Relay proxy providing secure connectivity in a controlled network environment

• US 9,736,119 B2
• Filed: 04/07/2014
• Issued: 08/15/2017
• Est. Priority Date: 04/07/2014
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Monk, Jason, Borggaard, Geoffrey Allen
• Primary Examiner(s): BAYOU, YONAS A
• Application Number:
  US14/247,179
• Publication Number:
  US 20150288661A1
• Time in Patent Office: 1,226 Days
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A computer system for accessing remote content stored outside of a local network from within the local network comprises a relay proxy and a plurality of applications. The relay proxy receives a first request from a first application and a second request from a second application, the first and second requests identifying first and second remote content items respectively. The relay proxy forwards the first and second requests to a proxy server that manages network traffic entering and leaving the local network. The relay proxy receives responses to the first and second requests, with the response to the first request including the first remote content item and the response to the second request including the second remote content item. The relay proxy forwards the first and second remote content items to the first and second applications respectively.

Claims

1. A user device for accessing remote content stored outside a network from within the network, the user device comprising:

a relay proxy, the relay proxy configured to;

receive sign in information associated with a user,

retrieve remote content items via a proxy server, the proxy server separate from the user device, the proxy server managing network traffic entering and leaving the network,

examine requests from a plurality of applications for the remote content items to determine whether required authentication credentials are present,

identify authentication credentials based on the sign in information, and

automatically insert the authentication credentials in the requests responsive to determining that the authentication credentials are required to retrieve the remote content items; and

the plurality of applications, each being communicatively connected to the relay proxy and each further configured to send a request for a remote content item to the relay proxy and retrieve the remote content item therefrom.

2. The user device of claim 1, wherein the proxy server is configured to process content requests received from the relay proxy and block content requests received directly from the plurality of applications.

3. The user device of claim 1, wherein the relay proxy is further configured to periodically provide a prompt to the user to supply the sign in information.

4. The user device of claim 1, wherein the relay proxy is configured to block a particular request for an unauthorized remote content item responsive to an indication that accessing the unauthorized remote content item from within the network is not permitted.

5. The user device of claim 4, wherein the indication comprises a resource server that hosts the remote content item appearing on a blacklist, the blacklist identifying resource servers to which access is not permitted from within the network.

6. The user device of claim 4, wherein the indication comprises a resource server that hosts the remote content item not being included on a whitelist, the whitelist identifying resource servers to which access is permitted from within the network.

7. The user device of claim 1, wherein the requests from the plurality of applications for the remote content items are examined after receiving the sign in information.

8. The user device of claim 1,

wherein the relay proxy is further configured to determine, based on the sign in information, the user from a plurality of users, and

wherein identifying the authentication credentials includes selecting the authentication credentials corresponding to the determined user.

9. A method of accessing remote content stored outside a network from within the network, the method comprising:

receiving sign in information associated with a user;

receiving, at a relay proxy executing on a user device, a first request from a first application executing on the user device and a second request from a second application executing on the user device, the first request identifying a first remote content item and the second request identifying a second remote content item;

examining the first request from the first application and the second request from the second application to determine whether required authentication credentials are present to retrieve the first remote content item and the second remote content item;

identifying authentication credentials based on the sign in information;

automatically inserting the authentication credentials into one of the first request and the second request lacking the authentication credentials;

forwarding the first request and the second request to a proxy server that manages network traffic entering and leaving the network, the proxy server separate from the user device;

receiving a first response to the first request and a second response to the second request, the first response including the first remote content item and the second response including the second remote content item; and

forwarding the first remote content item to the first application and the second remote content item to the second application.

10. The method of claim 9, wherein the proxy server is configured to process content requests received from the relay proxy and block content requests received directly from the first or second application.

11. The method of claim 9, further comprising:

periodically providing a prompt to the user to supply the sign in information.

12. The method of claim 9, further comprising:

receiving a third request from a third application installed on the user device, the third request identifying a third remote content item;

blocking the third request; and

sending a notification to the third application that the third request has been blocked.

13. The method of claim 12, wherein the relay proxy blocks the third request responsive to a resource server that hosts the third remote content item appearing on a blacklist, the blacklist identifying resource servers to which access is not permitted from within the network.

14. The method of claim 12, wherein the relay proxy blocks the third request responsive to the third remote content item not being included on a whitelist, the whitelist identifying content items to which access is permitted from within the network.

15. The method of claim 9, wherein the first request from the first application and the second request from the second application are examined after receiving the sign in information.

16. A non-transitory computer-readable medium storing executable computer program code for accessing remote content stored outside a network from within the network, the computer program code comprising instructions for:

receiving sign in information associated with a user;

receiving, at a relay proxy executing on a user device, a first request from a first application executing on the user device and a second request from a second application executing on the user device, the first request identifying a first remote content item and the second request identifying a second remote content item;

examining the first request from the first application and the second request from the second application to determine whether required authentication credentials are present to retrieve the first remote content item and the second remote content item;

identifying authentication credentials based on the sign in information;

automatically inserting the authentication credentials into one of the first request and the second request lacking the authentication credentials;

forwarding the first request to be delivered to a first resource server through a proxy server, the first resource server hosting the first remote content item, the proxy server managing network traffic entering and leaving the network, the proxy server separate from the user device;

forwarding the second request to be delivered to a second resource server through the proxy server, the second resource server hosting the second remote content item;

receiving a first response to the first request and a second response to the second request, the first response including the first remote content item and the second response including the second remote content item; and

providing the first remote content item to the first application and the second remote content item to the second application.

17. The non-transitory computer-readable medium of claim 16, wherein the computer program code further comprises instructions for:

periodically providing a prompt to the user to supply the sign in information.

18. The non-transitory computer-readable medium of claim 16, wherein the computer program code further comprises instructions for:

receiving a third request from a third application installed on the user device, the third request identifying a third remote content item;

blocking the third request; and

sending a notification to the third application that the third request has been blocked.

19. The non-transitory computer-readable medium of claim 18, wherein the relay proxy blocks the third request responsive to a resource server that hosts the third remote content item appearing on a blacklist, the blacklist identifying resource servers to which access is not permitted from within the network.

20. The non-transitory computer-readable medium of claim 18, wherein the relay proxy blocks the third request responsive to the third remote content item not being included on a whitelist, the whitelist identifying content items to which access is permitted from within the network.

21. The non-transitory computer-readable medium of claim 16, wherein the first request from the first application and the second request from the second application are examined after receiving the sign in information.