Granted Patent B2

US 12,368,713 · App. 17/473,549 · Granted Jul 22, 2025

Inventors: Suraj Kumar Jaiswal (Santa Clara, CA); Krishna Murthy Pokuri (Sunnyvale, CA); Manish Pathak (Milpitas, CA); Aditya Srinivasa Ivaturi (Santa Clara, CA)

Assignee: Palo Alto Networks, Inc.

H04L63/0892H04L9/3213H04L63/0807

Abstract

Claims (71)

1. A system, comprising:

a processor configured to:

receive a request to access a web service from a client device, comprising to:

send the request to a security processing node (SPN) of a plurality of SPNs for authenticating a user;

redirect, using the SPN, the request to a geo-distributed authentication service including a distributed cache for storing a user's authentication authorization, wherein the distributed cache includes using a geo-replicated database, wherein the geo-replicated database includes a plurality of databases, wherein the plurality of databases includes a first database and a second database, wherein the first database and the second database both cache and distribute authenticated identity state information, wherein the first database is located at a first location across a globe, wherein the second database is located at a second location across the globe, and wherein the redirecting of the request to the geo-distributed authentication service comprises to:

determine, via the distributed cache, whether the geo-distributed authentication service includes a distributed authentication cache cookie, wherein the distributed authentication cache cookie includes an expiration timestamp, wherein the determining comprises to:

determine that a current time is later than a validity time of the expiration timestamp; and

in the event that the current time is later than the validity time of the expiration timestamp, determine that the geo-distributed authentication service does not include the distributed authentication cache cookie; and

in the event that the geo-distributed authentication service does not include the distributed authentication cache cookie:

establish identity with an independent identity provider, wherein the identity is not established in the event that the distributed authentication cache cookie is included;

store authenticated state information for the user in the distributed cache; and

share the authenticated state information using an authorization token, wherein the authorization token includes three or more of the following: the original URL, a current timestamp, a time value of validity, firewall instance id, tenant-id, and/or firewall session-id; and

return the authorization token included in the distributed authentication cache cookie and uniform resource locator (URL) for the web service to facilitate secure access to the web service from the client device, comprising to:

receive a signed and encrypted token via a browser redirect;

upon receiving the signed and encrypted token:

decrypt and validate the signed and encrypted token;

send another redirect to the original URL;

set a site cookie for a domain with user information; and

validate the site cookie; and

in the event that the site cookie is valid, allow the user to access the web service via the original URL; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 , wherein the processor is further configured to:

receive another request to access another web service from the client device;

check for the distributed authentication cache cookie associated with a user's authentication state; and

in response to a determination that the distributed authentication cache cookie associated with the user's authentication state exists and is valid, allow the other request to go to a URL for the other web service.

3. A method, comprising:

receiving a request to access a web service from a client device, comprising:

sending the request to a security processing node (SPN) of a plurality of SPNs for authenticating a user;

redirecting, using the SPN, the request to a geo-distributed authentication service including a distributed cache for storing a user's authentication authorization, wherein the distributed cache includes using a geo-replicated database, wherein the geo-replicated database includes a plurality of databases, wherein the plurality of databases includes a first database and a second database, wherein the first database and the second database both cache and distribute authenticated identity state information, wherein the first database is located at a first location across a globe, wherein the second database is located at a second location across the globe, and wherein the redirecting of the request to the geo-distributed authentication service comprises:

determining, via the distributed cache, whether the geo-distributed authentication service includes a distributed authentication cache cookie, wherein the distributed authentication cache cookie includes an expiration timestamp, wherein the determining comprises:

determining that a current time is later than a validity time of the expiration timestamp; and

in the event that the current time is later than the validity time of the expiration timestamp, determining that the geo-distributed authentication service does not include the distributed authentication cache cookie; and

in the event that the geo-distributed authentication service does not include the distributed authentication cache cookie:

establishing identity with an independent identity provider, wherein the identity is not established in the event that the distributed authentication cache cookie is included;

storing authenticated state information for the user in the distributed cache; and

sharing the authenticated state information using an authorization token, wherein the authorization token includes three or more of the following: the original URL, a current timestamp, a time value of validity, firewall instance id, tenant-id, and/or firewall session-id; and

returning the authorization token included in the distributed authentication cache cookie and uniform resource locator (URL) for the web service to facilitate secure access to the web service from the client device, comprising:

receiving a signed and encrypted token via a browser redirect;

upon receiving the signed and encrypted token:

decrypting and validating the signed and encrypted token;

sending another redirect to the original URL; and

setting a site cookie for a domain with user information;

validating the site cookie; and

in the event that the site cookie is valid, allowing the user to access the web service via the original URL.

4. The method of claim 3 , further comprising:

receiving another request to access another web service from the client device;

checking for the distributed authentication cache cookie associated with a user's authentication state; and

in response to a determination that the distributed authentication cache cookie associated with the user's authentication state exists and is valid, allowing the other request to go to a URL for the other web service.

5. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:

receiving a request to access a web service from a client device, comprising:

sending the request to a security processing node (SPN) of a plurality of SPNs for authenticating a user;

redirecting, using the SPN, the request to a geo-distributed authentication service including a distributed cache for storing a user's authentication authorization, wherein the distributed cache includes using a geo-replicated database, wherein the geo-replicated database includes a plurality of databases, wherein the plurality of databases includes a first database and a second database, wherein the first database and the second database both cache and distribute authenticated identity state information, wherein the first database is located at a first location across a globe, wherein the second database is located at a second location across the globe, and wherein the redirecting of the request to the geo-distributed authentication service comprises:

determining, via the distributed cache, whether the geo-distributed authentication service includes a distributed authentication cache cookie, wherein the distributed authentication cache cookie includes an expiration timestamp, wherein the determining comprises:

determining that a current time is later than a validity time of the expiration timestamp; and

in the event that the current time is later than the validity time of the expiration timestamp, determining that the geo-distributed authentication service does not include the distributed authentication cache cookie; and

in the event that the geo-distributed authentication service does not include the distributed authentication cache cookie:

establishing identity with an independent identity provider, wherein the identity is not established in the event that the distributed authentication cache cookie is included;

storing authenticated state information for the user in the distributed cache; and

sharing the authenticated state information using an authorization token, wherein the authorization token includes three or more of the following: the original URL, a current timestamp, a time value of validity, firewall instance id, tenant-id, and/or firewall session-id; and

returning the authorization token included in the distributed authentication cache cookie and uniform resource locator (URL) for the web service to facilitate secure access to the web service from the client device, comprising:

receiving a signed and encrypted token via a browser redirect;

upon receiving the signed and encrypted token:

decrypting and validating the signed and encrypted token;

sending another redirect to the original URL; and

setting a site cookie for a domain with user information;

validating the site cookie; and

in the event that the site cookie is valid, allowing the user to access the web service via the original URL.

6. The computer program product of claim 5 , further comprising computer instructions for:

receiving another request to access another web service from the client device;

checking for the distributed authentication cache cookie associated with a user's authentication state; and

in response to a determination that the distributed authentication cache cookie associated with the user's authentication state exists and is valid, allowing the other request to go to a URL for the other web service.

Assignments (1)

Continuity (2)

References Cited (19)