Identity proxy to provide access control and single sign on

• US 10,673,861 B2
• Filed: 04/26/2019
• Issued: 06/02/2020
• Est. Priority Date: 01/26/2015
• Status: Active Grant

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: MobileIron, Inc.
• Inventors: Karunakaran, Kumara Das, Pawar, Vijay, Liu, Jian
• Primary Examiner(s): Pham, Luu T
• Assistant Examiner(s): Jackson, Jenise E
• Application Number:
  US16/396,354
• Publication Number:
  US 20190319962A1
• Time in Patent Office: 403 Days
• Field of Search: 726 4
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Techniques to provide secure access to a cloud-based service are disclosed. In various embodiments, a request is received from a client app on a device to connect to a security proxy associated with the cloud-based service. A secure tunnel connection between the device and a node with which the security proxy is associated is used to establish the requested connection to the security proxy. Information associated with the secure tunnel is used to determine that the requesting client app is authorized to access the cloud-based service from the device and to obtain from an identity provider associated with the cloud-based service a security token to be used by the client app to authenticate to the cloud-based service.

Claims

1. A system, comprising:

a processor configured to;

receive a request associated with a first client app on a device to connect to a security proxy, wherein the first client app is associated with a first cloud-based service;

determine that a secure tunnel exists between the device and a second cloud-based service, wherein a second client app is associated with the second cloud-based service, wherein the secure tunnel was used to authenticate the second client app to the second cloud-based service;

use the existing secure tunnel to establish a connection to the security proxy and to authenticate the first client app to the first cloud-based service, wherein to authenticate the first client app to the first cloud-based service, cached user or device information associated with the second client app is used to obtain a first security token for the first cloud-based service, wherein the cached user or device information associated with the second client app was cached in connection with authenticating the second client app to access the second cloud-based service;

provide the first security token to the first client app, wherein the first client app is configured to use the first security token to gain access to the first cloud-based service;

grant access to the first cloud-based service based at least in part on an indication that a compliance posture of the device is in compliance; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1, wherein the request is sent by the first client app in response to a redirect message received from the first cloud-based service.

3. The system of claim 2, wherein the redirect message includes a URL or other locator associated with the security proxy.

4. The system of claim 1, wherein the secure tunnel is established between the device and a tunnel server associated with the security proxy.

5. The system of claim 1, wherein to establish the secure tunnel, the processor is configured to receive from the device a security certificate.

6. The system of claim 5, wherein the processor is further configured to use information comprising the security certificate to determine one or more of device, app, user, and certificate information.

7. The system of claim 5, wherein the processor is further configured to use information associated with the security certificate to determine that the first client app is authorized to access the first cloud-based service.

8. The system of claim 1, wherein the secure proxy comprises an identity provider proxy configured to have a chained identity provider or other trust-based relationship to the identity provider associated with the second cloud-based service.

9. The system of claim 8, wherein the processor is further configured to determine that the secure tunnel has already been established and to establish the requested connection to the identity provider proxy on behalf of the first client app without requiring any further credential to be provided.

10. The system of claim 1, wherein the processor is further configured to provide the first security token to the first client app, wherein the security token comprises a Security Assertion Markup Language (SAML) assertion.

11. The system of claim 8, wherein the security proxy comprises a delegated identity provider.

12. The system of claim 9, wherein the security proxy comprises a service provider proxy.

13. The system of claim 12, wherein the processor is configured to provide and sign the first security token as and on behalf of an identity provider proxy associated with the first cloud-based service.

14. A method, comprising:

receiving a request associated with a first client app on a device to connect to a security proxy, wherein the first client app is associated with a first cloud-based service;

determining that a secure tunnel exists between the device and a second cloud-based service, wherein a second client app is associated with the second cloud-based service, wherein the secure tunnel was used to authenticate the second client app to the second cloud-based service;

using the existing secure tunnel to establish a connection to the security proxy and to authenticate the first client app to the first cloud-based service, wherein to authenticate the first client app to the first cloud-based service, cached user or device information associated with the second client app is used to obtain a first security token for the first cloud-based service, wherein the cached user or device information associated with the second client app was cached in connection with authenticating the second client app to access the second cloud-based service;

providing the first security token to the first client app, wherein the first client app is configured to use the first security token to gain access to the first cloud-based service; and

granting access to the first cloud-based service based at least in part on an indication that a compliance posture of the device is in compliance.

15. The method of claim 14, wherein the request is sent by the first client app in response to a redirect message received from the first cloud-based service.

16. The method of claim 15, wherein the redirect message includes a URL or other locator associated with a security proxy.

17. The method of claim 14, wherein a security proxy is associated with a system and the secure tunnel is established between the device and a tunnel server running on the system.

18. The method of claim 15, wherein establishing the secure tunnel includes receiving from the device a security certificate.

19. A computer program product to provide secure access to a cloud-based service, the computer program product being embodied in a non-transitory computer readable storage device and comprising computer instructions for:

receiving a request associated with a first client app on a device to connect to a security proxy, wherein the first client app is associated with a first cloud-based service;

determining that a secure tunnel exists between the device and a second cloud-based service, wherein a second client app is associated with the second cloud-based service, wherein the secure tunnel was used to authenticate the second client app to the second cloud-based service;

using the existing secure tunnel to establish a connection to the security proxy and to authenticate the first client app to the first cloud-based service, wherein to authenticate the first client app to the first cloud-based service, cached user or device information associated with the second client app is used to obtain a first security token for the first cloud-based service, wherein the cached user or device information associated with the second client app was cached in connection with authenticating the second client app to access the second cloud-based service;

providing the first security token to the first client app, wherein the first client app is configured to use the first security token to gain access to the first cloud-based service; and

granting access to the first cloud-based service based at least in part on an indication that a compliance posture of the device is in compliance.

20. The computer program product of claim 19, wherein the request is sent by the first client app in response to a redirect message received from the first cloud-based service.