Distributed cloud-based security systems and methods

1. A distributed security system comprising:

a plurality of content processing nodes communicatively coupled to an authority node, implemented in hardware, that are located external to a network edge of an enterprise and located external from one of a computer device and a mobile device associated with a user, wherein an external system is any of the enterprise, the computer device, and the mobile device, and wherein a content processing node is configured to

receive a request from the user for a domain;

identify one or more previously assigned authentication and authorization states of the user;

determine, based on data transmitted by the user and the one or more previously assigned authentication and authorization states, for the requested domain, an authentication and authorization state for the user;

store the determined authentication and authorization state for the user;

utilize the stored authentication and authorization state to process subsequent requests for the user, wherein the authentication and authorization state can include any of an Unauthenticated (UA) state, an Authenticated for a Location (AL) state, an Authenticated User (AU) state, and an Authorized for a Domain (AD) state, and wherein the transmitted data or lack of transmitted data identifies the user as belonging to an authentication and authorization state;

maintain the authentication and authorization states of users that submit requests to the content processing node;

process requests from the one of the computer device and the mobile device to a domain based on a level of authentication or authorization the user has obtained, wherein the content processing node is configured as a proxy for the one of the computer device and the mobile device;

one of: allow the user to transmit requests to the domain, allow a user to obtain content from the domain through the content processing node, allow a user to obtain content directly from the domain, or request credentials from a user in order for the user to become authenticated, wherein the domain is located external from the plurality of content processing nodes, and wherein the authority node is configured to provide policy data for an external system to each of the plurality of content processing nodes and monitor health of each of the plurality of content processing nodes to redirect and balance traffic among the plurality of content processing nodes based thereon, wherein the health relates to operational status including at least one of resource availability and communication link status of the plurality of content processing nodes;

wherein when the request is a new domain, the content processing node is further configured to

determine if the user is in an Authorized User (AU) state, wherein the AU state is determined by identifying if the user is authorized to submit requests to the content processing node;

responsive to determining that the user is in the AU state, examine policy associated with the user;

determine the user is authorized to access the new domain based on the policy; and

maintain an AD state for the user for the new domain.

2. The distributed security system of claim 1 , wherein the UA state indicates that the user has not obtained any level of authentication or authorization, the AL state indicates that the user is authenticated to transmit requests to a domain of the processing node, the AU state indicates that the identity of the user has already been validated, and that the processing node is able to determine what level of authorization the user has, and the AD state indicates that the user is an authorized user of the processing node for a specific domain.

3. The distributed security system of claim 1 , wherein authentication and authorization data is stored as an http cookie assigned to a domain.

4. The distributed security system of claim 1 , wherein the content processing node is further configured to

submit a redirect response to a client browser to solicit authorized user data responsive to determining that a client browser is not in an Authorized for a Domain (AD) state.

5. The distributed security system of claim 1 , wherein a client browser can transition between the plurality of authentication and authorization states based on received authentication data.

6. A content processing node comprising:

a processor for performing instructions and one or more memory devices for storing instructions and data, wherein the content processing node is part of a distributed security system and is located external to a network edge of an enterprise and located external from one of a computer device and a mobile device associated with a user, wherein an external system is any of the enterprise, the computer device, and the mobile device,

wherein the instructions cause the processorto perform steps of

receiving a request from the user for a domain;

identifying one or more previously assigned authentication and authorization states of the user;

determining, based on data transmitted by the user and the one or more previously assigned authentication and authorization states, for the requested domain, an authentication and authorization state for the user;

storing the determined authentication and authorization state for the user;

utilizing the stored authentication and authorization state to process subsequent requests for the user, wherein the authentication and authorization state can include any of an Unauthenticated (UA) state, an Authenticated for a Location (AL) state, an Authenticated User (AU) state, and an Authorized for a Domain (AD) state, and wherein the transmitted data or lack of transmitted data identifies the user as belonging to an authentication and authorization state;

maintaining the authentication and authorization states of users that submit requests to the content processing node;

processing requests to from the one of the computer device and the mobile device to a domain based on a level of authentication or authorization the user has obtained, wherein the content processing node is configured as a proxy for the one of the computer device and the mobile device; and

one of: allowing the user to transmit requests to the domain, allowing a user to obtain content from the domain through the content processing node, allowing a user to obtain content directly from domain, or requesting credentials from a user in order for the user to become authenticated, wherein the domain is located external from the plurality of content processing nodes, and wherein an authority node is configured to provide policy data for an external system to each of the plurality of content processing nodes and monitor health of each of the plurality of content processing nodes to redirect and balance traffic among the plurality of content processing nodes based thereon, wherein the health relates to operational status including at least one of resource availability and communication link status of the plurality of content processing nodes;

wherein when the request is a new domain, the content processing node is further configured to

determine if the user is in an Authorized User (AU) state, wherein the AU state is determined by identifying if the user is authorized to submit requests to the content processing node;

responsive to determining that the user is in the AU state, examine policy associated with the user;

determine the user is authorized to access the new domain based on the policy; and

maintain an AD state for the user for the new domain.

7. The content processing node of claim 6 , wherein the UA state indicates that the user has not obtained any level of authentication or authorization, the AL state indicates that the user is authenticated to transmit requests to a domain of the processing node, the AU state indicates that the identity of the user has already been validated, and that the processing node is able to determine what level of authorization the user has, and the AD state indicates that the user is an authorized user of the processing node for a specific domain.

8. The content processing node of claim 6 , wherein authentication and authorization data is stored as an http cookie assigned to a domain.

9. The content processing node of claim 6 , the steps further comprising

submitting a redirect response to a client browser to solicit authorized user data responsive to determining that a client browser is not in an Authorized for a Domain (AD) state.

10. The content processing node of claim 6 , wherein a client browser can transition between the plurality of authentication and authorization states based on received authentication data.

11. A non-transitory computer-readable medium comprising instructions that, when executed, cause a processor to

receive a request from a user for a domain;

identify one or more previously assigned authentication and authorization states of the user;

determine, based on data transmitted by the user and the one or more previously assigned authentication and authorization states, for the requested domain, an authentication and authorization state for the user;

storing the determined authentication and authorization state for the user;

utilizing the stored authentication and authorization state to process subsequent requests for the user, wherein the authentication and authorization state can include any of an Unauthenticated (UA) state, an Authenticated for a Location (AL) state, an Authenticated User (AU) state, and an Authorized for a Domain (AD) state, and wherein the transmitted data or lack of transmitted data identifies the user as belonging to an authentication and authorization state;

maintain the authentication and authorization states of users that submit requests to a content processing in a distributed security system;

process requests to from the one of the computer device and the mobile device to a domain based on a level of authentication or authorization the user has obtained, wherein the content processing node is configured as a proxy for the one of the computer device and the mobile device; and

one of: allow the user to transmit requests to the domain, allow a user to obtain content from the domain through the content processing node, allow a user to obtain content directly from the domain, or request credentials from a user in order for the user to become authenticated, wherein the domain is located external fromthe plurality of content processing nodes, and wherein an authority node is configured to provide policy data for an external system to each of the plurality of content processing nodes and monitor health of each of the plurality of content processing nodes to redirect and balance traffic among the plurality of content processing nodes based thereon, wherein the health relates to operational status including at least one of resource availability and communication link status of the plurality of content processing nodes;

wherein when the request is a new domain, the content processing node is further configured to

determine if the user is in an Authorized User (AU) state, wherein the AU state is determined by identifying if the user is authorized to submit requests to the content processing node;

responsive to determining that the user is in the AU state, examine policy associated with the user;

determine the user is authorized to access the new domain based on the policy; and

maintain an AD state for the user for the new domain.

12. The non-transitory computer-readable medium of claim 11 , wherein the UA state indicates that the user has not obtained any level of authentication or authorization, the AL state indicates that the user is authenticated to transmit requests to a domain of the processingnode, the AU state indicates that the identity of the user has already been validated, and that the processing node is able to determine what level of authorization the user has, and the AD state indicates that the user is an authorized user of the processing node for a specific domain.

13. The non-transitory computer-readable medium of claim 11 , wherein authentication and authorization data is stored as an http cookie assigned to a domain.

14. The non-transitory computer-readable medium of claim 11 , wherein the instructions further cause the processor to

submit a redirect response to a client browser to solicit authorized user data responsive to determining that a client browser is not in an Authorized for a Domain (AD) state.

15. The non-transitory computer-readable medium of claim 11 , wherein a client browser can transition between the plurality of authentication and authorization states based on received authentication data.