# US 11,444,925 B1 · Secure access to a corporate application in an SSH session using a transparent SSH proxy > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,925 B1 - Document ID: US11444925B1 - Status: Granted - Kind: B1 - Application number: 16/591,365 - Filed: 2019-10-02 - Granted: 2022-09-13 - Earliest claimed: 2019-04-10 - Assignees: CA, Inc. - Applicants: CA, Inc. - Inventors: David Patimer; Lior Lev-Tov; Eldad Rudich; Leonid Belkind - Web page: https://patentgrep.com/patent/US11444925B1 ## CPC - H04L 63/102: {Entity profiles} - G06F 9/452: {Remote windowing, e.g. X-Window System, desktop virtualisation (protocols for virtual reality H04L67/131)} - G06F 21/305: {by remotely controlling device operation} - G06F 21/33: using certificates - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/0281: {Proxies} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding - H04L 67/147: Signalling methods or messages providing extensions to protocols defined by standardisation - H04L 67/562: Brokering proxy services - H04L 69/22: Parsing or analysis of headers - H04L 61/2514: between local and global IP addresses - H04L 63/0272: {Virtual private networks} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Secure access to a corporate application in an SSH session using a transparent SSH proxy. In some embodiments, a method may include receiving, at a secure access cloud point of delivery (PoD), from a client application on a client device, a request to access a corporate application that is deployed in a corporate datacenter. The method may also include forwarding, from the secure access cloud PoD, to a connector that is also deployed in the corporate datacenter, the request. The method may further include brokering, by the connector and the secure access cloud PoD, authentication of a user, authorization of access by the user, and an SSH session between the client application and the corporate application using a transparent SSH proxy, with the client application being unaware that the SSH session is brokered by the connector and the secure access cloud PoD. ## Claims ### Claim 1 A computer-implemented method for secure access to a corporate application in a secure shell (SSH) session using a transparent SSH proxy, at least a portion of the method being performed by a computer system comprising one or more processors, the method comprising: receiving, at a secure access cloud point of delivery (PoD), from a client application on a client device, a request to access a corporate application that is deployed in a corporate datacenter; forwarding, from the secure access cloud PoD, to a connector that is also deployed in the corporate datacenter, the request to access the corporate application; and brokering, between the connector and the secure access cloud PoD, authentication of a user, authorization of access by the user, and an SSH session between the client application and the corporate application using a transparent SSH proxy deployed at the secure access cloud PoD, with no corresponding agent being installed at the client device, and with the client application being unaware that the SSH session is brokered by the connector and the secure access cloud PoD. ### Claim 2 (depends on 1) The method of claim 1, wherein the transparent SSH proxy comprises an SSH server paired with an SSH client that are both transparent to the client application. ### Claim 3 (depends on 2) The method of claim 2, further comprising: receiving SSH session requests, at the SSH server, from the client application; sending the SSH session requests, from the SSH server, to the SSH client; and sending the SSH session requests, from the SSH client, to the corporate application via the connector. ### Claim 4 (depends on 3) The method of claim 3, wherein authentication between the client application and the SSH server is separate from authentication between the SSH client and the corporate application to prevent direct access to the corporate application by the client application. ### Claim 5 (depends on 1) The method of claim 1, wherein the transparent SSH proxy comprises: an SSH server paired with an SSH client that are both transparent to the client application; and an HTTP/S proxy. ### Claim 6 (depends on 5) The method of claim 5, further comprising: receiving SSH session requests, at the HTTP/S proxy, from the client application; sending the SSH session requests, from the HTTP/S proxy, to the SSH server; sending the SSH session requests, from the SSH server, to the SSH client; and sending the SSH session requests, from the SSH client, to the corporate application via the connector. ### Claim 7 (depends on 6) The method of claim 6, wherein authentication between the client application and the SSH server is separate from authentication between the SSH client and the corporate application to prevent direct access to the corporate application by the client application. ### Claim 8 A computer-implemented method for secure access to a corporate application in an SSH session using a transparent SSH proxy, at least a portion of the method being performed by a computer system comprising one or more processors, the method comprising: receiving, at a secure access cloud point of delivery (PoD), from a client application on a client device, a request to access a corporate application that is deployed in a corporate datacenter; forwarding, from the secure access cloud PoD, to a connector that is also deployed in the corporate datacenter, the request to access the corporate application; and brokering, between the connector and the secure access cloud PoD, authentication of a user using an identity provider (IdP), authorization of access by the user, and an SSH session between the client application and the corporate application using a transparent SSH proxy deployed at the secure access cloud PoD, with no corresponding agent being installed at the client device, and with the client application being unaware that the SSH session is brokered by the connector and the secure access cloud PoD. ### Claim 9 (depends on 8) The method of claim 8, wherein the authentication of the user using the IdP comprises: the user logging in to a web portal; redirecting the user to the IdP which enforces authentication of the user; returning, from the IdP, a token; and authenticating the user in the SSH session using the token. ### Claim 10 (depends on 9) The method of claim 9, wherein the IdP enforces Multi-Factor Authentication (MFA) of the user. ### Claim 11 (depends on 8) The method of claim 8, wherein the authentication of the user using the IdP comprises: the user logging in to a web portal; redirecting the user to the IdP which enforces authentication of the user; returning, from the IdP, an SSH certificate; and authenticating the user in the SSH session using the SSH certificate. ### Claim 12 (depends on 11) The method of claim 11, wherein the IdP enforces Multi-Factor Authentication (MFA) of the user. ### Claim 13 (depends on 11) The method of claim 11, wherein the SSH certificate is also used for the authorization of access by the user. ### Claim 14 (depends on 13) The method of claim 13, wherein an expiration of the SSH certificate is controlled by the transparent SSH proxy. ### Claim 15 (depends on 13) The method of claim 13, wherein a validity of the SSH certificate is controlled by the transparent SSH proxy. ### Claim 16 (depends on 11) The method of claim 11, further comprising enforcing an out-of-bound second factor authentication request to the user. ### Claim 17 A computer-implemented method for secure access to a corporate application in an SSH session using a transparent SSH proxy, at least a portion of the method being performed by a computer system comprising one or more processors, the method comprising: receiving, at a secure access cloud point of delivery (PoD), from a client application on a client device, a request to access a corporate application that is deployed in a corporate datacenter; forwarding, from the secure access cloud PoD, to a connector that is also deployed in the corporate datacenter, the request to access the corporate application; and brokering, between the connector and the secure access cloud PoD, authentication of a user, authorization of access by the user, and an SSH session between the client application and the corporate application using a transparent SSH proxy, deployed at the secure access cloud PoD, the SSH proxy having a transparent SSH agent, with no corresponding agent being installed at the client device, and with the client application being unaware that the SSH session is brokered by the connector and the secure access cloud PoD. ### Claim 18 (depends on 17) The method of claim 17, wherein the transparent SSH agent creates session keys for the SSH session. ### Claim 19 (depends on 17) The method of claim 17, wherein the transparent SSH agent enforces authorization policy for the SSH session. ### Claim 20 (depends on 17) The method of claim 17, wherein the transparent SSH agent caches SSH keys/credentials for the SSH session and allows automated authentication of the user.