Enforcing restrictions on third-party accounts

Patent metadata

Field	Value
Publication number	US-10560435-B2
Application number	US-201715445054-A
Country	US
Kind code	B2
Filing date	Feb 28, 2017
Priority date	Jun 13, 2013
Publication date	Feb 11, 2020
Grant date	Feb 11, 2020

Abstract

Disclosed are various embodiments for management of third-party accounts for users in an organization. A request is received from a client corresponding to a user in an organization to access a third-party network site under management by the organization. The third-party network site is operated by a third party that does not correspond to the organization. It is determined whether network traffic between the client and the third-party network site is routed via a proxy server operated by the organization. Access of the client to a managed account with the third-party network site is denied in response to determining that the network traffic between the client and the third-party network site is not routed via the proxy server.

First claim

Therefore, the following is claimed:

1. A method, comprising:
receiving, via an authentication management service executed by at least one of one or more computing devices with memory, a request from a client to access account credentials for a network site;
determining, via the authentication management service, that the client corresponds to a user in an organization and the network site corresponds to a third-party network site under management by the organization, the third-party network site being operated by a third party that does not correspond to the organization;
determining, via the authentication management service, whether network traffic between the client and the third-party network site is routed via a proxy server application operated by the organization; and
denying, via the authentication management service, access of the client to a managed account with the third-party network site in response to determining that the network traffic between the client and the third-party network site is not routed via the proxy server application, wherein denying access of the client to the managed account comprises refraining from providing a security credential of the managed account to the client.

2. The method of claim 1 , wherein the proxy server application is implemented in the client.

3. The method of claim 1 , wherein the managed account is owned by the organization.

4. The method of claim 1 , further comprising blocking, via at least one of the one or more computing devices, access of the client to the third-party network site when the network traffic between the client and the third-party network site is determined not to be routed via the proxy server application.

5. The method of claim 1 , further comprising:
responsive to determining that the network traffic between the client and the third-party network site is routed via the proxy server:
receiving, via at least one of the one or more computing devices, security credentials for the managed account;
authenticating, via at least one of the one or more computing devices, with the third-party network site using the security credentials, wherein the security credentials are inaccessible to the user; and
rendering, via at least one of the one or more computing devices, a user interface based at least in part on data received from the third-party network site after authentication with the third-party network site.

6. The method of claim 1 , wherein the proxy server is configured to inspect the network traffic and enforce a rule restricting access to the managed account.

7. The method of claim 6 , wherein the rule is established based at least in part on whether the user has specified that the managed account is for organizational purposes.

8. The method of claim 6 , further comprising:
receiving, via at least one of the one or more computing devices, a directive generated by the proxy server in response to the proxy server enforcing the rule; and
implementing, via at least one of the one or more computing devices, an action in response to the directive.

9. A system, comprising:
at least one computing device with memory; and
at least one application executable in the at least one computing device, wherein when executed the at least one application causes the at least one computing device to at least:
receive a request from a client to access account credentials for a network site;
determine that the client corresponds to a user in an organization and the network site corresponds to a third-party network site under management by the organization, the third-party network site being operated by a third party that does not correspond to the organization;
determine whether network traffic between the client and the third-party network site is routed via a proxy server operated by the organization; and
deny access of the client to a managed account with the third-party network site in response to determining that the network traffic between the client and the third-party network site is not routed via the proxy server, wherein denying access of the client to the managed account comprises refraining from providing a security credential of the managed account to the client.

10. The system of claim 9 , wherein the managed account is owned by the organization.

11. The system of claim 9 , wherein when executed the at least one application further causes the at least one computing device to at least block access of the client to the third-party network site when the network traffic between the client and the third-party network site is determined not to be routed via the proxy server.

12. The system of claim 9 , wherein when executed the at least one application further causes the at least one computing device to at least, responsive to determining that the network traffic between the client and the third-party network site is routed via the proxy server:
receive security credentials for the managed account;
authenticate with the third-party network site using the security credentials, wherein the security credentials are inaccessible to the user; and
render a user interface based at least in part on data received from the third-party network site after authentication with the third-party network site.

13. The system of claim 9 , wherein the proxy server is configured to inspect the network traffic and enforce a rule restricting access to the managed account.

14. The system of claim 13 , wherein the rule is established based at least in part on whether the user has specified that the managed account is for organizational purposes.

15. The system of claim 13 , wherein when executed the at least one application further causes the at least one computing device to at least:
receive a directive generated by the proxy server in response to the proxy server enforcing the rule; and
implement an action in response to the directive.

16. A method, comprising:
receiving, via an authentication management service executed by at least one of one or more computing devices with memory, a request from a client to access account credentials for a network site;
determining, via the authentication management service, that the client corresponds to a user in an organization and the network site corresponds to a third-party network site under management by the organization, the third-party network site being operated by a third party that does not correspond to the organization;
determining, via the authentication management service, that network traffic between the client and the third-party network site is routed via a proxy server operated by the organization; and
granting, via the authentication management service, access of the client to a managed account with the third-party network site in response to determining that the network traffic between the client and the third-party network site is routed via the proxy server, granting access of the client to the managed account comprises sending a security credential for the managed account to the client.

17. The method of claim 16 , further comprising inspecting, via the proxy server, the network traffic pertaining to use of the managed account for compliance with at least one rule.

Assignees

• Amazon Tech Inc

Inventors

• Johansson Jesper Mikael
• Canavor Darren Ernest
• Mcclintock Jon Arron

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/0281 Primary

  Proxies · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title