SECURITY ACCESS PROTECTION FOR USER DATA STORED IN A CLOUD COMPUTING FACILITY

• US 20140020072A1
• Filed: 07/13/2012
• Published: 01/16/2014
• Est. Priority Date: 07/13/2012
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Plc (Sophos Group Ltd.)
• Inventors: Thomas, Andrew J.
• Granted Patent: US 8,713,633 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

In embodiments of the present invention improved capabilities are described for a method and system including storing a plurality of proxy access credentials for a user to securely access each of a plurality of cloud computing facilities; receiving a request from a client device for access to one of the plurality of cloud computing facilities; securing a communication link to the client device, thereby providing a secure link; receiving access credentials from the user through the secure link; verifying an identity of the user with the access credentials; assessing a security state of the client device to determine if the client is in compliance with a security policy; and if the client is in compliance with the security policy, coupling the client to one of the plurality of cloud computing facilities through a second secure link using a corresponding one of the plurality of proxy access credentials for the user.

Claims

1. A method comprising:

storing a plurality of proxy access credentials for a user to securely access each of a plurality of cloud computing facilities;

receiving a request from a client device for access to one of the plurality of cloud computing facilities;

securing a communication link to the client device, thereby providing a secure link;

receiving access credentials from the user through the secure link;

verifying an identity of the user with the access credentials;

assessing a security state of the client device to determine if the client is in compliance with a security policy; and

if the client is in compliance with the security policy, coupling the client to one of the plurality of cloud computing facilities through a second secure link using a corresponding one of the plurality of proxy access credentials for the user.

2. The method of claim 1, further comprising a transfer of data from the client device to the one of the plurality of cloud computing facilities, wherein the data that is transferred is at least one of tokenized and encrypted.

3. The method of claim 1, further comprising a transfer of data from the one of the plurality of cloud computing facilities to the client device, wherein the data that is transferred is at least one of de-tokenized and decrypted.

4. The method of claim 1, wherein the access credentials includes a username and password.

5. The method of claim 1, wherein the security policy enables the user to create an access rule.

6. The method of claim 5, wherein the access rule determines a list of authorized client devices.

7. The method of claim 5, wherein the access rule is a plurality of authorized users.

8. The method of claim 1, wherein the proxy credential is a randomly generated credential is mapped to the plurality of cloud computing facilities.

9. The method of claim 1, wherein the proxy access credentials is common for all of the plurality of cloud computing facilities.

10. The method of claim 1, wherein the proxy access credentials is different for each of the plurality of cloud computing facilities.

11. The method of claim 1, wherein the compliance is a determination that a malware scan process is up to date.

12. The method of claim 1, wherein the compliance is a determination that the client device software is up-to-date.

13. The method of claim 1, wherein the compliance is determination that the client device is accessing from a network known to be a secure network.

14. The method of claim 1, wherein the compliance is determination that a security aspect of the client device has been compromised.

15. The method of claim 14, wherein the security aspect that has been compromised is the client device has been reported as stolen.

16. The method of claim 14, wherein the security aspect that has been compromised is an unauthorized tampering with the client device.

17. The method of claim 16, wherein the tampering with the client device is tampering with the client operating system to provide privilege escalation.

18. A proxy server comprising:

a first interface for coupling in a communicating relationship with one or more of a plurality of cloud computing facilities;

a second interface for coupling in a communicating relationship with a client device;

a memory storing access credentials for enabling user access to the proxy server and a plurality of corresponding proxy access credentials for enabling the proxy server to link the user-provided access credentials to the proxy access credentials and use thereof to enable a user to access with the one or more of the plurality of cloud computing facilities through the proxy server; and

a processor configured to secure communications through the first interface and the second interface, to receive a request from the client device, to verify an identity of the user against the access credentials, to assess a security state of the client device, and to conditionally grant access through the proxy server to one of the plurality of cloud computing facilities using a corresponding one of the plurality of proxy access credentials when the security state is in compliance with a security policy.

19. The proxy server of claim 18, further comprising a transfer of data from the client device to the one of the plurality of cloud computing facilities, wherein the data that is transferred is at least one of tokenized and encrypted.

20. The proxy server of claim 18, wherein the access credentials includes a username and password.

21. The proxy server of claim 18, wherein the security policy enables the user to create an access rule.

22. A system comprising:

a client device having a user;

a plurality of cloud computing facilities, each accessible with one of a plurality of proxy access credentials; and

a proxy server configured for secure communications with the client device and the plurality of cloud computing facilities, the proxy server including a memory that stores the plurality of proxy access credentials for the plurality of cloud computing facilities, along with access credentials for the user to access the proxy server, and the proxy server further including a processor configured to conditionally grant access by the user to one or more of the plurality of cloud computing facilities through the proxy server with a corresponding one of the plurality of proxy access credentials based upon a verification of an identity of the user against the access credentials and a verification that a security state of the client device is in compliance with a security policy.

23. The system of claim 22, further comprising a transfer of data from the client device to the one of the plurality of cloud computing facilities, wherein the data that is transferred is at least one of tokenized and encrypted.

24. The system of claim 22, wherein the access credentials includes a username and password.

25. The system of claim 22, wherein the security policy enables the user to create an access rule.