third user authority to access the second native application.

16. The medium of claim 1, wherein the operations comprise:

receiving, with the permission-management application, a fourth request to manage permissions of one or more users to access resources with client computing devices; and

determining, with the permission-management application, that the fourth request specifies a fourth user is to be granted permission for a second network-accessible application and, in response, sending, via a network, with the permission-management application, instructions to an intermediary server to grant the second user authority to access the second network-accessible application, the second network-accessible application being a web application accessible by a web browser.

17. The medium of claim 1, wherein:

permissions for more than 1,000 users are managed for more than 5 native applications and more than 5 network-accessible applications.

18. The medium of claim 1, the operations comprising:

steps for providing a centralized platform for management of users within external applications.

19. The medium of claim 1, the operations comprising:

executing a plurality of enterprise applications on the client computing devices for which the permission-management application manages access; and

accessing a plurality of the network-accessible applications for which the permission-management application manages access with the client computing devices.

20. A method, comprising:

receiving, with one or more processors executing a permission-management application, a first request to manage permissions of one or more users to access resources with client computing devices, wherein;

the permission-management application is configured to manage permissions for users of an organization to access a plurality of network-accessible applications;

the plurality of different network-accessible applications have different permission-management application program interfaces; and

the permission-management application is configured to manage permissions for users to access respective instances of a plurality of different native applications executing on the client computing devices;

determining, with the permission-management application, that the first request specifies a first user is to be de-permissioned for a first native application among the plurality of different native applications and, in response, sending via a network, with the permission-management application, instructions to a first client computing device to revoke the first user'"'"'s authority to access the first native application;

receiving, with the permission-management application, a second request to manage permissions of one or more users to access resources with client computing devices; and

determining, with the permission-management application, that the second request specifies a second user is to be de-permissioned for a first network-accessible application among the plurality of network-accessible applications and, in response, sending via a network, with the permission-management application, instructions to an intermediary server to revoke the second user'"'"'s authority to access the first network-accessible application,

wherein the intermediary server is configured to automate control of login information for the first network-accessible application for the users of the organization.