Granted Patent B1

US 9,137,131 · App. 13/797,634 · Granted Sep 15, 2015

Abstract

Claims (46)

1. A network traffic monitoring system for redirecting network traffic between a client device and a cloud service, the system comprising:

a monitor proxy server configured as a network intermediary between the client device and a federated identity provider and between the client device and the cloud service, the monitor proxy server being designated by the cloud service to receive a redirected login request, the redirected login request being a login request originated from the client device and destined for the cloud service for accessing the cloud service, the login request being redirected by the cloud service to the monitor proxy server as the redirected login request wherein the redirected login request identifies the cloud service, the monitor proxy server being configured to provide, on behalf of the client device, a login credential including a password of the client device to the federated identity provider in response to the client device being redirected to the monitor proxy server by the cloud service and to receive from the federated identity provider a redirect response including an identity assertion or token generated by the federated identity provider upon user authentication, the redirect response containing a redirect web address to the cloud service, the monitor proxy server being configured to rewrite the redirect web address to the web address of the monitor proxy server, the monitor proxy server further being configured to rewrite a response web address in network communications between the cloud service and the client device to the web address of the monitor proxy server,

wherein network traffic between the cloud service and the client device is routed through the monitor proxy server after user authentication by the federated identity provider.

2. The system of claim 1 , wherein the monitor proxy server comprises a first reverse proxy server configured as a network intermediary between the client device and the federated identity provider, and a second reverse proxy server configured as a network intermediary between the client device and the cloud service, the first reverse proxy server being designated by the cloud service to receive a redirected login request from the client device, the first reverse proxy server being configured to provide, on behalf of the client device, a login credential of the client device to the federated identity provider in response to the client device being redirected to the first reverse proxy server by the cloud service,

wherein the first reverse proxy server is configured to receive the redirect response generated by the federated identity provider upon user authentication, the redirect response containing the redirect web address to the cloud service, the first reverse proxy server is further configured to rewrite the redirect web address to the web address of the second reverse proxy server, and the second reverse proxy server is configured to rewrite a response web address in network communications between the cloud service and the client device to the web address of the second reverse proxy server.

3. The system of claim 1 , wherein the client device accesses services of the cloud service on behalf of an enterprise, the enterprise employing the federated identity provider to authenticate the client device for access to the cloud service.

4. The system of claim 3 , wherein the cloud service is deployed on the publicly available Internet and the monitor proxy server is installed on the publicly available Internet, on a private data network of the enterprise, or on a third party private data network.

5. The system of claim 4 , wherein the client device accesses the cloud service from within or from outside of the private data network of the enterprise.

6. The system of claim 1 , wherein the monitor proxy server, in response to a redirect response from the federated identity provider upon user authentication, is configured to generate a HTTP redirect to the monitor proxy server.

7. The system of claim 1 , wherein the monitor proxy server receives a redirect response with an authentication token from the federated identity provider upon user authentication, the monitor proxy server is configured to encrypt the authentication token and to provide the encrypted authentication token to the client device.

8. A method in a monitor proxy server for redirecting network traffic between a client device and a cloud service, comprising:

receiving, at the monitor proxy server, a redirected login request from the client device redirected from the cloud service, the monitor proxy server being designated by the cloud service to receive the redirected login request, the redirected login request being a login request originated from the client device and destined for the cloud service, the login request being redirected by the cloud service to the monitor proxy server as the redirected login request wherein the redirected login request identifies the cloud service;

receiving login credentials including a password from the client device;

forwarding the login credential including the password to a federated identity provider for authentication;

receiving, at the monitor proxy server, a redirect response from the federated identity provider with an identity assertion or an authentication token from the federated identity provider, the redirect response containing a redirect web address to the cloud service;

rewriting the redirect web address to the web address of the monitor proxy server;

providing the rewritten redirect response with the authentication token to the client device;

receiving network communications between the client device and the cloud service; and

rewriting response web address in the network communications between the client device and the cloud service to the web address of the monitor proxy server.

9. The method of claim 8 , wherein the monitor proxy server comprises a first reverse proxy server configured as a network intermediary between the client device and the federated identity provider, and a second reverse proxy server configured as a network intermediary between the client device and the cloud service, the method comprising:

receiving at the first reverse proxy server a redirected login request from the client device redirected from the cloud service, the first reverse proxy server being designated by the cloud service to receive the redirected login request from the client device;

receiving at the first reverse proxy server login credentials from the client device;

forwarding the login credential to a federated identity provider for authentication;

receiving at the first reverse proxy server a redirect response with an authentication token from the federated identity provider, the redirect response containing a redirect web address to the cloud service;

rewriting at the first reverse proxy server the redirect web address to the web address of the second reverse proxy server;

providing the rewritten redirect response with the authentication token to the client device;

receiving at the second reverse proxy server network communications between the client device and the cloud service; and

rewriting at the second reverse proxy server response web address in the network communications between the client device and the cloud service to the web address of the monitor proxy server.

10. The method of claim 8 , wherein rewriting the redirect web address to the web address of the monitor proxy server comprises:

generating, in response to the redirect response, a HTTP redirect to the monitor proxy server.

11. The method of claim 8 , further comprising:

encrypting the authentication token; and

providing the rewritten redirect response with the encrypted authentication token to the client device.

12. The method of claim 8 , further comprising:

in response to network communications from the client device directed to the cloud service, providing the network communications to the cloud service with the authentication token, the authentication token being unencrypted or decrypted.

13. A system for redirecting network traffic between a client device and a cloud service, comprising:

a processor configured to:

receive, at the processor, a redirected login request from the client device redirected from the cloud service, the processor being designated by the cloud service to receive the redirected login request, the redirected login request being a login request originated from the client device and destined for the cloud service, the login request being redirected by the cloud service to the monitor proxy server as the redirected login request wherein the redirected login request identifies the cloud service;

receive login credentials including a password from the client device;

forward the login credential including the password to a federated identity provider for authentication;

receive, at the processor, a redirect response from the federated identity provider with an identity assertion or an authentication token from the federated identity provider, the redirect response containing a redirect web address to the cloud service;

rewrite the redirect web address to the web address of a monitor proxy server;

provide the rewritten redirect response with the authentication token to the client device;

receive at the monitor proxy server network communications between the client device and the cloud service; and

rewrite response web address in the network communications between the client device and the cloud service to the web address of the monitor proxy server; and

a memory coupled to the processor and configured to provide the processor with instructions.

Assignments (15)