# US 11,115,417 B2 · Secured access control to cloud-based applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,115,417 B2 - Document ID: US11115417B2 - Status: Granted - Kind: B2 - Application number: 15/082,768 - Filed: 2016-03-28 - Published: 2016-11-24 - Granted: 2021-09-07 - Earliest claimed: 2015-05-19 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC. - Inventors: Vitaly Khait; Ami Luttwak; Liran Moysi; Ariel Stolovich; Greg Vishnepolsky - Web page: https://patentgrep.com/patent/US11115417B2 ## CPC - H04L 63/102: {Entity profiles} - G06F 21/33: using certificates - G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1433: {Vulnerability analysis} - H04W 12/08: Access security - G06F 2221/2101: Auditing as a secondary aspect - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method and proxy device for securing an access to a cloud-based application are presented. In an embodiment, the method includes receiving an authentication token that includes an identity of a user of a client device requesting an access to the cloud-based application. The method further includes receiving, from an agent executed in the client device, a client certificate; retrieving, from a compliance server, a device posture of the client device, wherein the device posture is retrieved respective of the received client certificate; identifying an access policy for the client device to access the cloud-based application, and determining whether to grant an access to the cloud-based application based in part on the compliance of the client device with the identified access policy. In an embodiment, the access policy is identified based at least on the retrieved device posture. ## Claims ### Claim 1 A method for securing an access to a cloud-based application, comprising: receiving, by an authentication proxy device, an authentication token, wherein the authentication token includes an identity of a user of a client device requesting an access to the cloud-based application, wherein the client device is at least an un-managed device, and wherein the authentication proxy device is connected between the un-managed client device and a cloud computing platform hosting the cloud-based application to be secured, wherein the un-managed client device is not secured by an organization; receiving, from an agent executed in the un-managed client device, a client certificate; retrieving, from a compliance server, a device posture of the un-managed client device, wherein the device posture is retrieved respective of the received client certificate; identifying an access policy, from among a plurality of access polices configured with the authentication proxy device, for the un-managed client device to access the cloud-based application, wherein the access policy is identified based at least on the retrieved device posture; and determining whether to grant an access to the cloud-based application based in part on the compliance of the un-managed client device with the identified access policy. ### Claim 2 (depends on 1) The method of claim 1, further comprising: checking if the agent is installed in the un-managed client device; and causing at least one of: installation of the agent in the un-managed client device and execution of the agent in the un-managed client device, when the un-managed client device does not include the agent. ### Claim 3 (depends on 1) The method of claim 1, wherein the device posture characterizes at least security capabilities that the un-managed client device is configured with. ### Claim 4 (depends on 3) The method of claim 3, wherein the device posture includes at least a set of compliance parameters and a unique certificate associated with the un-managed client device. ### Claim 5 (depends on 4) The method of claim 4, wherein each compliance parameter includes a compliance status of at least one of: at least one security capability of the un-managed client device. ### Claim 6 (depends on 4) The method of claim 4, wherein the device posture is compiled using information provided by at least one of: a central authentication system, an end-point Data Loss Prevention (DLP) service, a network access control (NAC) service, and a mobile device management (MDM) service. ### Claim 7 (depends on 1) The method of claim 1, wherein the access policy includes a plurality of attributes, a plurality of conditions, and a policy action. ### Claim 8 (depends on 7) The method of claim 7, wherein determining whether to grant an access to the cloud-based application further comprises: determining which of the plurality of conditions and of the plurality of attributes set in the access policy are met; and allowing an access to the cloud-based application based on the determined met conditions and attributes. ### Claim 9 (depends on 8) The method of claim 8, wherein the policy action includes any one of: allow full access, block access, and allow limited access. ### Claim 10 (depends on 8) The method of claim 8, wherein the determination of which of the plurality of conditions and attributes are met is performed using information retrieved from at least one of: a central authentication system, a compliance server, an external reputation service, and a lightweight directory access protocol (LDAP) service. ### Claim 11 (depends on 1) The method of claim 1, further comprising: securing an access to the cloud-based application by a managed client device, wherein the managed client device and the un-managed client device are of the same user. ### Claim 12 (depends on 1) The method of claim 1, wherein the authentication token is received from a central authentication system, wherein the central authentication system is any of: a federated identity management (FIdM) system, and a single-sign-on (SSO) server. ### Claim 13 (depends on 1) A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute the method according to claim 1. ### Claim 14 An authentication proxy device for securing an access to a cloud-based application, wherein the authentication proxy device is connected between a client device and a cloud computing platform hosting the cloud-based application, comprising: a processing system; and a memory, the memory containing instructions that, when executed by the processing system, configure the proxy device to: receive an authentication token, wherein the authentication token includes an identity of a user of a client device requesting an access to the cloud-based application, wherein the client device is at least an un-managed device, wherein the un-managed client device is not secured by an organization; receive, from an agent executed in the un-managed client device, a client certificate; retrieve, from a compliance server, a device posture of the un-managed client device, wherein the device posture is retrieved respective of the received client certificate; identify an access policy, from among a plurality of access polices configured with the authentication proxy device, for the un-managed client device to access the cloud-based application, wherein the access policy is identified based at least on the retrieved posture; and determine whether to grant an access to the cloud-based application based in part on the compliance of the un-managed client device with the identified access policy. ### Claim 15 (depends on 14) The proxy device of claim 14, wherein the proxy device is further configured to: check if the agent is installed in the un-managed client device; and cause at least one of installation of the agent in the un-managed client device and execution of the agent in the un-managed client device, when the un-managed client device does not include the agent. ### Claim 16 (depends on 14) The proxy device of claim 14, wherein the device posture characterizes at least security capabilities that the un-managed client device is configured with. ### Claim 17 (depends on 16) The proxy device of claim 16, wherein the device posture includes at least a set of compliance parameters and a unique certificate associated with the un-managed client device. ### Claim 18 (depends on 17) The proxy device of claim 17, wherein each compliance parameter includes a compliance status of at least one of: at least one security capability of the un-managed client device. ### Claim 19 (depends on 17) The proxy device of claim 17, wherein the device posture is compiled using information provided by at least one of: a central authentication system, an end-point Data Loss Prevention (DLP) service, a network access control (NAC) service, and a mobile device management (MDM) service. ### Claim 20 (depends on 14) The proxy device of claim 14, wherein the access policy includes a plurality of attributes, a plurality of conditions, and a policy action. ### Claim 21 (depends on 20) The proxy device of claim 20, wherein the proxy device is further configured to: determine which of the plurality of conditions and of the plurality of attributes set in the access policy are met; and allow an access to the cloud-based application based on the determined met conditions and attributes. ### Claim 22 (depends on 21) The proxy device of claim 21, wherein the determination of which of the plurality of conditions and attributes are met is performed using information retrieved from at least one of: a central authentication system, a compliance server, an external reputation service, and a lightweight directory access protocol (LDAP) service. ### Claim 23 (depends on 20) The proxy device of claim 20, wherein the policy action includes any one of: allow full access, block access, and allow limited access. ### Claim 24 (depends on 14) The proxy device of claim 14, further comprising: securing an access to the cloud-based application by a managed client device, wherein the managed client device and the un-managed client device are of the same user. ### Claim 25 (depends on 14) The proxy device of claim 14, wherein the authentication token is received from a central authentication system, wherein the central authentication system is any of: a federated identity management (FIdM) system, and a single-sign-on (SSO) server. ### Claim 26 A cloud computing platform, comprising: at least one server configured to host at least one cloud-based application; a compliance server; an authentication proxy device connected between the client device and the at least one server hosting the cloud-based application to be secured, wherein the authentication proxy device includes a processing system and a memory; the memory containing instructions that, when executed by the processing system, configure the authentication proxy device to: receive an authentication token, wherein the authentication token includes an identity of a user of a client device requesting an access to the cloud-based application, wherein the client device is at least an un-managed device, wherein the un-managed client device is not secured by an organization; receive, from an agent executed in the un-managed client device, a client certificate; retrieve, from the compliance server, a device posture of the un-managed client device, wherein the device posture is retrieved respective of the received client certificate; identify an access policy, from among a plurality of access polices configured with the authentication proxy device, for the un-managed client device to access the cloud-based application, wherein the access policy is identified based at least on the retrieved posture; and determine whether to grant an access to the cloud-based application based in part on the compliance of the un-managed client device with the identified access policy.