Resource protection on un-trusted devices
First Claim
1. A client device, comprising:
- one or more hardware processors; and
one or more computer-readable media having stored thereon computer-executable instructions that are executable by the one or more processors, and that configure the client device to authenticate to an enterprise network, including computer-executable instructions that configure the client device to perform at least the following;
obtain a secondary credential, the secondary credential being associated with a primary credential that is usable from within the enterprise network to directly gain access to a service of the enterprise network, the secondary credential having been generated within the enterprise network as being usable by a particular set of client devices that includes the client device to indirectly gain access to the service through the primary credential and as being unusable by any other client devices not included in the particular set of client devices to gain access to the service;
while outside of the enterprise network, request access to the service, including sending the secondary credential to an enterprise gateway of the enterprise network; and
based at least on sending the secondary credential to the enterprise gateway, receive a resource from the service, the resource being received from the service based at least on the enterprise gateway having forwarded the primary credential to the service after verifying that the secondary credential is valid and that the client device is in the particular set of client devices.
1 Assignment
0 Petitions
Accused Products
Abstract
Authenticating a client device to a service to allow the client device to access a resource provided by the service. A client device obtains a secondary credential that is associated with a primary credential and that is generated as being usable by a particular set of devices including the client device to indirectly gain access to the service through the primary credential. While outside of an enterprise network, the client device requests access to the service, including sending the secondary credential to an enterprise gateway. Based at least on sending the secondary credential to the enterprise gateway, the client device receives a resource from the service. The resource is received based at least on the enterprise gateway having forwarded the primary credential to the service after verifying that the secondary credential is valid and that the client device is in the particular set of client devices.
-
Citations
20 Claims
-
1. A client device, comprising:
-
one or more hardware processors; and one or more computer-readable media having stored thereon computer-executable instructions that are executable by the one or more processors, and that configure the client device to authenticate to an enterprise network, including computer-executable instructions that configure the client device to perform at least the following; obtain a secondary credential, the secondary credential being associated with a primary credential that is usable from within the enterprise network to directly gain access to a service of the enterprise network, the secondary credential having been generated within the enterprise network as being usable by a particular set of client devices that includes the client device to indirectly gain access to the service through the primary credential and as being unusable by any other client devices not included in the particular set of client devices to gain access to the service; while outside of the enterprise network, request access to the service, including sending the secondary credential to an enterprise gateway of the enterprise network; and based at least on sending the secondary credential to the enterprise gateway, receive a resource from the service, the resource being received from the service based at least on the enterprise gateway having forwarded the primary credential to the service after verifying that the secondary credential is valid and that the client device is in the particular set of client devices. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A system, comprising:
-
an enterprise gateway of an enterprise network, which includes one or more first hardware processors and one or more first computer-readable media storing first computer-executable instructions that configure the enterprise gateway to perform at least the following; receive a secondary credential from a client device that is outside of the enterprise network, the secondary credential being associated with a primary credential that is usable from within the enterprise network to directly gain access to a service of the enterprise network, the secondary credential having been generated within the enterprise network as being usable by a particular set of client devices that includes the client device to indirectly gain access to the service through the primary credential and as being unusable by any other client devices not included in the particular set of client devices to gain access to the service; verify that the secondary credential is valid; verify that the client device is in the particular set of client devices; and when the secondary credential is valid and when the client device is in the particular set of client devices, forward the primary credential to the service; and the client device, which includes one or more second processors and one or more second computer-readable media storing second computer-executable instructions that configure the client device to perform at least the following; obtain the secondary credential; while outside of the enterprise network, request access to the service, including sending the secondary credential to the enterprise gateway; and based at least on sending the secondary credential to the enterprise gateway, receive a resource from the service. - View Dependent Claims (11, 12, 13, 14, 15, 16, 17, 18)
-
-
19. A method, implemented at a client device that includes one or more processors, for authenticating to an enterprise network, the method comprising:
-
obtaining a secondary credential, wherein the secondary credential is associated with a primary credential that is usable from within the enterprise network to directly gain access to a service of the enterprise network, and wherein the secondary credential was been generated within the enterprise network as being usable by a particular set of client devices that includes the client device to indirectly gain access to the service through the primary credential and as being unusable by any other client devices not included in the particular set of client devices to gain access to the service; while outside of the enterprise network, requesting access to the service, including sending the secondary credential to an enterprise gateway of the enterprise network; and based at least on sending the secondary credential to the enterprise gateway, receiving a resource from the service, wherein the resource is received from the service based at least on the enterprise gateway having forwarded the primary credential to the service after verifying that the secondary credential is valid and that the client device is in the particular set of client devices. - View Dependent Claims (20)
-
Specification