Authentication in a globally distributed infrastructure for secure content management

• US 20090178109A1
• Filed: 08/18/2008
• Published: 07/09/2009
• Est. Priority Date: 01/08/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ananiev, Oleg, Wohlfert, John, Teplitsky, Alik, Nice, Nir, Finkelstein, Amit
• Granted Patent: US 8,935,742 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: G06Q 30/0204 Market segmentation
• CPC Class Codes: G06Q 30/0215 Including financial accounts
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Secure content management is enabled as a cloud-based service through which security protection and policy enforcement may be implemented for both on-premise network users and roaming users. The global SCM service integrates the security functionalities—such as anti-virus, spyware, and phishing protection, firewall, intrusion detection, centralized management, and the like—that are typically provided by enterprise network SCM appliance hardware or servers into a cloud-based service that users reach via Internet-based points-of-presence (“POPs”). The POPs are configured with forward proxy servers, and in some implementations, caching and network acceleration components, and coupled to hubs which provide configuration management and identity management services such as active directory services.

Claims

1. A method for providing an SCM service to users of IT devices, the method comprising the steps of:

utilizing an infrastructure that is accessible by the users over an Internet connection, the infrastructure including a plurality of POPs, each POP in the plurality including at least a forward proxy server for forwarding traffic from the IT devices to resource servers that are accessible on the Internet;

authenticating the users of the IT devices to the SCM service; and

redirecting a user to a co-located POP, a POP being co-located when a set of parameters is optimized including network latency compared with non-co-located POPs and localization of a user experience may be implemented.

2. The method of claim 1 including a further step of securing user interaction with the SCM service according to predefined security policies, at least a subset of such security policies being part of security policies pertaining to an enterprise or business.

3. The method of claim 1 including a further step of securing user interaction with the SCM service according to predefined security policies, at least a subset of such security policies being part of security policies pertaining to a consumer or household.

4. The method of claim 1 including a further step of managing the forward proxy servers in the POPs using an enterprise management subsystem located in a hub that is coupled to one or more POPs.

5. The method of claim 1 in which the authenticating is performed with user credentials which are utilized when the user authenticates to a local network.

6. The method of claim 1 including a further step of implementing a client on an IT device, the client being arranged as a local forward proxy for performing authentication to the SCM service.

7. The method of claim 1 in which the authenticating is performed using one of integrated Windows authentication, federated identity authentication, Live ID authentication, two-factor authentication, forms authentication, Passport authentication, custom authentication, or Radius authentication.

8. The method of claim 1 including a further step of initiating authentication using one of HTTP proxy authentication, IPSec authentication, or VPN authentication.

9. A method of providing identity management in an SCM service, the method comprising the steps of:

utilizing an infrastructure to support the SCM service that is accessible by users over an Internet connection, the infrastructure including a plurality of POPs, each POP in the plurality including at least a forward proxy server for forwarding traffic from IT devices to resource servers that are accessible on the Internet, and further including a hub operatively coupled to one or more POPs, the hub providing i) configuration management for forward proxy servers, and ii) identity management;

receiving authentication credentials associated with users of the IT devices; and

performing authentication of a user seeking access to the SCM service in accordance with the received authentication credentials.

10. The method of claim 9 in which the authentication credentials are verified using a one-way or two-way trust.

11. The method of claim 10 including a further step of establishing a pipeline over which the one-way or two-way trust is operated.

12. The method of claim 11 in which the pipeline is implemented using VPN.

13. The method of claim 11 in which the pipeline is implemented using a secure network connection using one of MPLS, IPSec, or IPv6 global addressing.

14. The method of claim 9 including a further step of utilizing the authenticating as part of a single-sign-on procedure.

15. The method of claim 14 in which the single-sign-on is supported by one of Windows authentication.

16. The method of claim 14 in which the single-sign-on is implemented using federated access.

17. A method for authenticating users to an SCM service, the method comprising the steps of:

providing the SCM service using a cloud-based distributed infrastructure including a plurality of POPs, each POP including a forward proxy through which users access and interact with resources available via an Internet connection; and

authenticating the users to the SCM service using pre-existing credentials supported by an identity metasystem.

18. The method of claim 17 including a further step of performing network optimization in a POP, the network optimization including one of caching, HTTP compression, or QoS enforcement.

19. The method of claim 17 including a further step of redirecting a user to a co-located POP, a POP being co-located when network latency is minimized compared with non-co-located POPs and localization of a user experience may be implemented.

20. The method of claim 19 in which the localization is performed with at least one of language, time zone, currency, or character set.