Application authentication wrapper

Patent metadata

Field	Value
Publication number	US-2017279792-A1
Application number	US-201615082070-A
Country	US
Kind code	A1
Filing date	Mar 28, 2016
Priority date	Mar 28, 2016
Publication date	Sep 28, 2017
Grant date	—

Abstract

Disclosed are various approaches for implementing an application authentication wrapper. An authentication request, such as a Kerberos request, is created for authenticating the computing device. The authentication request is encrypted to generate an encrypted authentication request. The encrypted authentication request is then forwarded to a reverse proxy server. An encrypted authentication response is received from the reverse proxy server. The encrypted authentication response, such as a Kerberos response, is then decrypted to generate a corresponding authentication response, which is then forwarded to the computing device that generated the authentication request.

First claim

Therefore, the following is claimed:

1 . A system, comprising:
a computing device comprising a processor, a memory, and a network interface; an application comprising machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
create an authentication request for authenticating the computing device;
encrypt the authentication request to generate encrypted authentication request; and
forward the encrypted authentication request to a reverse proxy server.

2 . The system of claim 1 , wherein the application further causes the computing device to at least:
decrypt an authentication response received from the reverse proxy server.

3 . The system of claim 1 , wherein the application is configured to imitate a Kerberos key distribution center (KDC) service.

4 . The system of claim 1 , wherein the application further causes the computing device to at least embed the authentication request within a transmission control protocol (TCP) stream.

5 . The system of claim 1 , wherein the application further causes the computing device to at least wrap the authentication request within a request encoded according to a version of the hypertext transport protocol (HTTP).

6 . The system of claim 1 , wherein the authentication request is encrypted according to a version of the secure sockets layer (SSL) protocol or the transport layer security (TLS) protocol.

7 . The system of claim 1 , wherein the authentication request complies with a version of the Kerberos protocol.

8 . A method, comprising:
creating, by a computing device, an authentication request for authenticating the computing device; encrypting, by the computing device, the authentication request to generate encrypted authentication request; and forwarding, by the computing device, the encrypted authentication request to a reverse proxy server.

9 . The method of claim 8 , further comprising decrypting, by the computing device, an authentication response received from the reverse proxy server

10 . The method of claim 8 , further comprising imitating, by the computing device, a Kerberos key distribution center (KDC) service.

11 . The method of claim 8 , further comprising embedding, by the computing device, the authentication request within a transmission control protocol (TCP) stream.

12 . The method of claim 8 , further comprising wrapping, by the computing device, the authentication request within a request encoded according to a version of the hypertext transport protocol (HTTP).

13 . The method of claim 8 , wherein the authentication request is encrypted according to a version of the secure sockets layer (SSL) protocol or the transport layer security (TLS) protocol.

14 . The method of claim 8 , wherein the authentication request complies with a version of the Kerberos protocol.

15 . A non-transitory computer readable medium comprising machine readable instructions that, when executed by a processor of a computing device, cause the computing device to at least:
create an authentication request for authenticating the computing device; encrypt the authentication request to generate encrypted authentication request; and forward the encrypted authentication request to a reverse proxy server.

16 . The non-transitory computer readable medium of claim 15 , wherein the machine readable instructions further cause the computing device to at least decrypt an authentication response received from the reverse proxy server.

17 . The non-transitory computer readable medium of claim 15 , wherein the machine readable instructions further cause the computing device to at least imitate a Kerberos key distribution center (KDC) service.

18 . The non-transitory computer readable medium of claim 15 , wherein the machine readable instructions further cause the computing device to at least embed the authentication request within a transmission control protocol (TCP) stream.

19 . The non-transitory computer readable medium of claim 15 , wherein the machine readable instructions further cause the computing device to at least wrap the authentication request within a request encoded according to a version of the hypertext transport protocol (HTTP).

20 . The non-transitory computer readable medium of claim 15 , wherein the authentication request is encrypted according to a version of the secure sockets layer (SSL) protocol or the transport layer security (TLS) protocol.

Assignees

• Airwatch Llc

Inventors

• Tse Kar Fai
• Lu Chen
• Stuntebeck Erich

Classifications

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/166

  at the transport layer · CPC title