Secured access to resources using a proxy
A method of authentication and accessing resources is provided. A client device may send a request to a proxy device to access a resource, such as an enterprise resource. The proxy device may authenticate with one or more servers associated with the resource. During authentication, the proxy device may receive a request for a signature controlled by the client device. In response, the proxy device may send a request to the client device for the signature. The request may also include context information that identify a data structure of authentication information exchanged (or to be exchanged) during the authentication session. If the client device verifies the context information, the client device may send the requested signature.
1. A method comprising:
during an authentication session between a proxy device and a resource management device to authenticate the proxy device with the resource management device, generating, by the proxy device, a request for a client device to provide a signature, wherein the request for the client device to provide the signature comprises context information identifying authentication information previously exchanged between the proxy device and the resource management device during the authentication session between the proxy device and the resource management device to authenticate the proxy device or authentication information to be sent by the proxy device to the resource management device during the authentication session between the proxy device and the resource management device to authenticate the proxy device;
receiving, at the proxy device and from the client device, the signature; and
sending, from the proxy device to the resource management device, the signature.
2. The method of claim 1 , further comprising:
during the authentication session, receiving, at the proxy device and from the client device, a list of security certificates available to the client device; and
selecting a security certificate for the authentication session,
wherein the request for the client device to provide the signature includes an identification of the selected security certificate.
3. The method of claim 1 , further comprising:
after sending the signature to the resource management device, receiving, at the proxy device, a session key corresponding to the signature.
4. The method of claim 3 , further comprising:
using, by the proxy device, the session key to obtain, from the resource management device, a resource requested by the client device.
5. The method of claim 4 , further comprising:
sending, from the proxy device to the client device, the resource.
6. The method of claim 1 , wherein the authentication session comprises SSL authentication, and wherein the context information comprises one or more SSL authentication message previously exchanged between the proxy device and the resource management device during the authentication session.
7. The method of claim 1 , wherein the authentication session comprises Kerberos authentication, and wherein the context information comprises information identifying a Kerberos data structure.
8. The method of claim 7 , wherein the Kerberos data structure comprises Abstract Syntax Notation 1.
9. The method of claim 1 , wherein the authentication session comprises Kerberos authentication, and wherein the context information comprises at least one of a Kerberos domain used for the Kerberos authentication, a Kerberos principal name associated with the client device, an identifier of a key distribution center used for the authentication session, a validity period of a requested ticket, and Kerberos flags that have been set during the authentication session.
10. The method of claim 1 , wherein the context information identifies a timestamp associated with the authentication session.
11. The method of claim 1 , wherein the context information identifies a protocol type of the authentication session.
12. The method of claim 1 , wherein the signature is provided from a smart card at the client device.
13. A proxy device comprising:
a processor; and
memory storing computer-executable instructions that, when executed by the processor, cause the proxy device to:
during an authentication session between the proxy device and a resource management device to authenticate the proxy device with the resource management device, generate a request for a client device to provide a signature, wherein the request for the client device to provide the signature comprises context information identifying authentication information previously exchanged between the proxy device and the resource management device during the authentication session between the proxy device and the resource management device to authenticate the proxy device or authentication information to be sent by the proxy device to the resource management device during the authentication session between the proxy device and the resource management device to authenticate the proxy device;
receive, from the client device, the signature; and
send, to the resource management device, the signature.
14. The proxy device of claim 13 , wherein the memory stores computer-executable instructions that, when executed by the processor, cause the proxy device to:
after sending the signature to the resource management device, receive a session key corresponding to the signature.
15. The proxy device of claim 14 , wherein the memory stores computer-executable instructions that, when executed by the processor, cause the proxy device to:
use the session key to obtain, from the resource management device, a resource requested by the client device.
16. The proxy device of claim 13 , wherein the authentication session comprises SSL authentication, and wherein the context information comprises one or more SSL authentication message previously exchanged between the proxy device and the resource management device during the authentication session.
17. The proxy device of claim 13 , wherein the authentication session comprises Kerberos authentication, and wherein the context information comprises information identifying a Kerberos data structure.
18. A method comprising:
receiving, at a client device from a proxy device, a request for the client device to provide a signature, wherein the request for the client device to provide the signature comprises context information identifying authentication information previously exchanged between the proxy device and a resource management device during an authentication session between the proxy device and the resource management device to authenticate the proxy device with the resource management device or authentication information to be sent by the proxy device to the resource management device during the authentication session between the proxy device and the resource management device to authenticate the proxy device;
verifying, by the client device, the context information; and
in response to verifying the context information, sending, from the client device to the proxy device, a signature corresponding to a security certificate.
19. The method of claim 18 , wherein the security certificate is stored on a smart card connected to the client device.
20. The method of claim 18 , further comprising:
in response to a request, sending, from the client device to the proxy device, a list comprising one or more security certificates available to the client device,
wherein the received request for the client device to provide the signature includes an identification of a security certificate selected from the list comprising one or more security certificates.