Granted Patent B2

US 10,122,714 · App. 15/098,312 · Granted Nov 6, 2018

Abstract

Claims (55)

1. A method, comprising:

receiving, by a first device, an application access request from a client device across a network, the application access request including a request for access to an application and authentication credentials for a user, the authentication credentials are transmitted in clear-text to the first device;

encrypting, by the first device, the authentication credentials in the application access request, the encrypted authentication credentials only decryptable by the first device;

sending, by the first device, the received application access request that includes the encrypted authentication credentials to a second device;

receiving, by the first device, the encrypted authentication credentials from the second device;

decrypting, by the first device, the encrypted authentication credentials; and

sending, by the first device, the decrypted authentication credentials to an authentication server.

2. The method as recited in claim 1 , wherein the authentication server determines whether the decrypted authentication credentials are valid and sends the determination to the first device.

3. The method as recited in claim 1 , wherein the first device is a proxy server.

4. The method as recited in claim 1 , further comprising:

receiving, by the first device, a validation determination from the authentication server;

sending, by the first device, the validation determination to the second device.

5. The method as recited in claim 1 , further comprising:

receiving, by the first device, a validation determination from the authentication server;

sending, by the first device, the validation determination to the second device;

receiving, by the first device, a response to the application access request from the second device;

sending, by the first device, the response to the client device.

6. The method as recited in claim 1 , wherein the second device is an application server.

7. The method as recited in claim 1 , wherein the application access request requests access to an application stored on the second device.

8. The method as recited in claim 1 , wherein the application access request requests access to a resource managed by the second device.

9. The method as recited in claim 1 , wherein the application access request requests access to application specific data stored on the second device.

10. The method as recited in claim 1 , wherein prior to the encrypting the authentication credentials:

receiving, by the first device, a digitally signed certificate from the client device;

validating, by the first device, the digitally signed certificate by using a public key of the client device to decrypt the digitally signed certificate;

upon successful decryption of the digitally signed certificate, performing the encrypting the authentication credentials step.

11. A system, comprising:

a message receiver, implemented at least partially in hardware at a first device, that receives an application access request from a client device across a network, the application access request including a request for access to an application and authentication credentials for a user, the authentication credentials are transmitted in clear-text to the first device;

an authentication credential encrypter, implemented at least partially in hardware at the first device, that encrypts the authentication credentials in the application access request, the encrypted authentication credentials only decryptable by the first device;

a message transmitter, implemented at least partially in hardware at the first device, that sends the received application access request that includes the encrypted authentication credentials to a second device;

wherein the message receiver receives the encrypted authentication credentials from the second device;

an authentication credential decrypter, implemented at least partially in hardware at the first device, that decrypts the encrypted authentication credentials; and

wherein the message transmitter sends the decrypted authentication credentials to an authentication server.

12. The system as recited in claim 11 , wherein the authentication server determines whether the decrypted authentication credentials are valid and sends the determination to the first device.

13. The system as recited in claim 11 , wherein the first device is a proxy server and the second device is an application server.

14. The system as recited in claim 11 , wherein the message receiver receives a validation determination from the authentication server, wherein the message transmitter sends the validation determination to the second device, wherein the message receiver receives a response to the application access request from the second device, and wherein the message transmitter sends the response to the client device.

15. The system as recited in claim 11 , wherein the application access request requests access to a resource managed by the second device.

16. One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of:

receiving, by a first device, an application access request from a client device across a network, the application access request including a request for access to an application and authentication credentials for a user, the authentication credentials are transmitted in clear-text to the first device;

encrypting, by the first device, the authentication credentials in the application access request, the encrypted authentication credentials only decryptable by the first device;

sending, by the first device, the received application access request that includes the encrypted authentication credentials to a second device;

receiving, by the first device, the encrypted authentication credentials from the second device;

decrypting, by the first device, the encrypted authentication credentials; and

sending, by the first device, the decrypted authentication credentials to an authentication server.

17. The one or more non-transitory computer-readable storage media as recited in claim 16 , wherein the authentication server determines whether the decrypted authentication credentials are valid and sends the determination to the first device.

18. The one or more non-transitory computer-readable storage media as recited in claim 16 , wherein the first device is a proxy server and the second device is an application server.

19. The one or more non-transitory computer-readable storage media as recited in claim 16 , wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to further perform:

receiving, by the first device, a validation determination from the authentication server;

sending, by the first device, the validation determination to the second device;

receiving, by the first device, a response to the application access request from the second device;

sending, by the first device, the response to the client device.

20. The one or more non-transitory computer-readable storage media as recited in claim 16 , wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to further perform:

wherein prior to the encrypting the authentication credentials:

receiving, by the first device, a digitally signed certificate from the client device;

validating, by the first device, the digitally signed certificate by using a public key of the client device to decrypt the digitally signed certificate;

upon successful decryption of the digitally signed certificate, performing the encrypting the authentication credentials step.

Assignments (7)