Granted Patent B1

US 11,546,323 · App. 17/889,788 · Granted Jan 3, 2023

Inventors: William Craig Jones (Cedar Park, TX); Justin Allan McCarthy (Redwood City, CA); Patrick David Stephen (Minneapolis, MN); Evan Michael Todd (Culver City, CA)

Assignee: strongDM, Inc.

H04L63/083

Abstract

Claims (133)

1. A method for managing access to network resources in a network using one or more processors that are configured to execute instructions, wherein the execution of the instructions enables performance of actions, comprising:

providing a plurality of mesh agents for an overlay network, wherein each mesh agent is hosted on one or more network computers in the overlay network, and wherein the overlay network is employed to provide a secure tunnel between a client and a resource server; and

in response to a client request that requires user credentials being provided to a mesh agent associated with the resource server, performing further actions, including:

providing credential instructions to the mesh agent based on the client request, wherein the credential instructions are employed to determine credential information that enables access to the resource server;

employing the mesh agent to communicate the client request and the credential information to the resource server;

determining a response to the client request from the resource server; and

employing the mesh agent to receive a response to the client request from the resource server, wherein the response is forwarded to the client over the overlay network.

2. The method of claim 1 , wherein determining the credential information, further comprises:

determining one or more of a grammar or a ruleset based on the credential instructions and the client request;

employing the one or more of the grammar or the ruleset to interpret the credential instructions;

determining one or more actions for acquiring access to the credential information based on the interpretation of the credential instructions; and

executing the one or more actions to determine the credential information.

3. The method of claim 1 , wherein determining the credential information, further comprises:

determining one or more credential vaults based on the credential instructions, wherein one or more portions of the credential information are stored in the one or more credential vaults;

determining one or more actions that enable access to the one or more credential vaults based on the credential instructions; and

executing the one or more actions to obtain the credential information from the one or more credential vaults.

4. The method of claim 1 , wherein communicating the client request and the credential information from the mesh agent to the resource server, further comprises:

determining one or more portions of the client request that are associated with passing one or more credential secrets to the resource server based on an application protocol;

modifying the client request to include one or more portions of the credential information based on the one or more portions of the client request that are associated with passing the one or more credential secrets to the resource server based on the application protocol;

further modifying the client request based on the included one or more portions of the credential information, wherein the further modifications to the client request include one or more of an updated checksum, an updated hash digest value, or an updated message size value; and

providing the modified client request to the resource server.

5. The method of claim 1 , further comprising:

providing the client request to a mesh agent associated with the client application;

determining an application protocol associated with the client request based on one or more of the client request, the client application, or the resource server;

determining one or more portions of the client request that are associated with passing one or more credential secrets to the resource server based on the application protocol;

modifying the client request to include one or more placeholder secrets based on the one or more portions of the client request that are associated with passing the one or more credential secrets to the resource server based on the application protocol;

further modifying the client request based on the included one or more placeholder secrets, wherein the further modifications to the client request include one or more of an updated checksum, an updated hash digest value, or an updated message size value; and

communicating the modified client request to the overlay network for delivery to the resource server.

6. The method of claim 1 , wherein the one or more further actions performed in response to the client request, further comprise:

providing a request to an infrastructure security computer (ISC) in the overlay network to authorize the client request; and

in response to the ISC rejecting the authorization request, rejecting the client request and disabling the mesh agent from communicating the client request and the credential information to the resource server.

7. A network computer for managing access to network resources, comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

providing a plurality of mesh agents for an overlay network, wherein each mesh agent is hosted on one or more network computers in the overlay network, and wherein the overlay network is employed to provide a secure tunnel between a client and a resource server; and

in response to a client request that requires user credentials being provided to a mesh agent associated with the resource server, performing further actions, including:

providing credential instructions to the mesh agent based on the client request, wherein the credential instructions are employed to determine credential information that enables access to the resource server;

employing the mesh agent to communicate the client request and the credential information to the resource server;

determining a response to the client request from the resource server; and

employing the mesh agent to receive a response to the client request from the resource server, wherein the response is forwarded to the client over the overlay network.

8. The network computer of claim 7 , wherein determining the credential information, further comprises:

determining one or more of a grammar or a ruleset based on the credential instructions and the client request;

employing the one or more of the grammar or the ruleset to interpret the credential instructions;

determining one or more actions for acquiring access to the credential information based on the interpretation of the credential instructions; and

executing the one or more actions to determine the credential information.

9. The network computer of claim 7 , wherein determining the credential information, further comprises:

determining one or more credential vaults based on the credential instructions, wherein one or more portions of the credential information are stored in the one or more credential vaults;

determining one or more actions that enable access to the one or more credential vaults based on the credential instructions; and

executing the one or more actions to obtain the credential information from the one or more credential vaults.

10. The network computer of claim 7 , wherein communicating the client request and the credential information from the mesh agent to the resource server, further comprises:

determining one or more portions of the client request that are associated with passing one or more credential secrets to the resource server based on an application protocol;

modifying the client request to include one or more portions of the credential information based on the one or more portions of the client request that are associated with passing the one or more credential secrets to the resource server based on the application protocol;

further modifying the client request based on the included one or more portions of the credential information, wherein the further modifications to the client request include one or more of an updated checksum, an updated hash digest value, or an updated message size value; and

providing the modified client request to the resource server.

11. The network computer of claim 7 , wherein the one or more processors execute instructions that perform actions, further comprising:

providing the client request to a mesh agent associated with the client application;

determining an application protocol associated with the client request based on one or more of the client request, the client application, or the resource server;

determining one or more portions of the client request that are associated with passing one or more credential secrets to the resource server based on the application protocol;

modifying the client request to include one or more placeholder secrets based on the one or more portions of the client request that are associated with passing the one or more credential secrets to the resource server based on the application protocol;

further modifying the client request based on the included one or more placeholder secrets, wherein the further modifications to the client request include one or more of an updated checksum, an updated hash digest value, or an updated message size value; and

communicating the modified client request to the overlay network for delivery to the resource server.

12. The network computer of claim 7 , wherein the one or more further actions performed in response to the client request, further comprise:

providing a request to an infrastructure security computer (ISC) in the overlay network to authorize the client request; and

in response to the ISC rejecting the authorization request, rejecting the client request and disabling the mesh agent from communicating the client request and the credential information to the resource server.

13. A processor readable non-transitory storage media that includes instructions for managing access to network resources over a network, wherein execution of the instructions by one or more processors on one or more network computers performs actions, comprising:

providing a plurality of mesh agents for an overlay network, wherein each mesh agent is hosted on one or more network computers in the overlay network, and wherein the overlay network is employed to provide a secure tunnel between a client and a resource server; and

in response to a client request that requires user credentials being provided to a mesh agent associated with the resource server, performing further actions, including:

providing credential instructions to the mesh agent based on the client request, wherein the credential instructions are employed to determine credential information that enables access to the resource server;

employing the mesh agent to communicate the client request and the credential information to the resource server;

determining a response to the client request from the resource server; and

employing the mesh agent to receive a response to the client request from the resource server, wherein the response is forwarded to the client over the overlay network.

14. The media of claim 13 , wherein determining the credential information, further comprises:

determining one or more of a grammar or a ruleset based on the credential instructions and the client request;

employing the one or more of the grammar or the ruleset to interpret the credential instructions;

determining one or more actions for acquiring access to the credential information based on the interpretation of the credential instructions; and

executing the one or more actions to determine the credential information.

15. The media of claim 13 , wherein determining the credential information, further comprises:

determining one or more credential vaults based on the credential instructions, wherein one or more portions of the credential information are stored in the one or more credential vaults;

determining one or more actions that enable access to the one or more credential vaults based on the credential instructions; and

executing the one or more actions to obtain the credential information from the one or more credential vaults.

16. The media of claim 13 , wherein communicating the client request and the credential information from the mesh agent to the resource server, further comprises:

determining one or more portions of the client request that are associated with passing one or more credential secrets to the resource server based on an application protocol;

modifying the client request to include one or more portions of the credential information based on the one or more portions of the client request that are associated with passing the one or more credential secrets to the resource server based on the application protocol;

further modifying the client request based on the included one or more portions of the credential information, wherein the further modifications to the client request include one or more of an updated checksum, an updated hash digest value, or an updated message size value; and

providing the modified client request to the resource server.

17. The media of claim 13 , further comprising:

providing the client request to a mesh agent associated with the client application;

determining an application protocol associated with the client request based on one or more of the client request, the client application, or the resource server;

determining one or more portions of the client request that are associated with passing one or more credential secrets to the resource server based on the application protocol;

modifying the client request to include one or more placeholder secrets based on the one or more portions of the client request that are associated with passing the one or more credential secrets to the resource server based on the application protocol;

further modifying the client request based on the included one or more placeholder secrets, wherein the further modifications to the client request include one or more of an updated checksum, an updated hash digest value, or an updated message size value; and

communicating the modified client request to the overlay network for delivery to the resource server.

18. The media of claim 13 , wherein the one or more further actions performed in response to the client request, further comprise:

providing a request to an infrastructure security computer (ISC) in the overlay network to authorize the client request; and

in response to the ISC rejecting the authorization request, rejecting the client request and disabling the mesh agent from communicating the client request and the credential information to the resource server.

19. A system for method for managing access to network resources, comprising:

a network computer, comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

providing a plurality of mesh agents for an overlay network, wherein each mesh agent is hosted on one or more network computers in the overlay network, and wherein the overlay network is employed to provide a secure tunnel between a client and a resource server; and

in response to a client request that requires user credentials being provided to a mesh agent associated with the resource server, performing further actions, including:

providing credential instructions to the mesh agent based on the client request, wherein the credential instructions are employed to determine credential information that enables access to the resource server;

employing the mesh agent to communicate the client request and the credential information to the resource server;

determining a response to the client request from the resource server; and

employing the mesh agent to receive a response to the client request from the resource server, wherein the response is forwarded to the client over the overlay network; and

a client computer, comprising:

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

providing the client request.

20. The system of claim 19 , wherein determining the credential information, further comprises:

determining one or more of a grammar or a ruleset based on the credential instructions and the client request;

employing the one or more of the grammar or the ruleset to interpret the credential instructions;

determining one or more actions for acquiring access to the credential information based on the interpretation of the credential instructions; and

executing the one or more actions to determine the credential information.

21. The system of claim 19 , wherein determining the credential information, further comprises:

determining one or more credential vaults based on the credential instructions, wherein one or more portions of the credential information are stored in the one or more credential vaults;

determining one or more actions that enable access to the one or more credential vaults based on the credential instructions; and

executing the one or more actions to obtain the credential information from the one or more credential vaults.

22. The system of claim 19 , wherein communicating the client request and the credential information from the mesh agent to the resource server, further comprises:

determining one or more portions of the client request that are associated with passing one or more credential secrets to the resource server based on an application protocol;

modifying the client request to include one or more portions of the credential information based on the one or more portions of the client request that are associated with passing the one or more credential secrets to the resource server based on the application protocol;

further modifying the client request based on the included one or more portions of the credential information, wherein the further modifications to the client request include one or more of an updated checksum, an updated hash digest value, or an updated message size value; and

providing the modified client request to the resource server.

23. The system of claim 19 , wherein the one or more network computer processors execute instructions that perform further actions comprising:

providing the client request to a mesh agent associated with the client application;

determining an application protocol associated with the client request based on one or more of the client request, the client application, or the resource server;

determining one or more portions of the client request that are associated with passing one or more credential secrets to the resource server based on the application protocol;

modifying the client request to include one or more placeholder secrets based on the one or more portions of the client request that are associated with passing the one or more credential secrets to the resource server based on the application protocol;

further modifying the client request based on the included one or more placeholder secrets, wherein the further modifications to the client request include one or more of an updated checksum, an updated hash digest value, or an updated message size value; and

communicating the modified client request to the overlay network for delivery to the resource server.

24. The system of claim 19 , wherein the one or more further actions performed in response to the client request, further comprise:

providing a request to an infrastructure security computer (ISC) in the overlay network to authorize the client request; and

in response to the ISC rejecting the authorization request, rejecting the client request and disabling the mesh agent from communicating the client request and the credential information to the resource server.

Assignments (2)

Cited By (11)

US 12,242,599 US 12,284,224 US 12,323,468 US 12,348,519 US 12,355,770 US 12,423,418 US 12,432,242 US 12,603,921 US 12,627,560 US 12,670,246 US 12,695,793