Securing communication over a network using client system authorization and dynamically assigned proxy servers

1. A method for providing secure access to network resources, comprising:

at a trust broker system having one or more processors and memory storing one or more programs for execution by the one or more processors, wherein the trust broker system enables a client system to connect to a server system through a secure communication session:

receiving, from the client system, a request to access network applications and resources associated with and hosted by the server system;

locating a first virtual domain of a plurality of virtual domains, wherein:

each virtual domain provides a respective logical set of network applications and resources, distinct from other virtual domains, wherein a respective logical set of network applications and information corresponds to a subset of network resources provided by the server system, and

the first virtual domain provides the requested network applications and resources;

determining whether the client system is authorized to access the requested network applications and resources, including:

determining the identity of a user associated with the client system; and

determining whether the user associated with the client system is authorized to access the requested network applications and resources, including

retrieving stored permissions of the user associated with the client system; and

determining, based on the stored permissions associated with the user, that the user is permitted to access the first virtual domain;

in response to determining that the client system has authorization to access the requested network applications and resources:

determining, from a plurality of potential proxy servers, a proxy server associated with the server system;

transmitting an identification value for the client system to the determined proxy server, wherein the identification value is an encrypted value identifying the client system;

transmitting the identification value to the client system; and

transmitting, to the client system, contact information for connecting to the determined proxy server, wherein all communication between the client system and the server system associated with the requested network applications and resources passes through the determined proxy server.

2. The method of claim 1 , wherein determining a proxy server associated with the server system further includes:

determining the specific server system associated with the requested network applications and resources by examining a lookup table stored on the trust broker system.

3. The method of claim 2 , wherein determining a proxy server associated with the server system further includes:

determining the proxy server currently associated with the determined server system.

4. An electronic device for providing secure access to network resources, wherein the electronic device comprises a trust broker system which enables a client system to connect to a server system through a secure communication session, comprising:

one or more processors;

memory storing one or more programs to be executed by the one or more processors;

the one or more programs comprising instructions for:

receiving, from the client system, a request to access network applications and resources associated with and hosted by the server system;

locating a first virtual domain of a plurality of virtual domains, wherein:

each virtual domain provides a respective logical set of network applications and resources, distinct from other virtual domains, wherein a respective logical set of network applications and information corresponds to a subset of network resources provided by the server system, and

the first virtual domain provides the requested network applications and resources;

determining whether the client system is authorized to access the requested network applications and resources, including:

determining the identity of a user associated with the client system; and

determining whether the user associated with the client system is authorized to access the requested network applications and resources, including

retrieving stored permissions of the user associated with the client system; and

determining, based on the stored permissions associated with the user, that the user is permitted to access the first virtual domain;

in response to determining that the client system has authorization to access the requested network applications and resources:

determining, from a plurality of potential proxy servers, a proxy server associated with the server system;

transmitting an identification value for the client system to the determined proxy server, wherein the identification value is an encrypted value identifying the client system;

transmitting the identification value to the client system; and

transmitting, to the client system, contact information for connecting to the determined proxy server, wherein all communication between the client system and the server system associated with the requested network applications and resources passes through the determined proxy server.

5. The device of claim 4 , wherein the instructions for determining a proxy server associated with the server system further include instructions for:

determining the specific server system associated with the requested network applications and resources by examining a lookup table stored on the trust broker system.

6. The device of claim 5 , wherein the instructions for determining a proxy server associated with the server system further include instructions for:

determining the proxy server currently associated with the determined server system.

7. A non-transitory computer readable storage medium storing one or more programs configured for execution by an electronic device, wherein the electronic device comprises a trust broker system which enables a client system to connect to a server system through a secure communication session, the one or more programs comprising instructions for:

receiving, from the client system, a request to access network applications and resources associated with and hosted by the server system;

locating a first virtual domain of a plurality of virtual domains, wherein:

each virtual domain provides a respective logical set of network applications and resources, distinct from other virtual domains, wherein a respective logical set of network applications and information corresponds to a subset of network resources provided by the server system, and

the first virtual domain provides the requested network applications and resources;

determining whether the client system is authorized to access the requested network applications and resources, including:

determining the identity of a user associated with the client system; and

determining whether the user associated with the client system is authorized to access the requested network applications and resources, including

retrieving stored permissions of the user associated with the client system; and

determining, based on the stored permissions associated with the user, that the user is permitted to access the first virtual domain;

in response to determining that the client system has authorization to access the requested network applications and resources:

determining, from a plurality of potential proxy servers, a proxy server associated with the server system;

transmitting an identification value for the client system to the determined proxy server, wherein the identification value is an encrypted value identifying the client system;

transmitting the identification value to the client system; and

transmitting, to the client system, contact information for connecting to the determined proxy server, wherein all communication between the client system and the server system associated with the requested network applications and resources passes through the determined proxy server.

8. The non-transitory computer readable storage medium of claim 7 , wherein the instructions for determining a proxy server associated with the server system further include instructions for:

determining the specific server system associated with the requested network applications and resources by examining a lookup table stored on the trust broker system.

9. The non-transitory computer readable storage medium of claim 8 , wherein the instructions for determining a proxy server associated with the server system further include instructions for:

determining the proxy server currently associated with the determined server system.

10. The method of claim 1 , wherein determining whether the client system is authorized to access the requested network applications and resources further includes:

verifying hardware and/or software integrity of the client system; and

verifying the identity of the user associated with the client system, including receiving a unique user identifier that is encrypted with a one-time session-based key that is changed for each communication session.

11. The device of claim 4 , wherein the instructions determining whether the client system is authorized to access the requested network applications and resources further include instructions for:

verifying hardware and/or software integrity of the client system; and

verifying the identity of the user associated with the client system, including receiving a unique user identifier that is encrypted with a one-time session-based key that is changed for each communication session.

12. The non-transitory computer readable storage medium of claim 7 , wherein the instructions determining whether the client system is authorized to access the requested network applications and resources further include instructions for:

verifying hardware and/or software integrity of the client system; and

verifying the identity of the user associated with the client system, including receiving a unique user identifier that is encrypted with a one-time session-based key that is changed for each communication session.