Connecting to a Cloud Service for Secure Access

• US 20130246629A1
• Filed: 03/14/2012
• Published: 09/19/2013
• Est. Priority Date: 03/14/2012
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: SHAO, Hui
• Granted Patent: US 10,009,318 B2
• Time in Patent Office: Days
• US Class Current: 709/227
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A client may connect to a server over an insecure network by downloading and configuring a secure connection mechanism to the server. The secure connection mechanism may allow the client to join a domain when connected to the server and access domain level services. The server may receive a request from the client, classify the connection type, and used the classification to determine whether the request originated off premises. If so, the server may send a configuration mechanism to the client, which may then establish a secure connection to the server. Once the secure connection is established, the server may join the client to the server'"'"'s domain and begin secure operations.

Claims

1. A server system comprising:

a processor;

an incoming request analyzer operating on said processor, said incoming request analyzer that;

receives a request for a connection from a client device;

determines an address for said request;

determines that said address is outside of a domain;

a downloader that;

creates a setup file comprising;

an address for said server system;

a first setup configuration for a first secure connection mechanism; and

a security certificate for said server system; and

transmits said setup file to said client device for installation by said client, device;

an incoming authentication processor that;

receives a secure connection request from said client device;

establishes a secure connection with said client device using said first secure connection mechanism; and

joins said client device to said domain.

2. The server system of claim 1, said incoming request analyzer that further:

determines that an account for said client device exists.

3. The server system of claim 2, said incoming request analyzer that further:

receives a second request for a connection from a second client device;

determines a second address for said second request;

determines that said second address is outside of a domain;

determine that an account for said second client does not exist; and

stops processing said second request.

4. The server of claim 3, said setup file further comprising:

a second setup configuration for a second secure connection mechanism.

5. The server of claim 4, said setup file further comprising:

an executable installation routine operable on said client device.

6. The server of claim 5, said executable installation routine that:

analyzes at least one parameter on said client device; and

uses said at least one parameter to select between said first secure connection and said second secure connection.

7. The server of claim 6, said executable installation routine comprising a user interface wizard.

8. The server of claim 7, said executable installation routine configuring said client device to connect using said first secure connection mechanism for future requests.

9. The server of claim 7, said first secure connection mechanism being a virtual private network connection.

10. The server of claim 7, said first secure connection mechanism comprising an IPSec tunnel between said client device and said server system.

11. A method comprising:

receiving a request for a connection from a client device;

determining an address for said request;

determining that said address is outside of a local domain;

determining that said client device has an existing account on said local domain;

creating a setup file comprising;

an address for a secure connection;

a first setup configuration for a first secure connection mechanism; and

a public key for a security certificate for said local domain; and

transmitting said setup file to said client device for installation by said client device;

receiving a secure connection request from said client device;

establishing a secure connection with said client device using said first secure connection mechanism; and

joining said client device to said domain.

12. The method of claim 11 further comprising:

decrypting at least a portion of said request using a private key for said security certificate.

13. The method of claim 12, said setup file further comprising:

a configuration executable that configures said client device to establish a connection using said first secure connection mechanism for subsequent requests.

14. The method of claim 13, said setup file further comprising:

a second setup configuration for a second secure connection mechanism.

15. The method of claim 14, said configuration executable that further:

analyzes said client device to select said first secure connection mechanism from said first secure connection mechanism and said second secure connection mechanism.

16. The method of claim 15, said request being received by a first server and said secure connection request being received by a second server.

17. A server system comprising:

a processor;

an incoming request analyzer operating on said processor, said incoming request analyzer that;

receives a request for a connection from a client device;

determines that said request is an unauthenticated request;

determines an address for said request;

determines that said address is outside of a domain;

determines a host name for said client device;

determines that said host name has an account on said domain; and

launches a downloader based on said account;

said downloader that;

creates a setup file comprising;

an address for said server system;

a first setup configuration for a first secure connection mechanism;

a security certificate for said server system; and

executable code to configure said client device to perform a secure connection;

transmits said setup file to said client device for installation by said client device;

an incoming authentication processor that;

receives a secure connection request from said client device;

determines that said secure connection request complies with said first secure connection mechanism;

establishes a secure connection with said client device using said first secure connection mechanism; and

joins said client device to said domain.

18. The server system of claim 17, said first secure connection mechanism comprises an IPSec tunnel.

19. The server system of claim 18, said incoming authentication processor being a separate process from said incoming request analyzer.

20. The server system of claim 19, said incoming request analyzer being a website configured to receive said request for a connection.