Identity Proxy for Secure Cloud Access and Single Sign-On
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices face challenges in securely accessing cloud-based services due to sandboxed applications and limitations in supporting certain authentication protocols, which hinder single sign-on and expose enterprise credentials when using basic authentication.
Innovation Solution
A secure identity proxy system is implemented, utilizing a tunnel server and identity provider proxy to establish a secure tunnel based on device security posture, allowing secure access to cloud-based services without exposing credentials, and enabling single sign-on across multiple apps by using SAML assertions or other security tokens.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If basic authentication is used to access cloud-based services, then authentication simplicity is improved, but enterprise credentials are exposed on the mobile device and to cloud-based service providers
Solution Approach 1:
The patent introduces an identity provider proxy as an intermediary component that sits between the mobile application and the cloud-based service provider. This proxy receives authentication requests from the application, performs the authentication process using enterprise credentials stored securely in the enterprise mobile management system, and returns authentication results to the application without exposing the actual credentials. The proxy acts as a mediator that enables authentication while protecting the sensitivity of enterprise credentials.
2Reliability
If sandboxed applications perform their own authentication, then application security isolation is improved, but single sign-on capability deteriorates as applications cannot share sessions or tokens
Solution Approach 1:
The identity provider proxy serves multiple functions within the authentication architecture. It acts as an authentication endpoint for sandboxed applications, a session management system that maintains user state, and a token issuance authority that provides portable authentication credentials. By consolidating these functions in a central proxy, the system enables single sign-on across multiple sandboxed applications while each application maintains its security isolation, as the proxy handles the complex authentication logic that spans application boundaries.
3Reliability
If redirection to a separate identity provider is implemented, then authentication security is improved, but application compatibility deteriorates as some apps do not support certain protocols or redirection techniques
Solution Approach 1:
The identity provider proxy serves as an intermediary that adapts authentication requests from applications with varying protocol support. It receives authentication requests from applications that may have limited protocol capabilities, performs the necessary authentication operations using enterprise credentials, and returns results in formats compatible with the requesting application. This intermediary approach allows the system to maintain strong authentication security while supporting a broader range of applications that might not fully support complex redirection protocols.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
Techniques to provide secure access to a cloud-based service are disclosed. In various embodiments, a request is received from a client app on a device to connect to a security proxy associated with the cloud-based service. A secure tunnel connection between the device and a node with which the security proxy is associated is used to establish the requested connection to the security proxy. Information associated with the secure tunnel is used to determine that the requesting client app is authorized to access the cloud-based service from the device and to obtain from an identity provider associated with the cloud- based service a security token to be used by the client app to authenticate to the cloud-based service.