Patent Grant
9483627
Embodiments of the present disclosure relate to mobile client authentication and, more particularly, to a technique of abstracting credentials for mobile client authentication.
A business, corporation, and/or company, is commonly referred to as an Enterprise. Cloud computing is generally becoming the platform of choice for Enterprises that want to reduce operating expenses and be able to scale resources rapidly. “Clouds” may be provided by different cloud providers to provide Enterprises access of computing resources over a computer network. Clouds can provide Software-as-a-Service (SaaS), sometimes referred to as “on-demand software,” to various Enterprises. SaaS is a software delivery model in which software and its associated data are hosted centrally, typically in a cloud, and are accessed by user using, for example, a web browser, over the Internet. SaaS has become a common delivery model for most business applications, such as customer relationship management (CRM). Security is becoming a very important factor in a SaaS environment. Mobile devices typically embed user credentials (e.g., user identifier, password), for example, for accessing a cloud with the mobile device. The mobile devices may not have adequate security measures to prevent the user credentials from being captured and misappropriated.
In one embodiment, a system for abstracting credentials for mobile client authentication is described. An exemplary system may include a memory and a processor that is coupled to the memory. In one embodiment, the system receives an authentication request from a user device for access to a web application hosted in a cloud. The system determines that the authentication request is a candidate for modification based on initial user credentials in the authentication request and modifies the authentication request to include replacement user credentials that correspond to the initial user credentials. The system transmits the modified authentication request to the web application in the cloud. The web application determines whether the modified authentication request is valid based on the replacement user credentials.
In one embodiment, the initial user credentials are Virtual Private Network (VPN) credentials. In one embodiment, the system modifies the authentication request by locating the replacement user credentials that correspond to the initial user credentials in a data store that is coupled to the system and replaces the initial user credentials in the authentication request with the corresponding replacement user credentials. In one embodiment, the replacement user credentials are a different format from the initial user credentials. In one embodiment, the replacement user credentials are a same format as the initial user credentials. In one embodiment, the system receives the authentication request from the user device via a VPN. In one embodiment, the system receives the authentication request from the user device by intercepting the authentication based on a VPN configuration of the user device.
In additional embodiments, methods for performing the operations of the above described embodiments are also implemented. Additionally, in embodiments of the present disclosure, a non-transitory computer readable storage medium stores methods for performing the operations of the above described embodiments.
Various embodiments of the present disclosure will be understood more fully from the detailed description given below and from the accompanying drawings of various embodiments of the disclosure.
Embodiments of the invention are directed to a method and system for abstracting credentials for mobile client authentication. A computing system receives an authentication request from a user device for access to a web application hosted in a cloud and determines that the authentication request is a candidate for modification based on initial user credentials in the authentication request. The computing system modifies the authentication request to include replacement user credentials that correspond to the initial user credentials and transmits the modified authentication request to the web application in the cloud. The web application determines whether the modified authentication request is valid based on the replacement user credentials.
Embodiments of the invention provide protection of user credentials when users access data at a cloud using a mobile device. Embodiments provide an abstraction layer to abstract the user credentials embedded in a mobile device by replacing the user credentials at a proxy.
Wi-Fi is a technology that allows an electronic device to exchange data wirelessly over a network. A user device 102 can be a device that can use Wi-Fi to connect to a network resource, such as the Internet, via a wireless access point proxy 180. The user device 102 can be portable computing devices such as, and not limited to, laptop or tablet computers, cellular telephones (e.g., smartphones), personal digital assistants (PDAs), portable media players, netbooks, and the like. The user devices 102 can be non-portable computing devices such as, and not limited to, desktop computers, set-top boxes associated with a television, gaming consoles, and so on. The user devices 102 can be variously configured with different features to enable access to various web applications hosted by one or more web application server 130 in a cloud 150.
A wireless access point (WAP) proxy 180 allows the user device 102 to connect to a wired network using Wi-Fi, or related standards. The wireless access point proxy 180 can be hosted by any type of computing device including server computers, gateway computers, desktop computers, laptop computers, or similar computing device. The wireless access point proxy 180 can create a hotspot, which is a site that offers Internet access over a wireless local area network through the use of a router connected to a link to an Internet service provider. Hotspots typically use Wi-Fi technology. Hotspots may be found in hotels, airports, coffee shops, retailers, and various other public establishments throughout much of the developed world. The wireless access point proxy 180 may be provided by and maintained by a third party (e.g., hotels, airports, coffee shops, retailers, various other public establishments).
In one embodiment, a user 101 is authenticated with the WAP proxy 180 via credentials (e.g., user identifier, password) and a browser 190 on the user device 102. The user 101 can use the Wi-Fi connection established with the WAP proxy 180 to establish a Virtual Private Network (VPN) connection, for example to an Enterprise network. A VPN is a secure network that uses primarily public telecommunication infrastructures, such as the Internet, to provide remote offices or traveling users (e.g., user 101) an access to a central organizational network (e.g., Enterprise network).
User credentials (e.g., user identifier, password), for example, for accessing a cloud may be embedded in a user device 102. In one embodiment, the user device 102 is configured to use a VPN defined in a configuration profile 170 stored in the user device 102. In one embodiment, the configuration profile 170 is an XML file built using a user device 102 configuration utility. The configuration utility can contain, for example, user device 102 security policies and restrictions, VPN configuration information, Wi-Fi settings, email and calendar accounts, and authentication credentials, for example, that permit a user device 102 to work with Enterprise systems. The configuration utility can be executed to load settings and authorization information onto the user device 102. The configuration utility can be distributed via the web or email. For example, a user 101 may open an email attachment via the user device 102 or download the configuration profile 170 using, for example, the browser 190, on the user device 102, to trigger VPN user device configuration process to create the configuration profile 170 for the user device 102. A user 101 can authenticate with the VPN using VPN credentials (e.g., user identifier and password, certificate, etc.) to establish a VPN connection.
A cloud 150 can include one or more web application server computing systems 130 to host one or more web applications using cloud computing. The server computing systems 130 are controlled by a cloud service provider and not an enterprise. An enterprise as referred to herein can represent any organization including, for example, a business organization such as a corporation, an educational institution such as a college and university, etc. The cloud 150 can use a Software-as-a-Service (SaaS) model in which cloud computing companies provide software functionality, for example, to Enterprise users 101 on a subscription basis via the web application servers 130 in the cloud 150. Examples of web applications are business applications running on the cloud and including, for example, accounting, collaboration, customer relationship management (CRM), enterprise resource planning (ERP), invoicing, human resource management (HRM), content management (CM), and service desk management. The web application servers 130 can be hosted by any type of computing device including server computers, gateway computers, desktop computers, laptop computers, or similar computing device. The web applications can use HTTP or HTTPS connections.
The user 101 can send an authentication request to authenticate with a web application server 130 in the cloud 150 to access a cloud web application (e.g., CRM application). The user device 102 can run a cloud client 140 while connected to the VPN to send the authentication request. The cloud client 140 can use a cloud HTTP application program interface (API) to send an authentication request that includes the user credentials (e.g., username, password) of the user 101, for example, that are embedded in a user device 102, to the web application server 130 in the cloud 150. Examples of a cloud client 140 include, and are not limited to, a desktop web browser, a mobile device web browser, a mobile device application, a cloud connector plugin (e.g., cloud email connector plugin), a link (e.g., URL in an email), etc.
The user credentials in the authentication request are susceptible to being captured or misappropriated, for example, by a user (e.g., attacker). The network architecture 100 can include a credential abstraction proxy 110 to intercept the authentication request sent by the user device 102 and modify the authentication request to replace the initial user credentials (e.g., user identifier, password), which may have been captured and misappropriated, in the authentication request with replacement user credentials that are stored in a data store 120 that is coupled to the credential abstraction proxy 110. The credential abstraction proxy 110 can use the VPN to intercept the authentication request and rewrite the user credentials. The configuration profile 170 can cause the authentication request sent by the user device 102 to be routed to the credential abstraction proxy 110. In one embodiment, proxies and/or custom DNS solutions are part of the VPN DHCP profile of the user device 102. In one embodiment, additional client software can be included in a user device to cause the authorization request to be redirected to the credential abstraction proxy 110.
The credential abstraction proxy 110 can recognize and divert inbound authentication requests for specific web application domains in order to rewrite the inbound authentication request to abstract the user credentials in the request prior to passing the inbound authentication request to the web application server 130 in the cloud 150. The credential abstraction proxy 110 can be configured to communicate with a provisioning interface (e.g., SSO interface, Security Assertion Markup Language (SAML) interface) at the cloud 150. The credential abstraction proxy 110 may reside on a machine (e.g., server computers, desktop computers, etc.). The credential abstraction proxy 110 may be maintained by an organization (e.g., business, company). In another embodiment, the credential abstraction proxy 110 may be maintained by a third party.
The interception module 203 can intercept an authentication request sent by a user device (e.g., user device 102 in
The identification module 205 can determine whether the intercepted authentication request is a candidate for modification. The identification module 205 identifies whether the authentication request corresponds to requests of users that should have their user credentials re-written to provide a layer of abstraction. The identification module 205 can access abstraction user data 251 in a data store 250 that is coupled to the identification module 205 to determine whether the authentication request should be modified. The abstraction user data 251 can include user credentials associated with requests to be modified. The identification module 205 can search the abstract user data 251 for user credentials that match the user credentials in the intercepted authentication request. If there are no credentials in the abstraction user data 251 that match, the identification module 205 can transmit the unmodified authentication request to the web application server in the cloud. In one embodiment, the identification module 205 can apply a policy (e.g., data loss protection policy, access policy, etc.) prior to sending the unmodified authentication request to the web application server in the cloud.
The modification module 207 can modify an intercepted authentication request and transmit the modified authentication request to the web application server in the cloud. In one embodiment, the modification module 207 can apply a policy (e.g., data loss protection policy, access policy, etc.) prior to sending the modified authentication request to the web application server in the cloud. The modification module 207 can search replacement user credentials 253 stored in the data store 250 for user credentials that match the user credentials in the intercepted authentication request. The data store can store mapping data that maps initial user credentials (e.g., user credentials in an intercepted authentication request) to replacement user credentials. The replacement user credentials 253 can be user provided. The modification module 207 can replace the initial user credentials in the authentication request with the corresponding replacement user credentials 253 and transmit the modified request to the web application server in the cloud.
A data store 250 can be a persistent storage unit. A persistent storage unit can be a local storage unit or a remote storage unit. Persistent storage units can be a magnetic storage unit, optical storage unit, solid state storage unit, electronic storage units (main memory), or similar storage unit. Persistent storage units can be a monolithic device or a distributed set of devices. A ‘set’, as used herein, refers to any positive whole number of items.
At block 301, processing logic receives an authentication request from a user device for access to a cloud. The authentication request is a request to be authenticated by a web application server in a cloud for access to the web application hosted by the cloud. In one embodiment, processing logic intercepts the authentication request via the configuration of the user device to use a VPN defined in a configuration profile stored in the user device. In one embodiment, the authentication request is a HTTP authentication request. In another embodiment, the authentication request are parameters in a GET URL or a POST encoded form.
At block 303, processing logic locates initial user credentials in the authentication request. In one embodiment, the initial user credentials are VPN credentials. Examples of VPN credentials can include, and are not limited to, a user identifier and a password, and a client certificate. At block 305, processing logic determines whether the authentication request is a candidate for modification based on the initial user credentials in the request. Processing logic can search abstraction user data in a data store that is coupled to the credential abstraction module for credentials that match the initial user credentials in the request. If there are no credentials in the abstraction user data that match (block 305), processing logic transmits the authentication request to the cloud at block 311. If there are credentials in the abstraction user data that match (block 305), processing logic locates replacement user credentials that correspond to the initial user credentials in the data store at block 311. In one embodiment, the replacement user credentials are in the same format (e.g., first factor credentials, second factor credentials) as the initial user credentials. In another embodiment, the replacement user credentials are in a different format (e.g., first factor credentials, second factor credentials) than the initial user credentials. Examples of first factor credentials can include, and are not limited to, user identifier and passwords. Examples of second factor credentials, can include, and are not limited to, one-time password (OTP), a digital certificate (e.g., public key infrastructure (PKI) certificate), a fingerprint, etc.
At block 309, processing logic modifies the authentication request by replacing the initial user credentials in the request with the corresponding user credentials and transmits the modified request to the cloud at block 311. The cloud can validate the authentication request based on the replacement user credentials in the modified request.
The exemplary computer system 400 includes a processing device (processor) 402, a main memory 404 (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) such as synchronous DRAM (SDRAM), double data rate (DDR SDRAM), or DRAM (RDRAM), etc.), a static memory 406 (e.g., flash memory, static random access memory (SRAM), etc.), and a data storage device 418, which communicate with each other via a bus 730.
Processor 402 represents one or more general-purpose processing devices such as a microprocessor, central processing unit, or the like. More particularly, the processor 402 may be a complex instruction set computing (CISC) microprocessor, reduced instruction set computing (RISC) microprocessor, very long instruction word (VLIW) microprocessor, or a processor implementing other instruction sets or processors implementing a combination of instruction sets. The processor 402 may also be one or more special-purpose processing devices such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), network processor, or the like. The processor 402 is configured to execute instructions 422 for performing the operations and steps discussed herein.
The computer system 400 may further include a network interface device 408. The computer system 400 also may include a video display unit 410 (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)), an alphanumeric input device 412 (e.g., a keyboard), a cursor control device 414 (e.g., a mouse), and a signal generation device 416 (e.g., a speaker).
The data storage device 418 may include a computer-readable storage medium 428 on which is stored one or more sets of instructions 422 (e.g., software) embodying any one or more of the methodologies or functions described herein. The instructions 422 may also reside, completely or at least partially, within the main memory 404 and/or within the processor 402 during execution thereof by the computer system 400, the main memory 404 and the processor 402 also constituting computer-readable storage media. The instructions 422 may further be transmitted or received over a network 420 via the network interface device 408.
In one embodiment, the instructions 422 include instructions for a credential abstraction proxy (e.g., credential abstraction proxy 200 of
In the foregoing description, numerous details are set forth. It will be apparent, however, to one of ordinary skill in the art having the benefit of this disclosure, that the present invention may be practiced without these specific details. In some instances, well-known structures and devices are shown in block diagram form, rather than in detail, in order to avoid obscuring the present invention.
Some portions of the detailed description have been presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of steps leading to a desired result. The steps are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It has proven convenient at times, for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like.
It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise as apparent from the following discussion, it is appreciated that throughout the description, discussions utilizing terms such as “receiving”, “determining”, “modifying”, “transmitting”, “locating,” “replacing,” “intercepting”, or the like, refer to the actions and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (e.g., electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices.
For simplicity of explanation, the methods are depicted and described herein as a series of acts. However, acts in accordance with this disclosure can occur in various orders and/or concurrently, and with other acts not presented and described herein. Furthermore, not all illustrated acts may be required to implement the methods in accordance with the disclosed subject matter. In addition, those skilled in the art will understand and appreciate that the methods could alternatively be represented as a series of interrelated states via a state diagram or events. Additionally, it should be appreciated that the methods disclosed in this specification are capable of being stored on an article of manufacture to facilitate transporting and transferring such methods to computing devices. The term article of manufacture, as used herein, is intended to encompass a computer program accessible from any computer-readable device or storage media.
Certain embodiments of the present invention also relate to an apparatus for performing the operations herein. This apparatus may be constructed for the intended purposes, or it may comprise a general purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored in a computer readable storage medium, such as, but not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, or any type of media suitable for storing electronic instructions.
Reference throughout this specification to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Thus, the appearances of the phrase “in one embodiment” or “in an embodiment” in various places throughout this specification are not necessarily all referring to the same embodiment. In addition, the term “or” is intended to mean an inclusive “or” rather than an exclusive “or.” Moreover, the words “example” or “exemplary” are used herein to mean serving as an example, instance, or illustration. Any aspect or design described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other aspects or designs. Rather, use of the words “example” or “exemplary” is intended to present concepts in a concrete fashion.
It is to be understood that the above description is intended to be illustrative, and not restrictive. Many other embodiments will be apparent to those of skill in the art upon reading and understanding the above description. The scope of the invention should, therefore, be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled.
This application is related to and claims the benefit of U.S. Provisional Patent Application No. 61/482,191 filed May 3, 2011, which is hereby incorporated by reference herein.
| Number | Name | Date | Kind |
|---|---|---|---|
| 20070211716 | Oz et al. | Sep 2007 | A1 |
| 20080066172 | Tarsi | Mar 2008 | A1 |
| 20080320310 | Florencio et al. | Dec 2008 | A1 |
| 20100199086 | Kuang et al. | Aug 2010 | A1 |
| Number | Date | Country | |
|---|---|---|---|
| 61482191 | May 2011 | US |
