System, method, and apparatus for managing access to resources across a network

• US 8,418,238 B2
• Filed: 03/25/2009
• Issued: 04/09/2013
• Est. Priority Date: 03/30/2008
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Symplified Incorporated
• Inventors: Platt, Darren C., Royer, Coby, Berg, Keshava, Wallingford, Joseph H. III, Olden, Eric
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): TRAN, TRI MINH
• Application Number:
  US12/410,992
• Publication Number:
  US 20090249440A1
• Time in Patent Office: 1,476 Days
• Field of Search: 726/1, 726/3, 726/8
• US Class Current: 726/8
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system, method and apparatus for managing access across a plurality of applications is disclosed. The system may include a user store connector configured to connect to one or more user stores to retrieve attributes; an authentication connector configured to communicate with at least one authentication subsystem to authenticate a user; a policy engine configured to retrieve attributes from the user store connector corresponding to a user and use the attributes to evaluate access policies, if any, which are defined for protection of resources, to determine whether or not the user should be granted access to the resources; an admin component that is configured to enable the access policies to be defined relative to attributes and the resources; and a policy store configured to store the access policies.

Claims

1. A system for managing access across a plurality of resources, comprising:

a user store connector configured to connect to one or more user stores to retrieve attributes;

an authentication connector configured to communicate with at least one authentication subsystem to authenticate a user to at least one of the plurality of resources through the use of a keychain module, the keychain module being adapted to construct an authentication configuration for the at least one of the plurality of resources by,

discovering one or more form elements on the plurality of remote domains wherein

discovering the use of at least one of a HTTP basic, HTTP Digest, NTLM, and SSL handler;

enabling a single sign-on with a plurality of remote domains comprises,

receiving a 401 “

Unauthorized”

code,

turning off the use of the at least one of HTTP basic and HTTP Digest authentication handlers; and

cycling through Spring registered authentication handlers and receiving an authentication configuration from at least one of the Spring registered authentication handlers;

returning an authentication configuration from the plurality of remote domains;

removing differences between at least one of the plurality of protocols and a plurality of APIs;

communicating with the at least one of the plurality of resources to construct name/value pairs, and

attempting a login on at least one of a plurality of remote domains, and at least one of,

identifying in a response from the at least one of the plurality of resources what constitutes a failed login, and

saving to the authentication configuration a successful log-in ceremony with the at least one of the plurality of remote domains;

a policy engine configured to retrieve attributes from the user store connector corresponding to the user and use the attributes to evaluate access policies, which are defined for protection of resources, to determine whether or not the user should be granted access to the resources;

an admin component that is configured to enable the access policies to be defined relative to attributes and the resources; and

a policy store configured to store the access policies.

2. The system of claim 1, including a request interceptor configured to receive requests from users as proxy addresses that differ from the actual addresses of the resources.

3. The system of claim 2, including a plurality of cookietrap components, wherein,

each of the plurality of cookietrap components is,

hosted on the at least one of the plurality of remote domains, and adapted to,

drop at least one cookie for a first of the at least one of the plurality of resources,

supply the at least one cookie to the policy engine for a request for a second of the plurality of resources;

and

when the policy engine approves the request for the second of the plurality of resources, re-direct the request for the second of the plurality of resources to the second of the plurality of resources;

the re-directed request,

comprises a one-time validation token, and

is recognized as coming from the user,

the at least one cookie allows the user to request resources across the plurality remote domains.

4. The system of claim 1, wherein the admin component is remotely located from the policy engine and coupled to the policy engine via the Internet.

5. The system of claim 1, including an update handler configured to install updates of the user store connector, the authentication connector, and the policy engine.

6. The system of claim 1, including a request interceptor configured to bridge communications between the user and the resources, inspect the communications, and block the communications if the communications are denied by one or more of the access policies.

7. A method for managing access across a plurality of resources hosted on a plurality of remote domains, the plurality of domains comprising at least one of a plurality of protocols and a plurality of APIs, the method comprising:

defining access policies for the plurality of resources relative to attributes and resources;

receiving, the access policies for the plurality of resources by,

connecting to one or more user stores to retrieve attributes,

discovering one or more form elements on the plurality of remote domains through discovering the use of at least one of a HTTP basic, HTTP Digest, NTLM, and SSL handler, and

returning at least a portion of an authentication configuration from the plurality of remote domains;

communicating with a plurality of authentication subsystems to authenticate a user to the plurality of resources through the use of a keychain module, the keychain module being adapted to construct at least one authentication configuration for the plurality of resources by,

communicating with the plurality of resources to construct name/value pairs,

removing differences between the plurality of protocols and plurality of APIs,

attempting a login on the plurality of remote domains, and at least one of,

identifying in a response from the plurality of remote domains what constitutes a failed login,

receiving a 401 “

Unauthorized”

code,

turning off use of at least one of a HTTP basic and a HTTP Digest authentication handler,

cycling through Spring registered authentication handlers and receiving an authentication configuration from at least one of the Spring registered authentication handlers, and

saving to the authentication configuration a successful log-in ceremony with the plurality of remote domains;

utilizing the attributes to evaluate the access policies to determine whether or not the user should be granted access to the resources; and

enabling a single sign-on with the plurality of remote domains.

10. The method of claim 7, including:

automatically generating, before the user requests access to the resources, entitlements that define resources to which the user is granted access.

11. The method of claim 7, including:

storing the access policies in a policy cache; and

continuing, in the event communication with the remote location is disrupted, to evaluate the access policies in the policy cache to determine whether or not the user should be granted access to the resources.

8. The method of clam 7, including receiving a request to access one of the resources as a proxy address that differs from the actual address of the resource.

9. The method of clam 8, further comprising:

dropping cookies for the at least one of the plurality of remote domains so that subsequent requests for the at least one of the plurality of remote domains are,

comprised of a one-time validation token, and

recognized as coming from the user, even if the user requests resources from different domains.

12. An apparatus for managing access to a plurality of resources, comprising:

a request interceptor configured to receive requests from users to access the plurality of resources;

an authentication connector configured to communicate with at least one authentication subsystem to authenticate a user to at least one of the plurality of resources through the use of a keychain module, the keychain module being adapted to construct an authentication configuration for the at least one of the plurality of resources by,

discovering one or more form elements on the plurality of remote domains wherein

discovering the use of at least one of a HTTP basic, HTTP Digest, NTLM, and SSL handler;

enabling a single sign-on with a plurality of remote domains comprises,

receiving a 401 “

Unauthorized”

code,

turning off the use of the at least one of HTTP basic and HTTP Digest authentication handlers; and

cycling through Spring registered authentication handlers and receiving an authentication configuration from at least one of the Spring registered authentication handlers;

returning an authentication configuration from the plurality of remote domains;

removing differences between at least one of the plurality of protocols and a plurality of APIs;

communicating with the at least one of the plurality of resources to construct name/value pairs, and

attempting a login on at least one of a plurality of remote domains, and at least one of,

identifying in a response from the at least one of the plurality of resources what constitutes a failed login, and

saving to the authentication configuration a successful log-in ceremony with the at least one of the plurality of remote domains;

a session component configured to initiate an SSO session by triggering authentication with the authentication connector;

a user store connector component configured to connect to one or more user stores so as to enable attributes for the user to retrieved;

a policy cache, the policy cache adapted to store a plurality of access policies; and

a policy engine configured to retrieve attributes from the user store connector corresponding to the user and use the attributes to evaluate the access policies to determine whether or not the user should be granted access to the resources.

13. The apparatus of claim 12, wherein the request interceptor configured to receive requests from users as proxy addresses that differ from the actual addresses of the resources.

14. The apparatus of claim 13, including a at least one cookietrap component that drops cookies for at least one of a plurality of remote domains so that subsequent requests domains for the at least one of a plurality of resources comprise a one-time validation token, and even if the users request resources from different domains, to allow sessions with the resources to span multiple domains.

15. The apparatus of claim 14, including:

a credential data store including, for each of a plurality of users, a plurality of credential data sets, each credential data set corresponding to a resource;

a plurality of adaptors, each adaptor is configured to receive one of the credential sets from the credential data store and, utilizing information from the credential set, communicate with the resource corresponding to the received credential set to authenticate the user to the resource;

an SSO engine configured, responsive to a request from a user, to access a resource and detect whether the user was previously authenticated within a time window, and if not, authenticate the users with the authentication connector, and if the user was previously authenticated, the SSO engine is configured to retrieve the credential set corresponding to the resource requested by the user and provide the credential set to the adaptor to enable the adaptor authenticate the user to the resource without requiring the user to perform additional authentication for that resource.

16. The apparatus of claim 12, including:

a controller connector configured to receive updates from a remote controller; and

an update handler that is configured to install the updates without disrupting communication with a plurality of resources.

17. The apparatus of claim 16, wherein the controller connector is configured to receive the plurality of access policies from a remote location.

18. The apparatus of claim 17, wherein the request interceptor, the authentication connector, the session component, the user store connector, the policy cache, and the policy engine continue to operate even when the controller connector is disconnected from the remote location.

19. The apparatus of claim 12, including:

a session state store configured to store SSO session data, states of resources session, and entitlements.