Controlling access to resources on a network

Patent metadata

Field	Value
Publication number	US-9769266-B2
Application number	US-201414197385-A
Country	US
Kind code	B2
Filing date	Mar 5, 2014
Priority date	Dec 9, 2011
Publication date	Sep 19, 2017
Grant date	Sep 19, 2017

Abstract

Control of access to resources on a network may be provided. A request to access enterprise resource(s), the request comprising a set of user access credentials and a device identifier, may be generated. The request to access the at least one enterprise resource and an updated device profile may be provided to an authorization service. A set of enterprise access credentials may be received from the authorization service and used to generate a second request to access the enterprise resource(s).

First claim

What is claimed:

1. A non-transitory computer-readable medium embodying program instructions executable in a client device that, when executed by the client device, cause the client device to:
generate a request on the client device to access an enterprise resource from an enterprise device, the request comprising user access credentials and a device identifier corresponding to the client device;
cause the request to access the enterprise resource to be communicated to a proxy server configured to:
authenticate a user account of the client device by determining that the user access credentials match approved user access credentials stored in a data store;
authenticate the client device by determining that the device identifier matches an approved device identifier stored in the data store;
communicate with a compliance server to determine that the client device complies with at least one compliance rule based at least in part on a device profile generated for the client device;
associate enterprise access credentials with the client device in response to the client device being authorized by the proxy server and the compliance server to access the enterprise resource;
modify the request to generate a subsequent request to access the enterprise resource for transmission to the enterprise device by replacing the user access credentials with the enterprise access credentials in response to the enterprise access credentials being associated with the client device, the subsequent request further comprising the device identifier;
receive the enterprise resource from the enterprise device in response to the subsequent request being received by the enterprise device from the proxy server and the subsequent request being authenticated by the enterprise device using the enterprise access credentials and the device identifier; and
communicate the enterprise resource to the client device; and

access the enterprise resource received at the client device from the proxy server.

2. The non-transitory computer-readable medium of claim 1 , wherein the user access credentials further comprise login information provided on the client device.

3. The non-transitory computer-readable medium of claim 2 , wherein the login information further comprises a user name, a password, biometric data, or a combination thereof.

4. The non-transitory computer-readable medium of claim 1 , further comprising program instructions that, when executed by the client device, cause the client device to provide the device profile to the compliance server on a periodic basis.

5. The non-transitory computer-readable medium of claim 4 , further comprising program instructions that, when executed, cause the client device to access a notification received from the proxy server that the device profile failed a compliance check performed by the compliance server.

6. The non-transitory computer-readable medium of claim 1 , wherein the request to access the enterprise resource on the client device is initiated on the client device via a network page rendered on a display of the client device.

7. The non-transitory computer-readable medium of claim 1 , wherein:
the request to access the enterprise resource on the client device is initiated on the client device via an enterprise access application locally executed on the client device, and
the request to access the enterprise resource is communicated to the proxy sever by communicating the request to the enterprise device, wherein the enterprise device is configured to reroute the request from the enterprise device to the proxy server.

8. A system, comprising:
a user device comprising a local data store; and
program code executable in the user device that, when executed, causes the user device to:
generate a request to access an enterprise resource from an enterprise device on the user device, the request comprising user access credentials and a device identifier corresponding to the user device; and
cause the request to access the enterprise resource to be communicated to a proxy server configured to:
authenticate a user account of the user device by determining that the user access credentials matches approved user access credentials stored in memory;
authenticate the user device by determining that the device identifier matches an approved device identifier stored in the memory;
communicate with a compliance server to determine that the user device complies with at least one compliance rule based at least in part on a device profile generated for the user device;
associate enterprise access credentials with the user device in response to the user device being authorized by the proxy server and the compliance server to access the enterprise resource;
modify the request to generate a subsequent request to access the enterprise resource for transmission to the enterprise device by replacing the user access credentials with the enterprise access credentials in response to the enterprise access credentials being associated with the user device, the subsequent request further comprising the device identifier;
receive the enterprise resource from the enterprise device in response to the subsequent request being received by the enterprise device from the proxy server and the subsequent request being authenticated by the enterprise device using the enterprise access credentials and the device identifier; and
communicate the enterprise resource to the user device; and

access the enterprise resource received at the user device from the proxy server.

9. The system of claim 8 , wherein the user access credentials further comprise login information provided on the user device.

10. The system of claim 9 , wherein the login information further comprises a user name, a password, biometric data, or a combination thereof.

11. The system of claim 8 , further comprising program code that causes the user device to provide the device profile to the compliance server on a periodic basis.

12. The system of claim 11 , further comprising program code that causes the user device to receive a notification from the proxy server that the device profile failed a compliance check performed by the compliance server.

13. The system of claim 8 , wherein the request to access the enterprise resource on the user device is initiated on the user device via a network page rendered on a display of the user device.

14. The system of claim 8 , wherein:
the request to access the enterprise resource on the user device is initiated on the user device via an enterprise access application locally executed on the user device, and
the request to access the enterprise resource is provided to the proxy sever by communicating the request to the enterprise device, wherein the enterprise device is configured to reroute the request from the enterprise device to the proxy server.

15. A method, comprising:
generating, by a client device in data communication with a proxy server over a network, a request to access an enterprise resource from an enterprise device on the client device, the request comprising user access credentials and a device identifier corresponding to the client device; and
causing, by the client device, the request to access the enterprise resource to be provided to the proxy server, the proxy server being configured to:
authenticate a user account of the client device by determining that the user access credentials match approved user access credentials stored in a data store;
authenticate the client device by determining that the device identifier matches an approved device identifier stored in the data store; and
communi

Assignees

• Skysocket Llc
• Airwatch Llc

Inventors

• Stuntebeck Erich

Classifications

• H04L67/16 Primary

  Electricity · mapped topic

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L67/51 Primary

  Discovery or management thereof, e.g. service location protocol [SLP] or web services · CPC title

• H04W12/37

  Managing security policies for mobile devices or for controlling mobile applications · CPC title