Authorizing delegated capabilities to applications in a secure end-to-end communications system
An organization that wishes its messages to be secure (the “communicating organization”) uses services of a secure communications infrastructure to securely exchange communications among its users. The secure communications infrastructure allows granting to third-party applications the permission to act on behalf of the users when using the secure communications infrastructure. This delegation may be accomplished at a very granular level, specifying the particular applications that are authorized to act on behalf of a user, the particular operations that those applications are authorized to perform, and/or in which contexts the applications may perform the operations. An agent component acts as an intermediary between third-party applications and the core of the secure communications infrastructure. This permits the third-party application to take actions on behalf of the user, while also preventing the third-party applications from obtaining the security-specific data that could lead to a breach of security.
1. A computer-implemented method for enabling a third-party application to act on behalf of a user of an organization when using cryptographic facilities of a secure communications infrastructure, the computer-implemented method comprising:
receiving, from an administrator of the organization, registration of a third-party application to act on behalf of a user of the organization;
authenticating the third-party application for an application session using information received during the registration;
responsive to the authenticating, providing the third-party application with a session token;
receiving, from the third-party application:
a request for initiation of an application-user session during which the third-party application is permitted to act on behalf of the user, and
the session token;
authenticating the third-party application for the application-user session using the session token;
responsive to authenticating the third-party application for the application-user session, providing the third-party application with an application-user session token;
receiving, from the third-party application:
a request to provide a message comprising an encrypted form of data of the third-party application to a recipient user on behalf of the user, and
the application-user session token;
verifying, using the application-user session token, that the third-party application has been registered to provide the encrypted form of the data on behalf of the user;
responsive to the verifying, obtaining a cryptographic conversation key of the user;
without providing the cryptographic conversation key of the user to the third-party application, encrypting the data of the third-party application using the cryptographic conversation key of the user; and
requesting the secure communications infrastructure to send a message comprising the encrypted data of the third-party application to the recipient user on behalf of the user.
2. The computer-implemented method of claim 1 , wherein the registration comprises indications of which operations, from a set of possible operations of the secure communications infrastructure, the third-party application is permitted to perform on behalf of the user.
3. The computer-implemented method of claim 2 , further comprising using the indications to verify that the third-party application has been registered to provide the encrypted form of the data on behalf of the user.
4. The computer-implemented method of claim 1 , further comprising verifying a digital certificate of an agent component and providing an agent session token in response to successful verification.
5. The computer-implemented method of claim 1 , wherein the information received during registration using which the third-party application is authenticated is a client digital certificate of the third-party application.
6. The computer-implemented method of claim 1 , further comprising certifying that the encrypted data is from the third-party application on behalf of the user.
7. A computer-implemented method of using a secure communications infrastructure, the computer-implemented method comprising:
receiving, from an organization, registration of a third-party application to act on behalf of a user of the organization;
authenticating the third-party application for an application session using information received during the registration;
responsive to the authenticating, providing the third-party application with a session token;
receiving, from the third-party application, a request for an application-user session in which the third-party application is permitted to act on behalf of the user;
authenticating the third-party application for the application-user session using the session token;
receiving, from the third-party application, a request to perform a cryptographic operation on behalf of the user;
verifying, using an application-user session token, that the third-party application is permitted to perform the cryptographic operation on behalf of the user,
wherein the application-user session token is provided to the third-party application in response to authenticating the third-party application for the application-user session;
responsive to the verifying, obtaining a cryptographic key of the user; and
without providing the cryptographic key of the user to the third-party application, performing the cryptographic operation on behalf of the user.
8. The computer-implemented method of claim 7 , wherein the registration comprises indications of which operations, from a set of possible operations of the secure communications infrastructure, the third-party application is permitted to perform on behalf of the user.
9. The computer-implemented method of claim 8 , wherein the verifying is performed using the indications.
10. The computer-implemented method of claim 7 , further comprising:
responsive to the authenticating the third-party application for the application-user session, sending the application-user session token to the third-party application;
wherein the verifying is based on the application-user session token.
11. The computer-implemented method of claim 7 , wherein the cryptographic operation encrypts data of the third-party application, the computer-implemented method further comprising requesting the secure communications infrastructure to send a message comprising the encrypted data of the third-party application to a recipient user on behalf of the user.
12. The computer-implemented method of claim 7 , further comprising verifying a digital certificate of an agent component and providing an agent session token in response to successful verification.
13. The computer-implemented method of claim 7 , wherein the information received during registration using which the third-party application is authenticated is a client digital certificate of the third-party application.
14. The computer-implemented method of claim 7 , further comprising certifying that the encrypted data is from the third-party application on behalf of the user.
15. A non-transitory computer-readable storage medium storing instructions that when executed by a computer processor perform actions comprising:
receiving, from an organization, registration of a third-party application to act on behalf of a user of the organization;
authenticating the third-party application for an application session using information received during the registration;
responsive to the authenticating, providing the third-party application with a session token;
receiving, from the third-party application, a request for an application-user session in which the third-party application is permitted to act on behalf of the user;
authenticating the third-party application for the application-user session using the session token;
receiving, from the third-party application, a request to perform a cryptographic operation on behalf of the user;
verifying, using an application-user session token, that the third-party application is permitted to perform the cryptographic operation on behalf of the user,
wherein the application-user session token is provided to the third-party application in response to authenticating the third-party application for the application-user session;
responsive to the verifying, obtaining a cryptographic key of the user; and
without providing the cryptographic key of the user to the third-party application, performing the cryptographic operation on behalf of the user.
16. The non-transitory computer-readable storage medium of claim 15 , wherein the registration comprises indications of which operations, from a set of possible operations of a secure communications infrastructure, the third-party application is permitted to perform on behalf of the user.
17. The non-transitory computer-readable storage medium of claim 16 , wherein the verifying is performed using the indications.
18. The non-transitory computer-readable storage medium of claim 15 , the actions further comprising:
responsive to the authenticating the third-party application for the application-user session, sending the application-user session token to the third-party application;
wherein the verifying is based on the application-user session token.
19. The non-transitory computer-readable storage medium of claim 15 , wherein the cryptographic operation encrypts data of the third-party application, the actions further comprising requesting a secure communications infrastructure to send a message comprising the encrypted data of the third-party application to a recipient user on behalf of the user.
20. The non-transitory computer-readable storage medium of claim 15 , the actions further comprising certifying that the encrypted data is from the third-party application on behalf of the user.