System and method for client device authentication through remote browser isolation

Abstract

Systems and methods for authenticating a client device through remote browser isolation (RBI) are described. The RBI service determines that its remote browser is configured to issue an authentication request to an identity provider to access a resource of a resource provider, and in response, transmits a command to an RBI front end of a client browser executing on a client computing device. The RBI front end receives the command and, in response, generates a browsing context that issues a client-side authentication request to the identity provider that includes information accessible to the client computing device. In response to issuing the client-side authentication request, the browsing context receives an authentication workpiece from the access service and transmits the authentication workpiece to the RBI service. The RBI service receives the authentication workpiece, generates a response to the authentication request including the authentication workpiece, and transmits the response to the resource provider.

Description

Background Art

[0001] The Remote Browser Isolation (RBI) system performs browsing activities in an environment isolated from the client computing device. For example, a user of a client computing device can use an RBI service executed on an RBI server to navigate to a website via a remote browser. The remote browser is capable of sending Hypertext Transfer Protocol (HTTP) messages, receiving HTTP messages, rendering Hypertext Markup Language (HTML) code, executing code (e.g., Code or Cascading Style Sheet (CSS) code). The processed version of the web page is sent to the client computing device for display in the client browser. In this context, the original web content does not reach the client computing device, thereby reducing the risk of malware infiltrating the client computing device from the website. Summary of the invention

[0002] This summary is provided to introduce a selection of concepts in a simplified form, which are further described in the detailed description below. This summary is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to be used to limit the scope of the claimed subject matter.

[0003] This article describes a system and method for authenticating a client device through remote browser isolation (RBI). In one aspect, an RBI service executed on an RBI server includes a remote browser configured to perform web browsing operations on a client browser executed on a client computing device. The RBI service determines that the remote browser is configured to issue an authentication request to an identity provider to obtain access to a resource provider's resources. In response to the determination, the RBI service transmits a command to the RBI front end of the client browser. The command includes an instruction to send a client-side authentication request from the client browser to the identity provider. In response to transmitting the command to the RBI front end of the client browser, the RBI service receives an authentication artifact from the client browser and generates a response to the authentication request including the authentication artifact. The RBI service transmits the response to the resource provider.

[0004] In another example aspect, a client browser executing on a client computing device is communicatively connected to an RBI service, which is executed on an RBI server and includes a remote browser configured to perform browsing operations for the client browser. An RBI front end of the client browser receives a command from the RBI service, the command including an instruction to issue an authentication request to an identity provider to obtain access to a resource of a resource provider. The RBI front end generates a browsing context configured to issue an authentication request to the identity provider. The browsing context issues an authentication request to the identity provider. In response to issuing the authentication request to the identity provider, the browsing context receives an authentication artifact from an access service. The browsing context transmits the authentication artifact to the RBI service.

[0005] Other features and advantages of the present invention and the structure and operation of various embodiments of the present invention are described in detail below with reference to the accompanying drawings. Note that the present invention is not limited to the specific embodiments described herein. Such embodiments are presented herein for illustrative purposes only. Based on the teachings contained herein, additional embodiments will be apparent to one or more persons skilled in the relevant art. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate the embodiments and, together with the description, also serve to explain the principles of the embodiments and to enable those skilled in the relevant art to make and use the embodiments.

[0007] Figure 1 is a block diagram of an example system that performs client device authentication through remote browser isolation (RBI) according to an embodiment.

[0008] Figure 2 It shows that the subject obtains Figure 1 A sequence diagram of the process of accessing resources within an example system.

[0009] Figure 3A Depicted is a flow diagram of a process performed by an RBI server for enabling client device authentication through RBI, according to an embodiment.

[0010] Figure 3B Depicted is a flow diagram of a process performed by an RBI server for generating a response to an authentication request, according to an embodiment.

[0011] Figure 4A Depicted is a flow diagram of a process performed by a client browser for enabling client device authentication through RBI, according to an embodiment.

[0012] Figure 4B Depicted is a flow diagram of a process performed by a browsing context of a client browser for issuing a client-side authentication request to an identity provider, according to an embodiment.

[0013] Figure 4C Depicted is a flow diagram of a process performed by an RBI front end of a client browser for generating a browsing context configured to issue an authentication request to an identity provider, according to an embodiment.

[0014] Figure 4D Depicted is a flow diagram of a process performed by a browsing context of a client browser for issuing a client-side authentication request to an identity provider, according to an embodiment.

[0015] Figure 4E Depicted is a flow diagram of a process performed by a browsing context of a client browser for transmitting authentication artifacts to an RBI service, according to an embodiment.

[0016] Figure 4F Depicted is a flow diagram of a process performed by a browsing context of a client browser for transmitting authentication artifacts to an RBI service, according to an embodiment.

[0017] Figure 5 is a block diagram of an example computing device that may be used to implement an embodiment.

[0018] Features and advantages of the present invention will become more apparent from the detailed description set forth below in conjunction with the accompanying drawings, in which the same reference numerals identify corresponding elements throughout. In the accompanying drawings, the same reference numerals generally indicate identical, functionally similar, and / or structurally similar elements. The drawing in which an element first appears is represented by the leftmost digit or digits in the corresponding reference numeral. DETAILED DESCRIPTION I. Introduction

[0019] The following detailed description discloses a number of example embodiments. The scope of this patent application is not limited to the disclosed embodiments, but covers combinations of the disclosed embodiments and modifications to the disclosed embodiments.

[0020] References in the specification to "one embodiment," "an embodiment," "an example embodiment," etc. indicate that the described embodiment may include a particular feature, structure, or characteristic, but every embodiment may not necessarily include the particular feature, structure, or characteristic. Moreover, such phrases do not necessarily refer to the same embodiment. Further, when a particular feature, structure, or characteristic is described in conjunction with an embodiment, it is considered that it is within the knowledge of those skilled in the art to implement such feature, structure, or characteristic in conjunction with other embodiments, whether or not explicitly described.

[0021] In the discussion, unless otherwise stated, adjectives such as "substantially" and "approximately" modifying conditions or relational characteristics of one or more features of an embodiment of the present disclosure should be understood to mean that the condition or characteristic is defined within a tolerance that is acceptable for operation of the embodiment for the intended application.

[0022] If the performance of an operation is described herein as being "based on" one or more factors, it should be understood that the performance of the operation may be based only on one or more such factors, or may be based on one or more such factors and one or more additional factors. Therefore, as used herein, the term "based on" should be understood to be equivalent to the term "based at least on".

[0023] Many exemplary embodiments are now described. Any section / subsection headings provided herein are not intended to be limiting. Embodiments are described throughout this document, and any type of embodiment may be included under any section / subsection. In addition, the embodiments disclosed in any section / subsection may be combined in any manner with any other embodiment described in the same section / subsection and / or different sections / subsections. II. Systems and Methods for Client-Side Authentication

[0024] As discussed in the Background section above, a remote browser isolation (RBI) system performs browsing activities in an environment isolated from a client computing device. For example, a user of a client computing device can use an RBI service executed on an RBI server to navigate to a website via a remote browser. The remote browser is capable of sending Hypertext Transfer Protocol (HTTP) messages, receiving HTTP messages, rendering Hypertext Markup Language (HTML) code, executing code (e.g., Code or Cascading Style Sheet (CSS) code). The processed version of the web page is sent to the client computing device for display in the client browser. In this context, the original web content does not reach the client computing device, thereby reducing the risk of malware infiltrating the client computing device from the website.

[0025] The RBI service executing the remote browser can communicate with the RBI front end of the client browser executing on the client computing device to cause the processed web page to be displayed by the client browser. The processed web page can be sent to the RBI front end as an image (e.g., pixels), graphics rendering instructions (e.g., to render a graphical representation of the web page), rendered HTML (e.g., document object model), and / or any other processed information corresponding to the web page navigated to by the remote browser.

[0026] The RBI front end displays the processed web page in a window of a client browser executed on the client computing device. In addition, the RBI front end transmits information to the RBI service that represents user input received with respect to the window displaying the processed web page. For example, the RBI front end may transmit letters, numbers, or symbols corresponding to keystrokes provided by the user using a keyboard, x and y coordinates of mouse clicks within a window, and / or any other form of input provided with respect to the window displaying the processed web page. The RBI service interprets the information about the remote browser input from the RBI front end.

[0027] The RBI service may be implemented in a computing system with a secure access policy. In such a computing system, a subject associated with a client computing device, if such subject is successfully authenticated, may access the resources of a resource provider through a remote browser of the RBI service. For example, a subject may include, but is not limited to, a user of a client computing device, an application executed on a client computing device (e.g., a client browser), the client computing device itself, or some combination thereof. For example, a resource may include, but is not limited to, an information object (e.g., a document, a web page, an image, an audio file, a video file, or an output of an executable file), an application, a service, a physical device, and / or any other resource to which access may be provided by a resource provider.

[0028] A subject associated with a client computing device may provide user input to the RBI service, which causes a remote browser of the RBI service to issue an access request for a resource to a resource provider. The resource provider receives the access request, determines that authentication is required to authorize the access request, and sends a redirect message to the remote browser. In response to receiving the redirect message, the remote browser issues an authentication request to the identity provider. The identity provider may be configured to evaluate the information included in the authentication request against the authentication criteria to determine whether the subject associated with the client computing device should be authenticated. Depending on the implementation, the identity provider may evaluate user credentials (e.g., username, password, or personal identification number (PIN)), biometric information (e.g., retinal scan, facial scan, or fingerprint), device identification information (e.g., cryptographic key (e.g., secure socket layer (SSL) client certificate, transport layer security (TLS) client certificate), media access control (MAC) address, Internet protocol (IP) address, or geographic location information) and / or any other information used to determine whether the subject should be authenticated. Depending on the implementation, some of the information evaluated (e.g., device identification information) may be accessible to the client computing device, but not accessible to the RBI service executing on the RBI server. Thus, in this case, the remote browser will not be able to include such information in the authentication request to the identity provider, and if the identity provider is configured to require such information to authenticate the principal (e.g., as part of performing client device authentication), the authentication request will fail even if an appropriate client device is used.

[0029] Embodiments described herein solve the above problems by enabling client device authentication through RBI. In particular, the system and method include an RBI service executed on an RBI server, the RBI server including a remote browser that performs web browsing operations on a client browser executed on a client computing device. The RBI service determines that the remote browser is configured to issue an authentication request to an identity provider to obtain access to a resource of a resource provider, and in response to the determination, transmits a command to the RBI front end of the client browser to issue a client-side authentication request to the identity provider. In response to receiving the command, the RBI front end generates a browsing context that issues a client-side authentication request to the identity provider. Since the client-side authentication request is generated by a client browser executed on a client computing device, the client-side authentication request may include information required for authentication (e.g., device identification information), and the information is accessible to the client computing device, but the information is not accessible to the RBI server. In response to issuing the authentication request to the identity provider, the browsing context receives an authentication artifact from an access service that is authenticated by the identity provider or is part of the identity provider, and transmits the authentication artifact to the RBI service. The RBI service receives the authentication artifact, generates a response to the authentication request including the authentication artifact, and transmits the response to the resource provider.

[0030] According to the system and method, a client-side authentication request is issued to an identity provider through a client browser rather than through a remote browser. For this reason, the identity provider is able to authorize the client-side authentication request because the authentication request can include necessary information that is accessible to the client computing device, but the information is not accessible to the RBI server. Therefore, the method represents an improvement over conventional methods, in which a remote browser issues an authentication request to an identity provider but cannot include information necessary for authentication that is accessible to the client computing device but not to the RBI server. Therefore, even if RBI is being used, the system and method enable a subject to access resources subject to an access policy that requires authentication based on information available to the client device rather than the RBI server.

[0031] To help illustrate the above-described systems and methods, the following will now be described. Figure 1 In particular, Figure 1 is a block diagram of an example system 100 for performing client device authentication via RBI according to an embodiment. Figure 1 As shown, system 100 includes a client computing device 102, an RBI server 104, a resource provider 106, an identity provider 108, and an access service 110. Client computing device 102 is configured to execute a client browser 112, and RBI server 104 is configured to execute an RBI service 114. Figure 1 As further shown in FIG. 1 , the client browser 112 includes a browsing context 116 and an RBI front end 118, and the RBI service 114 includes a remote browser 120. In general, the system 100 operates to provide a principal associated with the client computing device 102 access to resources of the resource provider 106 via the remote browser 120 if such principal has been successfully authenticated by the identity provider 108.

[0032] Each component and subcomponent of system 100 can be connected via one or more networks ( Figure 1 The one or more networks may include, for example, but not limited to, one or more of a local area network (LAN), a wide area network (WAN), a personal area network (PAN), a private network, a public network, a packet network, a circuit switching network, a wired network, and / or a wireless network.

[0033] The RBI service 114 is a computer-implemented system configured to execute and manage a remote browser 120. The remote browser 120 is configured to perform web browsing operations for the client browser 112. Figure 1 As shown, RBI service 114 is implemented on RBI server 104. RBI server can be a single server computing device, or alternatively, can be a group of server computing devices. In addition, RBI server can be a subset of a networked computing system (e.g., a cloud platform).

[0034] Resource providers 106 are intended to represent devices operable to communicate with client computing devices 102 for the purpose of providing client computing devices 102 with access to resources if a principal associated with the client computing device 102 is properly authenticated by identity provider 108. Resource providers 106 may include, for example, one or more server computing devices.

[0035] The identity provider 108 is a computer-implemented system that is configured to create, maintain, and manage identity information associated with a principal (e.g., a user, an application, and / or a client computing device) while providing authentication services to dependent web services. The identity provider 108 can be implemented, for example, on one or more server computing devices.

[0036] The access service 110 is a computer-implemented system that is configured to determine access policies associated with a subject. The access policies may include client-side access policies, operating system-based policies, download access policies, IP-based access policies, geographic location-based access policies, proxy access policies, and / or any other policies for determining resources that can be accessed by a subject and / or the environment in which the subject accesses those resources. For example, the access service 110 may be implemented on one or more server computing devices. Figure 1 As shown, the identity provider 108 and the access service 110 can be implemented as separate systems. However, it is also contemplated herein that the identity provider 108 and the access service 110 can be implemented as part of the same system.

[0037] The client computing device 102 may be any type of computing device, including fixed or mobile computing devices. Examples of fixed computing devices include, but are not limited to, desktop computers, personal computers (PCs), video game consoles, or smart appliances (e.g., smart TVs). Examples of mobile computing devices include, but are not limited to, smartphones, laptop computers, notebook computers, tablet computers, netbooks, or wearable computing devices (e.g., smart watches, including devices such as Glass TM smart glasses head-mounted devices, etc.).

[0038] like Figure 1 As depicted, the client computing device 102 includes one or more device storages 122 (herein, "device storages 122"). The device storages 122 may be configured to store device identification information 124 and / or any other information associated with the client computing device 102, the client browser 112, and / or the system 100. The device identification information 124 may be any type of information suitable for identifying the client computing device 102 (e.g., a cryptographic key (e.g., an SSL client certificate, a TLS certificate), a MAC address, an IP address, or geographic location information), as described herein. The device storage 122 may include any number of hardware-based computer-readable storage media. Alternatively or additionally, the device storage 122 may include a remote storage system (e.g., a cloud storage system or an intranet storage system) accessible to the client computing device 102 via one or more networks.

[0039] The RBI front end 118 and the RBI service 114 are configured to enable a subject associated with the client computing device 102 to access resources of the resource provider 106 via the remote browser 120. The RBI service 114 transmits a processed web page to the RBI front end 118, the processed web page representing the web page navigated to by the remote browser 120, and receives data representing user input from the RBI front end 118. In addition, the RBI service 114 and the RBI front end 118 can communicate via additional communication channels (e.g., an HTTP communication channel or a WebSocket communication channel) for transmitting and / or receiving commands, authentication artifacts, and / or any other information associated with the operation of the system 100, as described elsewhere herein.

[0040] In view of the foregoing context, reference will now be made to Figure 2 An exemplary process is described by which a principal associated with a client computing device 102 may gain access to resources provided by a resource provider 106 in the system 100 .

[0041] like Figure 2 As shown in the sequence diagram 200 of , the process begins when the RBI front end 118 sends user input 202 to the RBI service 114 on behalf of a subject associated with the client computing device 102. The user input 202 may specify a type of user input (e.g., a keystroke, a mouse click, etc.) and / or any other information indicative of the user input (e.g., an x ​​and y coordinate corresponding to a mouse click). Furthermore, while the user input 202 is described with respect to a user associated with the client computing device 102, the user input 202 may correspond to an input of another subject associated with the client computing device 102.

[0042] The RBI service 114 receives the user input 202 and interprets the user input 202 for the remote browser 120. For example, as described in the following example, the RBI service 114 determines that the user input 202 indicates a request for access to a resource and sends a resource access request 204 on behalf of the principal to the resource provider 106. The resource access request 204 may specify a resource 224 of the resource provider 106 for which access is sought.

[0043] The resource provider 106 receives the resource access request 204 and determines that an authentication artifact is needed to authorize the request. For example, the resource provider 106 may determine that an authentication artifact is needed because the principal associated with the client computing device 102 has not provided an authentication artifact or because an authentication artifact previously provided by the principal associated with the client computing device 102 has expired. In either case, based on the determination, the resource provider 106 sends a redirect message 206 to the RBI service 114. The redirect message 206 is configured to redirect the remote browser 120 of the RBI service 114 to the identity provider 108 for the purpose of obtaining the authentication artifact.

[0044] In response to receiving redirect message 206, RBI service 114 makes a determination 208 that remote browser 120 is configured to issue an authentication request to identity provider 108. As part of making determination 208, RBI service 114 may determine that the authentication request includes a device authentication request, determine that the authentication request includes another authentication requiring information accessible to client computing device 102 and not accessible to RBI server 104, determine that a uniform resource locator (URL) corresponding to identity provider 108 included in redirect message 206 is on a predetermined list of URLs corresponding to identity providers configured to perform device authentication, and / or otherwise determine that remote browser 120 is configured to issue an authentication request to identity provider 108. In the context of determining that a URL corresponding to identity provider 108 is on a predetermined list of URLs, the predetermined list of URLs may be provided by a user associated with client computing device 102, a developer associated with RBI server 104, an administrator associated with an enterprise system that includes client computing device 102, a user associated with another client computing device of the enterprise system that includes client computing device 102, and / or any combination thereof. Figure 2 As shown, based on this determination, the RBI service 114 sends a command 210 to the RBI front end 118. The command 210 includes instructions to send a client-side authentication request from the client browser 112 to the identity provider 108. The RBI service 114 may send the command 210 to the RBI front end 118 via a communication channel that is separate from the communication channel used to send and receive processed web pages and user input.

[0045] In response to receiving the command 210, the RBI front end 118 performs a creation step 212. The creation step 212 includes creating a browsing context 116 to issue a client-side authentication request. The RBI front end 118 can create the browsing context 116 in the same window of the client browser 112 in which the RBI front end 118 is located (e.g., as an iframe or frameset), in a new tab of the client browser 112, or in a new window of the client browser 112. For example, according to an embodiment, the RBI front end 118 creates the browsing context 116 as a child iframe of the RBI front end 118.

[0046] The browsing context 116 issues an authentication request 214 to the identity provider 108 on behalf of the principal. The authentication request 214 may include credentials for the principal. In some embodiments, the authentication request 214 may include multiple communications. For example, the browsing context 116 may initiate the authentication request 214 by sending a first communication to the identity provider 108. In response to receiving the first communication, the identity provider 108 may interact with the browsing context 116 to obtain credentials (e.g., user credentials, biometric information, device identification information, or other types of credentials, as described elsewhere herein or otherwise known) as part of a second communication from it. For example, the identity provider 108 may cause a user interface to be presented via the client computing device 102, and the user may submit credentials to the identity provider 108 via the user interface. Alternatively, the identity provider 108 may obtain credentials from a cookie stored on the client computing device 102. For example, the identity provider 108 may obtain credentials from a cookie indicating a single sign-on corresponding to the principal. According to an embodiment, and as will be described below with respect to Figure 4B As further discussed, the identity provider 108 can interact with the browsing context 116 to obtain the device identification information 124 therefrom as part of the second communication. For example, the identity provider 108 and the browsing context 116 can perform an SSL handshake process in which the identity provider 108 verifies that the browsing context 116 has access to an SSL client certificate corresponding to the client computing device 102. The SSL client certificate can be stored in one or more device stores 122 (e.g., as all or part of the device identification information 124). However, these are merely examples and are not intended to be limiting. Other techniques can be used to transfer credentials from the browsing context 116 to the identity provider 108.

[0047] After receiving the authentication request 214, the identity provider 108 evaluates certain information included in the authentication request 214 against a set of authentication criteria to determine whether the principal associated with the authentication request 214 should be authenticated. To perform this function, the identity provider 108 may access a directory that stores information about principals that can be used by the identity provider 108 to determine whether the authentication criteria have been met. For example, the directory may store information that can be used by the identity provider 108 to verify the credentials provided as part of the authentication request 214. For purposes of this example, it will be assumed that the identity provider 108 determines that the authentication criteria have been met.

[0048] In response to determining that the authentication criteria have been met, the identity provider 108 generates a redirect message (herein "redirect message 216") having an authentication artifact 216. The authentication artifact may include, for example, but not limited to, an access token, an ID token, a refresh token, or a Security Assertion Markup Language (SAML) token. In addition, the authentication artifact may include a digital signature generated by the identity provider 108.

[0049] The browsing context 116 receives the redirect message 216 and sends an authentication artifact 218 to the access service 110. In response to receiving the authentication artifact 218, the access service 110 determines an access policy corresponding to the principal and / or resource 226, encrypts the authentication artifact 218 to generate an encrypted authentication artifact 220, and sends the encrypted authentication artifact 220 to the browsing context 116. The access service 110 may encrypt the authentication artifact 218 by applying any suitable encryption algorithm to it. The access service 110 may encrypt the authentication artifact 218 to prevent the client computing device 102 from accessing the underlying authentication artifact 218.

[0050] The browsing context 116 receives the encrypted authentication artifact 220 and transmits it to the RBI service 114. The browsing context 116 may send the authentication artifact 220 to the RBI service 114 via a communication channel separate from the communication channel used to send and receive processed web pages and user input. Figure 4E and Figure 4F As further discussed, the browsing context 116 may transmit the encrypted authentication artifact 220 to the RBI service 114 directly or indirectly.

[0051] The RBI service 114 receives the encrypted authentication artifact 220, performs decryption 222 to decrypt the encrypted authentication artifact 220 to recover the authentication artifact 218, and then transmits the authentication artifact 218 as part of a response with the authentication artifact 224 (herein "response 224") to the resource provider 106. The decryption 222 can include verifying that the encrypted authentication artifact 220 was generated by the access service 110. In addition to the authentication artifact 218, the response 224 can also include additional information associated with the RBI service 114, the resource provider 106, and / or any other component of the system 100.

[0052] The resource provider 106 receives the response 224 and performs a number of checks thereon to determine whether the included authentication artifact is sufficient to allow the principal associated with the client computing device 102 to access the resource 226. For example, the resource provider 106 may check the digital signature of the included authentication artifact to verify that the included authentication artifact was generated by the identity provider 108. If this verification of the digital signature fails, the resource provider 106 will not allow the principal associated with the client computing device 102 to access the resource 226.

[0053] If the resource provider 106 determines that the included authentication artifact passes the above-described checks, the resource provider 106 provides the RBI service 114 with access to the resource 226 , as shown at the bottom of the sequence diagram 200 .

[0054] In embodiments, the RBI server 104 may operate in various ways. For example, Figure 3A Depicted is a flow chart 300 of a process performed by an RBI server for enabling client device authentication through RBI, according to an embodiment. Figure 1 The RBI server 104 may operate according to the flowchart 300 in the embodiment. Note that not all steps of the flowchart 300 need to be performed in all embodiments. Figure 3A Based on the description, other structural and operational embodiments will be apparent to persons skilled in one or more relevant arts.

[0055] Flowchart 300 begins at step 302. In step 302, it is determined that the remote browser is configured to issue an authentication request to an identity provider to obtain access to a resource of a resource provider. Figure 1 The RBI service 114 is configured to determine that the remote browser 120 is configured to issue an authentication request to the identity provider 108 to obtain access to the resources of the resource provider 106. For example, as described above with reference to Figure 2 As discussed, the RBI service 114 may receive a redirect message 206 from the resource provider 106 that is configured to redirect the remote browser 120 to the identity provider 108 .

[0056] Furthermore, depending on the embodiment, the RBI service 114 may have additional criteria for performing step 302. For example, Figure 1 The RBI service 114 may determine that the redirect message 206 is configured to redirect the remote browser 120 to an identity provider that is configured to perform device authentication based on information accessible to the client computing device 102 and not accessible to the RBI server 104. For example, as described above with reference to Figure 2 As discussed, the RBI service 114 may make this determination based at least on the URL corresponding to the identity provider 108 included in the redirect message 206 .

[0057] In step 304, in response to the determination, a command is transmitted to the RBI front end of the client browser. The command includes instructions to send a client-side authentication request from the client browser to the identity provider. For example, as shown in FIG. Figure 2 As discussed, the RBI service 114 transmits a command 210 to the RBI front end 118 of the client browser 112. The command 210 includes instructions to send an authentication request 214 from the client browser 112 to the identity provider 108.

[0058] In step 306, in response to transmitting a command to the RBI front end of the client browser, an authentication artifact is received from the client browser. Figure 1 The RBI service 114 is configured to receive the authentication artifact from the client browser 112. Depending on the implementation, the RBI service 114 may receive the authentication artifact as part of a response that includes additional data associated with the authentication request, command 210, authentication artifact, client computing device 102, and / or RBI server 104. Figure 2 discussed, and as will be referred to below Figure 3B As further discussed, the authentication artifact received from the client browser 112 may be an encrypted authentication artifact (eg, encrypted authentication artifact 220 ).

[0059] In step 308, a response to the authentication request including an authentication artifact is generated. For example, Figure 1 The RBI service 114 is configured to generate a response to the authentication request including the authentication artifact received in step 306. Generating the response may include processing the information included in the authentication artifact received in step 306, decrypting the authentication artifact (e.g., as described below with respect to Figure 3B ), and / or otherwise analyze (include, evaluate, and / or process the information) to generate a response to the authentication request corresponding to the determination in step 302.

[0060] In step 310, the response is transmitted to the resource provider. For example, Figure 1 The RBI service 114 is configured to transmit the response generated in step 308 to the resource provider 106. Figure 2 As discussed, the response (eg, response 224 ) may include the authentication artifact received in step 306 .

[0061] In an embodiment, the RBI service 114 may generate a response to the authentication request in various ways. For example, Figure 3B A flowchart 320 is depicted of a process performed by an RBI server for generating a response to an authentication request according to an embodiment. Flowchart 320 may be Figure 3A Another embodiment of steps 304 and 308. In an embodiment, Figure 1 The RBI server 104 may operate according to the flowchart 320. Note that not all steps of the flowchart 320 need to be performed in all embodiments. Figure 3B Based on the description, other structural and operational embodiments will be apparent to persons skilled in one or more relevant arts.

[0062] Flowchart 320 begins at step 322. In step 322, an encrypted authentication artifact is received from a client browser. For example, as described above with reference to Figure 2 As discussed, the RBI service 114 receives the encrypted authentication artifact 220 from the browsing context 116 of the client browser 112 .

[0063] In step 324, the encrypted authentication artifact is decrypted to generate a decrypted authentication artifact. Figure 2 As discussed, the RBI service 114 performs decryption 222 to decrypt the encrypted authentication artifact 220 and generates a decrypted authentication artifact.

[0064] In step 326 , a response to the authentication request is generated that includes the decrypted authentication artifact. For example, the RBI service 114 is configured to generate a response to the authentication request that includes the decrypted authentication artifact in step 324 .

[0065] In embodiments, the client browser 112 executing on the client computing device 102 may operate in a variety of ways. For example, Figure 4A Depicted is a flow diagram 400 of a process performed by a client browser for enabling client device authentication through RBI, according to an embodiment. Figure 1 The client browser 112 can operate according to the flowchart 400 in the embodiment. Note that not all steps of the flowchart 400 need to be performed in all embodiments. Figure 4ABased on the description, other structural and operational embodiments will be apparent to persons skilled in one or more relevant arts.

[0066] Flowchart 400 begins at step 402. In step 402, the RBI front end of the client browser receives a command from the RBI service. The command includes instructions to issue an authentication request to the identity provider to obtain access to the resources of the resource provider. For example, as described above with reference to Figure 2 As discussed, the RBI front end 118 receives the command 210 from the RBI service 114. The command 210 includes instructions to issue an authentication request to the identity provider 108 to obtain access to the resources of the resource provider 106. The command 210 may include any other information associated with the RBI server 104, the client computing device 102, the resource provider 106, the identity provider 108, and / or any other component of the system 100.

[0067] In step 404, the RBI front end of the client browser generates a browsing context configured to issue an authentication request to the identity provider. Figure 2 As discussed, the RBI front end 118 generates the browsing context 116 to issue an authentication request to the identity provider 108. The RBI front end 118 can generate the browsing context 116 as a linked frame or frameset within the same window of the client browser 112 as the RBI front end 118, within another tab (e.g., a new tab) of the client browser 112, or within another window (e.g., a new window) of the client browser 112, as described herein.

[0068] In step 406, the browsing context sends an authentication request to the identity provider. Figure 2 As discussed, the browsing context 116 issues an authentication request 214 to the identity provider 108. As described elsewhere herein, the authentication request 214 may include multiple communications.

[0069] In step 408, in response to issuing an authentication request to the identity provider, the browsing context receives an authentication artifact from the access service. Figure 2 As discussed, the browsing context 116 receives the encrypted authentication artifact 220 from the access service 110. Figure 1 Shown and about Figure 2 As described above, the identity provider 108 and the access service 110 may be separate services implemented by separate systems. Alternatively, the access service 110 is incorporated into the same system that implements the identity provider 108, or as a sub-service of the identity provider 108. Figure 2 As described, the authentication artifact received by the browsing context 116 from the access service 110 may be encrypted.

[0070] In step 410, the browsing context transmits the authentication artifact to the RBI service. Figure 2 As described, the browsing context 116 transmits the encrypted authentication artifact 220 to the RBI service 114. Depending on the implementation, the transmission may include other information in addition to the encrypted authentication artifact 220, as described elsewhere herein.

[0071] In embodiments, browsing context 116 may issue the client-side authentication request in a variety of ways. Figure 4B A flowchart 420 is depicted of a process performed by a browsing context of a client browser for issuing a client-side authentication request to an identity provider according to an embodiment. Flowchart 420 may be Figure 4A Another embodiment of step 406. Figure 1 The browsing context 116 of the embodiment can be operated according to the flowchart 420 of the embodiment. Note that not all steps of the flowchart 420 need to be performed in all embodiments. Figure 4B Based on the description, other structural and operational embodiments will be apparent to persons skilled in one or more relevant arts.

[0072] Flowchart 420 begins at step 422. In step 422, information that is not accessible to the RBI server but is accessible to the client computing device is included in the authentication request. For example, Figure 1 The browsing context 116 of the identity provider 108 may be configured to include the device identification information 124 in the authentication request (e.g., the authentication request 214) issued to the identity provider 108. Figure 2 As discussed, the authentication request 214 may include multiple communications. For example, in the operating example, the browsing context 116 initiates the authentication request 214 by sending a first communication to the identity provider 108. In response to receiving the first communication, the identity provider 108 interacts with the browsing context 116 to obtain the device identification information 124. For example, the identity provider 108 may determine the device identification information 124 required to authorize the authentication request 214, and issue a request to the browsing context 116 to provide the device identification information 124.

[0073] In step 424, an authentication request is issued to an identity provider configured to perform device authentication based at least on the information. Figure 1The browsing context 116 may be configured to issue an authentication request of step 422 to the identity provider 108, and the identity provider 108 is configured to perform device authentication based on at least the device identification information 124. For example, with respect to the example discussed above regarding running step 422, in response to the identity provider 108 interacting with the browsing context 116 to obtain the device identification information 124, the browsing context 116 issues an authentication request including the device identification information 124.

[0074] In an embodiment, the client computing device 102, the identity provider 108, and the access service 110 with respect to the RBI service 114 executing on the RBI server 104 perform client device authentication through RBI. The client device authentication may be performed based on state information identifying the RBI service 114. Depending on the implementation, the state information may be included in a command sent from the RBI server 104 (e.g., command 210), determined by the RBI front end 118, included in an authentication request issued by the browsing context 116 (e.g., authentication request 214), determined by the access service 110 (e.g., as part of generating the encrypted authentication artifact 220), and / or otherwise utilized by one or more components or subcomponents of the system 100 to identify the RBI service 114. Several example processes with respect to state information for identifying the RBI service 114 are described below.

[0075] As described above, the RBI front end 118 may be configured to determine state information identifying the RBI service 114. For example, Figure 4C A flowchart 430 is depicted of a process performed by an RBI front end of a client browser for generating a browsing context configured to issue an authentication request to an identity provider by the browsing context according to an embodiment. Flowchart 430 may be Figure 4A Another embodiment of step 404. Figure 1 The RBI front end 118 can operate according to the flowchart 430 in the embodiment. Note that not all steps of the flowchart 430 need to be performed in all embodiments. Based on the following description of FIG. 4, further structural and operational embodiments will be apparent to one or more persons skilled in the relevant art.

[0076] Flowchart 430 begins at step 432. In step 432, the RBI front end determines status information identifying the RBI service. For example, Figure 1The RBI front end 118 may be configured to determine state information identifying the RBI service 114. For example, the RBI front end 118 may determine that the command 210 received from the RBI service 114 includes the state information. Alternatively, the RBI front end 118 may generate the state information in response to receiving the command 210. The state information may include an endpoint of the RBI service 114, an IP address of a server computing device of the RBI server 104, and / or any other information suitable for identifying the RBI service 114.

[0077] In step 434, the browsing context is configured to include state information in the authentication request. For example, Figure 1 The browsing context 116 of the embodiment of the present invention may be configured to include the state information determined in step 432 in the authentication request issued to the identity provider 108 (e.g., as described in relation to Figure 2 For example, the browsing context 116 may include state information determined in the URL used to interact with the identity provider 108 and / or access service 110 in step 432.

[0078] As described above, the browsing context 116 may include state information in the authentication request issued to the identity provider 108. Depending on the implementation, the browsing context 116 may include state information in the authentication request without the RBI front end 118 determining the state information. For example, Figure 4D A flowchart 440 is depicted of a process performed by a browsing context of a client browser for issuing a client-side authentication request to an identity provider according to an embodiment. Flowchart 440 may be Figure 4A Another embodiment of step 406. Figure 1 The browsing context 116 of the embodiment can be operated according to the flowchart 440. Note that the steps of the flowchart 440 need not be performed in all embodiments. Figure 4D Based on the description, other structural and operational embodiments will be apparent to persons skilled in one or more relevant arts.

[0079] Flowchart 440 includes step 442. In step 442, the browsing context includes state information with an authentication request to an identity provider. For example, Figure 1 The browsing context 116 may include state information with the authentication request 214 issued to the identity provider 108. In this context, the state information may be included in the command 210 received from the RBI service 114, as described above with respect to Figure 4C430, and / or otherwise provided to or determined by the browsing context 116 to include an authentication request issued to the identity provider 108. For example, the browsing context 116 may include state information determined in a URL used to interact with the identity provider 108 and / or access service 110.

[0080] Therefore, it has been about Figure 4C and Figure 4D Several example embodiments are described, including state information for identifying an RBI service 114 in an authentication request issued to an identity provider 108. However, it is contemplated herein that the state information may be determined in other ways. For example, the identity provider 108 may determine the state information as part of the authentication process described herein. In addition, as part of generating an (e.g., encrypted) authentication token, the access service 110 may determine the state information. For example, the access service 110 may interact with the browsing context 116 (e.g., as part of determining an access policy corresponding to a principal associated with the authentication request) in order to determine the state information and identify the RBI service 114. For example, in an embodiment where the browsing context 116 is generated in the same window of the client browser 112 as the RBI front end 118, the access service 110 is able to identify the RBI service 114 through the RBI front end 118 via interaction with the browsing context 116. As will be appreciated by one skilled in one or more related fields having the benefit of the present disclosure, the state information may still be determined and / or the RBI service 114 may be identified in other ways.

[0081] In embodiments, the browsing context 116 may be configured to transmit the authentication artifact to the RBI service 114 in various ways. For example, the browsing context 116 may be configured to transmit the authentication artifact to the RBI service 114 indirectly (e.g., via the client browser 112 or another component of the client computing device 102) or directly (e.g., via the browsing context 116). For example, Figure 4E A flowchart 450 is depicted of a process performed by a browsing context of a client browser for transmitting authentication artifacts to an RBI service according to an embodiment. Flowchart 450 may be Figure 4A Another embodiment of step 410. Figure 1 The browsing context 116 of the embodiment can be operated according to the flowchart 450 of the embodiment. Note that the steps of the flowchart 450 need not be performed in all embodiments. Figure 4E Based on the description, other structural and operational embodiments will be apparent to persons skilled in one or more relevant arts.

[0082] Flowchart 450 includes step 452. In step 452, the authentication artifact is transmitted to the RBI service via the RBI front end. For example, the browsing context 116 can transmit the encrypted authentication artifact 220 to the RBI service 114 via the RBI front end 118. For example, according to an embodiment, the browsing context 116 is generated in a window of the client browser 112 that is the same as a subframe of the RBI front end 118 (e.g., as an inline frame or frameset). In this context, the browsing context 116 is able to operate within the scope of the RBI front end 118. For example, the browsing context 116 interacts with the RBI service 114 via the RBI front end 118 (e.g., receives commands from the RBI service 114 and / or transmits authentication artifacts to the RBI service 114). In this context, the browsing context 116 and the RBI front end 118 can communicate using frame-to-frame communication techniques.

[0083] Replace the above about Figure 4E In the described example embodiment, the browsing context 116 may transmit (eg, directly) the validation artifacts to the RBI service 114 (eg, without the RBI front end 118). For example, Figure 4F A flowchart 460 is depicted of a process performed by a browsing context of a client browser for transmitting authentication artifacts to an RBI service according to another embodiment. Flowchart 460 may be Figure 4A Another embodiment of step 410. Figure 1 The browsing context 116 can be operated according to the flowchart 460 in the embodiment. Note that not all steps of the flowchart 460 need to be performed in all embodiments. Based on the following description of FIG. 4, further structural and operational embodiments will be apparent to one or more technicians in the relevant art.

[0084] Flowchart 460 begins at step 462. In step 462, an RBI service is identified. For example, browsing context 116 may be configured to identify RBI service 114. State information may be used to identify RBI service 114, as described elsewhere herein. For example, access service 110 may request state information identifying RBI service 114 from browsing context 116. Alternatively, in response to receiving redirect message 216 from identity provider 108, browsing context 116 may present state information to access service 110. In yet another alternative, browsing context 116 identifies RBI service 114 without providing state information to access service 110.

[0085] In step 464, the authentication artifact is transmitted to the identified RBI service. For example, the browsing context 116 may be configured to transmit the authentication artifact to the RBI service 114, as identified in step 462. In this context, the browsing context 116 may transmit the authentication artifact (e.g., the encrypted authentication artifact 220) to the RBI service 114 while in a different window of the client browser 112 than the RBI front end 118, in a different tab of the client browser 112 than the RBI front end 118, or otherwise operating in a different scope than the RBI front end 118. III. Additional Example Embodiments and Advantages

[0086] As described above, systems and devices can be configured in various ways to enable client device authentication through RBI. Example embodiments have been described with respect to remote browsers and RBI services that can be implemented in various ways. For example, an RBI service according to an embodiment can be implemented in a cloud access security broker (CASB) proxy server. In this example, an RBI service is executed on a proxy server (e.g., a proxy computing device) interconnected between a client computing device and a server computing device (e.g., a web server or other resource providing server). In another example, the RBI service can be implemented as part of a firewall or antivirus system. For example, in response to a firewall determining that a destination web page is potentially malicious, a client browser can be directed to an RBI front end. In this context, the remote browser of the RBI service is configured to navigate to the destination web page on behalf of the client browser. In addition, other RBI applications can implement one or more of the systems or methods described herein.

[0087] In addition, embodiments have been described herein with respect to client device authentication. However, it is also contemplated herein that the RBI service may be configured to transmit commands to the client browser and also issue other types of authentication. For example, the RBI service may transmit commands to the client browser to issue some or all authentication requests to the identity provider. Alternatively, the RBI service may be configured to issue an authentication request (e.g., a subset thereof) to the identity provider. For example, the RBI service may determine that the RBI server-side authentication request may be suitable for responding to a redirect message received from a resource provider. For example, the RBI service according to an embodiment may determine that the authentication of the subject does not require authentication based on information available to the client device rather than the RBI server. In this context, the RBI service issues an RBI server-side authentication request to the identity provider, receives an authentication token, and provides the authentication token to the resource provider.

[0088] Systems and methods have been described herein with respect to a browsing context configured to issue an authentication request to an identity provider. As described herein, a browsing context can be implemented in an inline frame, frameset, tag, or window of a client browser. For example, in an inline frame implementation, a browsing context is generated as an inline frame that is hidden or otherwise presented in a window of a client browser to reduce visibility or not obstruct a user's view of a processed web page displayed by an RBI front end. For example, a browsing context in a specific implementation is generated as an inline frame of a single pixel size. Alternatively, a browsing context can be implemented as an inline frame, frameset, tag, or window of a client browser that displays information of input to a user associated with the client browser and / or requests information of input from a user associated with the client browser. For example, a browsing context can be implemented as a pop-up window indicating the progress of an authenticated user and / or requesting a user to provide user input (e.g., user credentials).

[0089] In some example embodiments, one or more operations of the flowcharts described herein may not be performed. Furthermore, operations may be performed in addition to or in place of the operations of the flowcharts described herein. Further, in some example embodiments, one or more of the operations of the flowcharts described herein may be performed out of sequence, in an alternate sequence, or partially (or completely) simultaneously with each other or with other operations.

[0090] The embodiments described herein and / or any other systems, subsystems, devices, and / or components disclosed herein may be implemented in hardware (e.g., hardware logic / electrical circuitry) or in any combination of hardware and software (computer program code configured to be executed in one or more processors or processing devices) and / or firmware. IV. Example Computer System Implementation

[0091] Figure 5 An example processor-based computer system 500 (herein "system 500"), such as reference 1, is depicted that may be used to implement various embodiments described herein. Figures 1 to 4F And any of the embodiments described in the above sections. For example, the system 500 can be used to implement the above reference Figure 1 Any of the components of the system 100 described above with reference to Figure 2 Any of the operations of the sequence diagram 200 described above, and / or the operations of the sequence diagram 200 described above, FIG. 3A to FIG. 4F Any of the flowcharts described. The description of system 500 provided herein is provided for the purpose of illustration and is not intended to be limiting. As known to one or more persons skilled in the art, embodiments may be implemented in other types of computer systems.

[0092] like Figure 5 As shown, system 500 includes one or more processors, one or more processors are referred to as processing units 502, system memory 504, and bus 506 that couples various system components including system memory 504 to processing unit 502. Processing unit 502 is an electrical and / or optical circuit implemented as a central processing unit (CPU), microcontroller, microprocessor and / or other physical hardware processor circuit in one or more physical hardware circuit device elements and / or integrated circuit devices (semiconductor material chips or tube dies). Processing unit 502 can execute program codes stored in computer-readable media, such as program codes of operating system 530, application programs 532, other program modules 534, etc. Bus 506 represents any one or more of several types of bus structures, including memory bus or memory controller, peripheral bus, accelerated graphics port, and processor or local bus using any of various bus architectures. System memory 504 includes read-only memory (ROM) 508 and random access memory (RAM) 510. Basic input / output system 512 (BIOS) is stored in ROM 508.

[0093] The system 500 also has one or more of the following drives: a hard disk drive 514 for reading from and writing to the hard disk; a magnetic disk drive 516 for reading from or writing to a removable magnetic disk 518; and an optical disk drive 520 for reading from or writing to a removable optical disk 522 (such as a CD ROM, DVD ROM, or other optical media). The hard disk drive 514, magnetic disk drive 516, and optical disk drive 520 are connected to the bus 506 via a hard disk drive interface 524, a magnetic disk drive interface 526, and an optical disk drive interface 528, respectively. The drives and their associated computer-readable media provide non-volatile storage of computer-readable instructions, data structures, program modules, and other data for the computer. Although a hard disk, a removable magnetic disk, and a removable optical disk are described, other types of hardware-based computer-readable storage media may be used to store data, such as flash memory cards, digital video disks, RAM, ROM, and other hardware storage media.

[0094] A plurality of program modules may be stored on a hard disk, a magnetic disk, an optical disk, a ROM, or a RAM. These programs include an operating system 530, one or more application programs 532, other program modules 534, and program data 536. For example, the application program 532 or other program modules 534 may include computer program logic (e.g., computer program code or instructions) for implementing the above system, including reference Figures 1 to 4F Described embodiments.

[0095] A user may enter commands and information into the system 500 through input devices such as a keyboard 538 and a pointing device 540. Other input devices (not shown) may include a microphone, a joystick, a game pad, a satellite dish, a scanner, a touch screen and / or touchpad, a voice recognition system for receiving voice input, a gesture recognition system for receiving gesture input, etc. These and other input devices are typically connected to the processing unit 502 through a serial port interface 542 coupled to the bus 506, but may be connected by other interfaces, such as a parallel port, a game port, or a universal serial bus (USB).

[0096] Display screen 544 is also connected to bus 506 via an interface such as video adapter 546. Display screen 544 may be external to system 500 or incorporated into system 500. Display screen 544 may display information, as well as serve as a user interface for receiving user commands and / or other information (e.g., by touch, finger gestures, a virtual keyboard, etc.). In addition to display screen 544, system 500 may also include other peripheral output devices (not shown), such as speakers and printers.

[0097] The system 500 is connected to a network 548 (e.g., the Internet) through an adapter or network interface 550, a modem 552, or other means for establishing communications over the network. The modem 552 may be internal or external and may be connected to the bus 506 via the serial port interface 542, such as a serial bus. Figure 5 As shown, or may be connected to bus 506 using another interface type including a parallel interface.

[0098] As used herein, the terms “computer program medium”, “computer readable medium” and “computer readable storage medium” are generally used to refer to physical hardware media such as hard disk drive 514, removable disk 518, removable optical disk 522, such as RAM, ROM, flash memory cards, digital video disks, zip disks, MEMs, nanotechnology-based storage devices, and other types of physical / tangible hardware storage media (including Figure 5 Such computer-readable storage media are distinguished from (not including) and do not overlap with communication media. Communication media typically embody computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave. The term "modulated data signal" refers to a signal having one or more characteristics set or changed in a manner that encodes information in the signal. By way of example and not limitation, communication media include wireless media such as acoustic, RF, infrared, and other wireless media, as well as wired media. Embodiments also relate to such communication media.

[0099] As described above, computer programs and modules (including application programs 532 and other program modules 534) can be stored on a hard disk, disk, optical disk, ROM, RAM or other hardware storage medium. Such computer programs can also be received via network interface 550, serial port interface 552 or any other interface type. Such computer programs, when executed or loaded by an application, enable system 500 to implement the features of the embodiments discussed herein. Therefore, such computer programs represent controllers of system 500.

[0100] Embodiments also relate to computer program products including computer codes or instructions stored on any computer readable medium.Such computer program products include hard drives, optical drives, memory device packages, portable memory sticks, memory cards, and other types of physical storage hardware. V. Additional Exemplary Embodiments

[0101] In an embodiment, a system includes a client computing device that executes a client browser. The client browser is communicatively connected to a remote browser isolation (RBI) service, and the RBI service is executed on an RBI server. The RBI service includes a remote browser configured to perform browsing operations for the client browser. The client browser includes an RBI front end. The RBI front end is configured to receive a command from the RBI service. The command includes an instruction to issue an authentication request to an identity provider to obtain access to a resource of a resource provider. The RBI front end is also configured to generate a browsing context in response to receiving the command. The browsing context is configured to issue an authentication request to the identity provider. In response to issuing the authentication request to the identity provider, the browsing context is configured to receive an authentication artifact from an access service. The browsing context is also configured to transmit the authentication artifact to the RBI service.

[0102] In an embodiment, the browsing context is one of: an inline frame of a client browser, a frameset of a client browser, a tab of a client browser, or a window of a client browser.

[0103] In an embodiment, the authentication request includes information accessible to the client computing device, the information not accessible to the RBI server.The identity provider includes an identity provider configured to perform device authentication based at least on the information.

[0104] In an embodiment, the information includes a Secure Sockets Layer (SSL) client certificate.

[0105] In an embodiment, an access service includes an access service configured to determine an access policy corresponding to a client computing device and generate an authentication artifact based at least on the determined access policy.

[0106] In an embodiment, the browsing context is configured to transmit the authentication artifact to the RBI service by transmitting the authentication artifact to the RBI service via the RBI front end.

[0107] In an embodiment, the browsing context is configured to transmit the authentication artifact to the RBI service by: identifying the RBI service; and transmitting the authentication artifact to the identified RBI service.

[0108] In an embodiment, a method performed by a client browser, the client browser is executed on a client computing device. The client browser is communicatively connected to a remote browser isolation (RBI) service, the RBI service being executed on an RBI server. The RBI service includes a remote browser configured to perform browsing operations for the client browser. The method includes receiving a command from the RBI service through an RBI front end of the client browser. The command includes an instruction to issue an authentication request to an identity provider to obtain access to a resource of a resource provider. A browsing context configured to issue an authentication request to the identity provider is generated by the RBI front end. An authentication request is issued to the identity provider through the browsing context. In response to issuing the authentication request to the identity provider, the browsing context receives an authentication artifact from an access service. The browsing context transmits the authentication artifact to the RBI service.

[0109] In one embodiment, the browsing context is one of: an inline frame of a client browser, a frameset of a client browser, a tab of a client browser, or a window of a client browser.

[0110] In an embodiment, issuing the authentication request to the identity provider comprises: including in the authentication request information accessible to the client computing device, the information not accessible to the RBI server; and issuing the authentication request to the identity provider configured to perform device authentication based at least on the information.

[0111] In an embodiment, receiving the authentication artifact from the access service includes receiving the authentication artifact from an access service configured to determine an access policy corresponding to the client computing device and to generate the authentication artifact based on at least the determined access policy.

[0112] In an embodiment, the command includes state information identifying the RBI service.The browsing context issuing an authentication request to the identity provider includes: including the state information with the authentication request.

[0113] In an embodiment, the RBI front end determines state information identifying the RBI service. Generating a browsing context configured to issue an authentication request to the identity provider includes configuring the browsing context to include the state information in the authentication request.

[0114] In an embodiment, transmitting the authentication artifact to the RBI service through the browsing context includes: transmitting the authentication artifact to the RBI service via the RBI front end; or identifying the RBI service and transmitting the authentication artifact to the identified RBI service.

[0115] In an embodiment, a method is performed by a remote browser isolation (RBI) service. The RBI service is executed on an RBI server. The RBI service includes a remote browser. The remote browser is configured to perform network browsing operations for a client browser executed on a client computing device. The method includes determining that the remote browser is configured to issue an authentication request to an identity provider to obtain access to a resource of a resource provider. In response to the determination, a command is transmitted to the RBI front end of the client browser. The command includes an instruction to send a client-side authentication request from the client browser to the identity provider. In response to transmitting the command to the RBI front end of the client browser, an authentication artifact is received from the client browser. A response to the authentication request including the authentication artifact is generated. The response is transmitted to the resource provider.

[0116] In an embodiment, determining that the remote browser is configured to issue an authentication request to the identity provider to obtain access to a resource of the resource provider includes determining that the remote browser is configured to issue an authentication request to the identity provider. The identity provider is configured to perform device authentication based on at least information accessible to the client computing device, which is not accessible to the RBI server.

[0117] In an embodiment, the command includes state information to be included with the client-side authentication request. The state information identifies the RBI service.

[0118] In an embodiment, receiving the authentication artifact from the client browser includes receiving an encrypted authentication artifact from the client browser. Generating a response to the authentication request including the authentication artifact includes: decrypting the encrypted authentication artifact to generate a decrypted authentication artifact; and generating a response to the authentication request including the decrypted authentication artifact.

[0119] In an embodiment, the authentication artifact includes information indicative of an access policy corresponding to the client computing device.

[0120] In an embodiment, receiving the authentication artifact from the client browser comprises one of: receiving the authentication artifact from an RBI front end of the client browser; or receiving the authentication artifact from a tab or window of the client browser that is not the RBI front end. VI. Conclusion

[0121] Although various embodiments have been described above, it should be understood that they are presented by way of example only and not limitation. It will be apparent to those skilled in the relevant art that various changes in form and detail may be made therein without departing from the spirit and scope of the embodiments. Therefore, the breadth and scope of the embodiments should not be limited by any of the above-described exemplary embodiments, but should be limited only in accordance with the following claims and their equivalents.

Claims

1. A system comprising: A client computing device executing a client browser, the client browser being communicatively connected to a remote browser isolation (RBI) service executing on an RBI server and comprising a remote browser configured to perform browsing operations for the client browser, the client browser comprising: RBI front end, the RBI front end is configured to: receiving a command from the RBI service, the command comprising an instruction to issue an authentication request to an identity provider to obtain access to a resource of a resource provider; and In response to receiving the command, a browsing context is generated, the browsing context being configured as follows: Sending the authentication request to the identity provider; receiving an authentication artifact from an access service in response to issuing the authentication request to the identity provider; and The authentication artifact is transmitted to the RBI service.

2. The system according to claim 1, wherein the browsing context is one of the following: the inline frame of the client browser, the frameset of the client browser, The client browser tab, or The client browser window.

3. The system of claim 1, wherein: The authentication request includes information accessible to the client computing device, the information not accessible to the RBI server; and The identity provider includes an identity provider configured to perform device authentication based at least on the information.

4. The system of claim 3, wherein the information comprises a Secure Sockets Layer (SSL) client certificate. 5 . The system of claim 1 , wherein the access service comprises an access service configured to determine an access policy corresponding to the client computing device and to generate the authentication artifact based at least on the determined access policy.

6. The system of claim 1 , wherein the browsing context is configured to transmit the authentication artifact to the RBI service by: The authentication artifact is transmitted to the RBI service via the RBI front end.

7. The system of claim 1 , wherein the browsing context is configured to transmit the authentication artifact to the RBI service by: identifying the RBI service; and The authentication artifact is transmitted to the identified RBI service.

8. A method performed by a client browser, the client browser executing on a client computing device, the client browser being communicatively connected to a remote browser isolation (RBI) service, the RBI service executing on an RBI server and comprising a remote browser configured to perform a browsing operation for the client browser, the method comprising: The RBI frontend via the client browser: receiving a command from the RBI service, the command comprising an instruction to issue an authentication request to an identity provider to obtain access to a resource of a resource provider; as well as generating a browsing context configured to issue the authentication request to the identity provider; and Through the browsing context: Sending the authentication request to the identity provider; receiving an authentication artifact from an access service in response to issuing the authentication request to the identity provider; as well as The authentication artifact is transmitted to the RBI service.

9. The method according to claim 8, wherein the browsing context is one of the following: the inline frame of the client browser, the frameset of the client browser, The client browser tab, or The client browser window.

10. The method according to claim 8, wherein the issuing of the authentication request to the identity provider comprises: including in the authentication request information accessible to the client computing device, the information being inaccessible to the RBI server; as well as The authentication request is issued to an identity provider configured to perform device authentication based at least on the information.

11. The method of claim 8, wherein the receiving the authentication artifact from the access service comprises: The authentication artifact is received from an access service configured to determine an access policy corresponding to the client computing device and to generate an authentication artifact based at least on the determined access policy.

12. The method according to claim 8, wherein: The command includes status information identifying the RBI service, and The sending of the authentication request to the identity provider through the browsing context includes: Utilizing the authentication request to include the state information.

13. The method according to claim 8, further comprising: Determining, by the RBI front end, status information identifying the RBI service; and The generating the browsing context configured to issue the authentication request to the identity provider comprises: The browsing context is configured to include the state information in the authentication request.

14. The method of claim 8, wherein the transmitting the authentication artifact to the RBI service via the browsing context comprises: transmitting the authentication artifact to the RBI service via the RBI front end; or The RBI service is identified and the authentication artifact is transmitted to the identified RBI service.

15. A computer readable storage medium having programmed instructions encoded thereon, the programmed instructions being executable by one or more processors to perform the method of any one of claims 8 to 14.

Images