Unified identity platform for multiple cloud services

Patent metadata

Field	Value
Publication number	US-12495044-B2
Application number	US-202318494125-A
Country	US
Kind code	B2
Filing date	Oct 25, 2023
Priority date	Jun 14, 2023
Publication date	Dec 9, 2025
Grant date	Dec 9, 2025

Abstract

Systems and methods for providing identity services are provided. A method, according to one implementation, includes a step of assuming unified and centralized responsibility for performing identity-related services for a plurality of network security products. In response to an end user device attempting to initiate a session with a selected network security product of the plurality of network security products, the method may perform the identity-related services to manage or authenticate an identity of the end user device or a user of the end user device. Then, the method includes a step of enabling the end user device to establish the session with or receive a service from the selected network security product after performing the identity-related services.

First claim

What is claimed is:

1 . An Identity Provider (IdP) system comprising:
a processing device, and a memory device configured to store a computer program having instructions that, when executed, enable the processing device to
assume unified and centralized responsibility for performing identity-related services for a plurality of network security products;
in response to an end user device attempting to initiate a session with a selected network security product of the plurality of network security products, perform the identity-related services to manage or authenticate an identity of the end user device or a user of the end user device, wherein the IdP system comprises a centralized identity platform configured to execute an authentication process that provides centralized enhancements to identity-related functionalities, wherein the centralized enhancements made within the IdP system are automatically and simultaneously propagated to each of the plurality of network security products, thereby ensuring standardized identity-related configurations, uniform authentication behaviors, and a consistent user experience across all of the plurality of network security products; and
enable the end user device to establish the session with or receive a service from the selected network security product after performing the identity-related services.

2 . The IdP system of claim 1 , wherein, by assuming unified and centralized responsibility for performing the identity-related services for the plurality of network security products, the IdP system avoids duplication of the identity-related services by the plurality of network security products.

3 . The IdP system of claim 1 , wherein the IdP system is related to a cloud-based system oriented between the end user device and the Internet.

4 . The IdP system of claim 1 , wherein the instructions further enable the processing device to institute a Single Sign-On (SSO) procedure for accessing the plurality of network security products.

5 . The IdP system of claim 1 , wherein managing or authenticating the identity of the end user device or user includes support of authentication processes associated with one or more of Security Assertion Markup Language (SAML), OAuth 1.0, OAuth 2.0, and OpenID Connect.

6 . The IdP system of claim 1 , wherein managing or authenticating the identity of the end user device or user includes support of authentication processes associated with one or more of a System for Cross-domain Identity Management (SCIM), a system that spans multiple data centers, a Lightweight Directory Access Protocol (LDAP), an Active Directory (AD), and an authentication bridge service.

7 . The IdP system of claim 1 , further comprising one or more of a metadata manager, an organization configuration manager, a provisioning manager, and a notification manager.

8 . The IdP system of claim 1 , further comprising a database configured to store or log ID information related to one or more user IDs, device IDs, and authentication attempts.

9 . The IdP system of claim 1 , further comprising an inbound authentication unit, an authentication manager, and an outbound federated authentication unit configured in combination to perform the identity-related services.

10 . The IdP system of claim 1 , further comprising an inbound provisioning unit, a provisioning manager, and an outbound provisioning unit configured in combination to manage identity-related messaging with the plurality of network security products.

11 . The IdP system of claim 1 , wherein the instructions further enable the processing device to act as a Certificate Authority and sync a mobile portal to an ID store.

12 . The IdP system of claim 1 , wherein the instructions further enable the processing device to protect applications associated with a Cloud Access Security Broker (CASB).

13 . The IdP system of claim 1 , further comprising a single portal or User Interface (UI) allowing a user to navigate the plurality of network security products.

14 . A non-transitory computer-readable storage medium configured to store computer logic having instructions that, when executed, cause one or more processing devices to:
assume unified and centralized responsibility for performing identity-related services for a plurality of network security products; in response to an end user device attempting to initiate a session with a selected network security product of the plurality of network security products, perform the identity-related services to manage or authenticate an identity of the end user device or a user of the end user device, wherein the one or more processing devices comprise a centralized identity platform configured to execute an authentication process that provides centralized enhancements to identity-related functionalities, wherein the centralized enhancements made within the IdP system are automatically and simultaneously propagated to each of the plurality of network security products, thereby ensuring standardized identity-related configurations, uniform authentication behaviors, and a consistent user experience across all of the plurality of network security products; and enable the end user device to establish the session with or receive a service from the selected network security product after performing the identity-related services.

15 . The non-transitory computer-readable storage medium of claim 14 , wherein, by assuming unified and centralized responsibility for performing the identity-related services for the plurality of network security products, duplication of the identity-related services by the plurality of network security products is avoided.

16 . The non-transitory computer-readable storage medium of claim 14 , further comprising a single portal or User Interface (UI) allowing a user to navigate the plurality of network security products, wherein the instructions further cause the one or more processing devices to use the single portal or UI to institute a Single Sign-On (SSO) procedure for accessing the plurality of network security products.

17 . The non-transitory computer-readable storage medium of claim 14 , wherein managing or authenticating the identity of the end user device or user includes support of authentication processes associated with one or more of Security Assertion Markup Language (SAML), OAuth 1.0, OAuth 2.0, OpenID Connect, a System for Cross-domain Identity Management (SCIM), a system that spans multiple data centers, a Lightweight Directory Access Protocol (LDAP), an Active Directory (AD), and an authentication bridge service.

18 . A method comprising steps of:
assuming unified and centralized responsibility for performing identity-related services for a plurality of network security products; in response to an end user device attempting to initiate a session with a selected network security product of the plurality of network security products, performing the identity-related services to manage or authenticate an identity of the end user device or a user of the end user device, wherein the steps are performed in a centralized identity platform configured to execute an authentication process that provides centralized enhancements to identity-related functionalities, wherein the centralized enhancements made within the IdP system are automatically and simultaneously propagated to each of the plurality of network security products, thereby ensuring standardized identity-related configurations, uniform authentication behaviors, and a consistent user experience across all of the plurality of ne

Assignees

• Zscaler Inc

Inventors

• Attarwala Murtuza
• Wang Alice
• Udupa Siva

Classifications

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title