SYSTEM, METHOD, AND APPARATUS FOR MANAGING ACCESS TO RESOURCES ACROSS A NETWORK

• US 20090249440A1
• Filed: 03/25/2009
• Published: 10/01/2009
• Est. Priority Date: 03/30/2008
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Symplified Incorporated
• Inventors: Royer, Coby, Olden, Eric, Wallingford, Joseph H. III, Berg, Keshava, Platt, Darren C.
• Granted Patent: US 8,418,238 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system, method and apparatus for managing access across a plurality of applications is disclosed. The system may include a user store connector configured to connect to one or more user stores to retrieve attributes; an authentication connector configured to communicate with at least one authentication subsystem to authenticate a user; a policy engine configured to retrieve attributes from the user store connector corresponding to a user and use the attributes to evaluate access policies, if any, which are defined for protection of resources, to determine whether or not the user should be granted access to the resources; an admin component that is configured to enable the access policies to be defined relative to attributes and the resources; and a policy store configured to store the access policies.

Claims

1. A system for managing access across a plurality of resources, comprising:

a user store connector configured to connect to one or more user stores to retrieve attributes;

an authentication connector configured to communicate with at least one authentication subsystem to authenticate a user;

a policy engine configured to retrieve attributes from the user store connector corresponding to the user and use the attributes to evaluate access policies, which are defined for protection of resources, to determine whether or not the user should be granted access to the resources;

an admin component that is configured to enable the access policies to be defined relative to attributes and the resources; and

a policy store configured to store the access policies.

2. The system of claim 1, including a request interceptor configured to receive requests from users as proxy addresses that differ from the actual addresses of the resources.

3. The system of claim 2, including a cookietrap component that drops cookies for multiple domains so that subsequent requests are recognized as coming from the users, even if the users request resources from different domains, so as to allow sessions with the resources to span multiple domains.

4. The system of claim 1, wherein the admin component is remotely located from the policy engine and coupled to the policy engine via the Internet.

5. The system of claim 1, including an update handler configured to install updates of the user store connector, the authentication connector, and the policy engine.

6. The system of claim 1, including a request interceptor configured to bridge communications between the user and the resources, inspect the communications, and block the communications if the communications are denied by one or more of the access policies.

7. A method for managing access across a plurality of resources comprising:

defining access policies relative to attributes and resources;

receiving, from a remote location, the access policies;

communicating with at least one authentication subsystem to authenticate a user;

connecting to one or more user stores to retrieve attributes; and

utilizing the attributes to evaluate the access policies to determine whether or not the user should be granted access to the resources.

10. The method of claim 7, including:

generating, before the user requests access to the resources, entitlements that define resources to which the user is granted access.

11. The method of claim 7, wherein utilizing the attributes to evaluate the access policies to determine whether or not the user should be granted access to the resources is carried out in real time connection with receipt of a user request to access one of the resources.

12. The method of claim 7, including:

storing the access policies in a policy cache; and

continuing, in the event communication with the remote location is disrupted, to evaluate the access policies in the policy cache to determine whether or not the user should be granted access to the resources.

8. The method of clam 7, including receiving a request to access one of the resources as a proxy address that differs from the actual address of the resource.

9. The method of clam 8, including dropping cookies for multiple domains so that subsequent requests are recognized as coming from the user, even if the user requests resources from different domains.

13. An apparatus for managing access to a plurality of resources, comprising:

a request interceptor configured to receive requests from users to access the plurality of resources;

an authentication connector configured to communicate with at least one authentication subsystem to authenticate a user;

a session component configured to initiate an SSO session by triggering authentication with the authentication connector;

a user store connector component configured to connect to one or more user stores so as to enable attributes for the user to retrieved;

a policy cache, the policy cache adapted to store a plurality of access policies; and

a policy engine configured to retrieve attributes from the user store connector corresponding to the user and use the attributes to evaluate the access policies to determine whether or not the user should be granted access to the resources.

14. The apparatus of claim 13, wherein the request interceptor configured to receive requests from users as proxy addresses that differ from the actual addresses of the resources.

15. The apparatus of claim 14, including a cookietrap component that drops cookies for multiple domains so that subsequent requests are recognized as coming from the users, even if the users request resources from different domains, so as to allow sessions with the resources to span multiple domains.

16. The apparatus of claim 15, including:

a credential data store including, for each of a plurality of users, a plurality of credential data sets, each credential data set corresponding to a resource;

a plurality of adaptors, each adaptor is configured to receive one of the credential sets from the credential data store and, utilizing information from the credential set, communicate with the resource corresponding to the received credential set to authenticate the user to the resource;

an SSO engine configured, responsive to a request from a user, to access a resource and detect whether the user was previously authenticated within a time window, and if not, authenticate the users with the authentication connector, and if the user was previously authenticated, the SSO engine is configured to retrieve the credential set corresponding to the resource requested by the user and provide the credential set to the adaptor to enable the adaptor authenticate the user to the resource without requiring the user to perform additional authentication for that resource.

17. The apparatus of claim 13, including:

a controller connector configured to receive updates from a remote controller; and

an update handler that is configured to install the updates while continuing to manage access to a plurality of resources.

18. The apparatus of claim 17, wherein the controller connector is configured to receive the plurality of access policies from a remote location.

19. The apparatus of claim 18, wherein the request interceptor, the authentication connector, the session component, the user store connector, the policy cache, and the policy engine continue to operate even when the controller connector is disconnected from the remote location.

20. The apparatus of claim 13, including:

a session state store configured to store SSO session, resources-session-state, and entitlements.