Securing communication over a network using client integrity verification

• US 9,942,274 B2
• Filed: 01/25/2016
• Issued: 04/10/2018
• Est. Priority Date: 02/01/2013
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Vidder, Inc. (Verizon Communications Inc.)
• Inventors: Islam, Junaid, Bilger, Brent, Schroeder, Ted
• Primary Examiner(s): Wang, Harris C
• Application Number:
  US15/005,452
• Publication Number:
  US 20160142415A1
• Time in Patent Office: 806 Days
• Field of Search: 726 4
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 2101/69 using geographic information, e.g. room number
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/562 Brokering proxy services

Abstract

A method for protecting application servers from network-based attacks and verifying the security posture of end client systems is disclosed. A trust broker system receives a request from a user agent associated with a client system remote from the trust broker to connect to applications and resources associated with the trust broker. The trust broker system verifies the integrity of the client system and verifies the identity of a user of the client system. The trust broker system then determines the access level permitted to the identified user and based on the access level. The trust broker system establishes a connection with the user agent and transmits session information to the server system. The trust broker system sends the user agent connection information, wherein the connection information enables the requesting user agent to connect to the requested server system.

Claims

1. A method for securing communication over a network, comprising:

at a trust broker system having one or more processors and memory storing one or more programs for execution by the one or more processors;

receiving a request from a client system remote from the trust broker system to connect to network applications and resources hosted by a server system, wherein the client system is a stateless client device that retains no network access information from a prior online session;

in response to the request to connect with the server system;

determining which network applications and resources a user associated with the client system is authorized to access;

in accordance with a determination that the user is authorized to access the requested network applications and resources;

establishing a connection with the client system;

transmitting, to the server system, session information that identifies the client system; and

sending the network access information to the client system, wherein the network access information enables the requesting client system to connect to the requested server system for one session, and enables the client system to download, from the server system, instructions for performing one or more tasks associated with the requested network data and services, wherein the downloaded instructions are not permanently stored on the client system and are only retained for the one session.

2. The method of claim 1, further comprising verifying an identity of the client system, including determining an identity of the user based on a unique user identifier received from the client system.

3. The method of claim 2, wherein verifying the identity of the client system includes:

receiving a generated system fingerprint for the client system; and

determining, based on the generated system fingerprint, a specific device that is currently executing a user agent computer application, wherein the request to connect to network applications and resources is received from the user agent computer application.

4. The method of claim 3, wherein the trust broker system includes a user device database that associates specific users with devices, and wherein verifying the identity of the client system further includes:

determining whether the identified user is associated with the determined specific device currently executing the user agent computer application.

5. The method of claim 2, wherein verifying the identity of the client system includes:

determining a geographic location of the client system;

retrieving a list of authorized regions within which the client system is authorized to operate; and

determining whether the list of authorized regions includes the geographic location of the client system,

wherein sending the user agent the network access information is in accordance with a determination that the list of authorized regions includes the geographic location of the client system.

6. The method of claim 1, wherein the server system and the trust broker system are components in a secure network.

7. The method of claim 1, further including:

identifying a first virtual domain of a plurality of virtual domains, wherein;

each virtual domain provides a respective logical set of network applications and resources, distinct from other virtual domains, wherein a respective logical set of network applications and information corresponds to a subset of network resources provided by the server system, and

the first virtual domain provides the requested network applications and services;

wherein determining which network applications and resources the identified user is authorized to access includes;

retrieving stored permissions of the user associated with the client system; and

determining, based on the stored permissions associated with the user, that the user is permitted to access the first virtual domain.

8. An electronic device for securing communication over a network, wherein the electronic device comprises a trust broker system, comprising:

one or more processors;

memory storing one or more programs to be executed by the one or more processors;

the one or more programs comprising instructions for;

receiving a request from a client system remote from the trust broker system to connect to network applications and resources hosted by a server system, wherein the client system is a stateless client device that retains no network access information from a prior online session;

in response to the request to connect with the server system;

determining which network applications and resources a user associated with the client system is authorized to access;

in accordance with a determination that the user is authorized to access the requested network applications and resources;

establishing a connection with the client system;

transmitting, to the server system, session information that identifies the client system; and

sending the network access information to the client system, wherein the network access information enables the requesting client system to connect to the requested server system for one session, and enables the client system to download, from the server system, instructions for performing one or more tasks associated with the requested network data and services, wherein the downloaded instructions are not permanently stored on the client system and are only retained for the one session.

9. The device of claim 8, wherein the instructions for verifying the identity of the user of a client system further include instructions for verifying an identity of the client system, including determining an identity of the user based on a unique user identifier received from the client system.

10. The device of claim 9, wherein the instructions for verifying the identity of the client system further include instructions for:

receiving a generated system fingerprint for the client system; and

determining, based on the generated system fingerprint, a specific device that is currently executing a user agent computer application, wherein the request to connect to network applications and resources is received from the user agent computer application.

11. The device of claim 10, wherein the trust broker system includes a user device database that associates specific users with devices, and wherein the instructions for verifying the identity of the client system further include instructions for:

determining whether the identified user is associated with the determined specific device currently executing the user agent computer application.

12. The device of claim 9, wherein the instructions for verifying the identity of the client system include instructions for:

determining a geographic location of the client system;

retrieving a list of authorized regions within which the client system is authorized to operate; and

determining whether the list of authorized regions includes the geographic location of the client system,

wherein sending the user agent the network access information is in accordance with a determination that the list of authorized regions includes the geographic location of the client system.

13. The device of claim 8, wherein the server system and the trust broker system are components in a secure network.

14. The device of claim 8, further including instructions for:

identifying a first virtual domain of a plurality of virtual domains, wherein;

each virtual domain provides a respective logical set of network applications and resources, distinct from other virtual domains, wherein a respective logical set of network applications and information corresponds to a subset of network resources provided by the server system, and

the first virtual domain provides the requested network applications and services;

wherein determining which network applications and resources the identified user is authorized to access includes;

retrieving stored permissions of the user associated with the client system; and

determining, based on the stored permissions associated with the user, that the user is permitted to access the first virtual domain.

15. A non-transitory computer readable storage medium storing one or more programs configured for execution by an electronic device, wherein the electronic device comprises a trust broker system, the one or more programs comprising instructions for:

receiving a request from a client system remote from the trust broker system to connect to network applications and resources hosted by a server system, wherein the client system is a stateless client device that retains no network access information from a prior online session;

in response to the request to connect with the server system;

determining which network applications and resources a user associated with the client system is authorized to access;

in accordance with a determination that the user is authorized to access the requested network applications and resources;

establishing a connection with the client system;

transmitting, to the server system, session information that identifies the client system; and

sending the network access information to the client system, wherein the network access information enables the requesting client system to connect to the requested server system for one session, and enables the client system to download, from the server system, instructions for performing one or more tasks associated with the requested network data and services, wherein the downloaded instructions are not permanently stored on the client system and are only retained for the one session.

16. The non-transitory computer readable storage medium of claim 15, wherein the instructions for verifying the identity of the user of a client system further include instructions for verifying an identity of the client system, including determining an identity of the user based on a unique user identifier received from the client system.

17. The non-transitory computer readable storage medium of claim 16, wherein the instructions for verifying the identity of the client system further include instructions for:

receiving a generated system fingerprint for the client system; and

determining, based on the generated system fingerprint, a specific device that is currently executing a user agent computer application, wherein the request to connect to network applications and resources is received from the user agent computer application.

18. The non-transitory computer readable storage medium of claim 17, wherein the trust broker system includes a user device database that associates specific users with devices, and wherein the instructions for verifying the identity of the client system further include instructions for:

determining whether the identified user is associated with the determined specific device currently executing the user agent computer application.

19. The non-transitory computer readable storage medium of claim 16, wherein the instructions for verifying the identity of the client system include instructions for:

determining a geographic location of the client system;

retrieving a list of authorized regions within which the client system is authorized to operate; and

determining whether the list of authorized regions includes the geographic location of the client system,

wherein sending the user agent the network access information is in accordance with a determination that the list of authorized regions includes the geographic location of the client system.

20. The non-transitory computer readable storage medium of claim 16, further including instructions for:

identifying a first virtual domain of a plurality of virtual domains, wherein;

each virtual domain provides a respective logical set of network applications and resources, distinct from other virtual domains, wherein a respective logical set of network applications and information corresponds to a subset of network resources provided by the server system, and

the first virtual domain provides the requested network applications and services;

wherein determining which network applications and resources the identified user is authorized to access includes;

retrieving stored permissions of the user associated with the client system; and

determining, based on the stored permissions associated with the user, that the user is permitted to access the first virtual domain.