Back to results
US 11,641,361 B2Granted
Dynamic access control to network resources using federated full domain logon
AssigneeCitrix Systems, Inc.
InventorsAndrew Innes, Chris Mayers
Life of this patent
Estimating the term…
Abstract
Methods and systems for granting or denying a client device access to one or more resources in a remote computing environment are described herein. A computing device may receive from an identity provider a token authenticating that a user of a client device is at a first location. The computing device may determine, based on the token, one or more labels for a session associated with the user. Each label of the one or more labels is associated with a corresponding security group. Based on the one or more labels, the user of the client device may be granted access to sensitive data.
Claims18
A method comprising:
- receiving, by one or more computing devices and from an identity provider, a token authenticating that a user of a client device is at a first geographic location;
- determining, by the one or more computing devices and based on the token, one or more labels for a session associated with the user, wherein each label of the one or more labels is associated with a corresponding security group;
- based on the one or more labels, granting the user of the client device access to sensitive data;
- disconnecting the user of the client device from the session;
- after the disconnecting the user, receiving a request to reconnect the user to the session;
- receiving, by the one or more computing devices, a second token indicating that the user is at a second geographic location different from the first geographic location;
- and
- based on the second token, granting the user access to general data and denying the user access to the sensitive data.
5 more elements
An apparatus comprising:
- one or more processors;
- and
- memory storing instructions that, when executed by the one or more processors, cause the apparatus to:
- receive, from an identity provider, a token authenticating that a user of a client device is at a first geographic location;
- determine, based on the token, one or more labels for a session associated with the user, wherein each label of the one or more labels is associated with a corresponding security group;
- based on the one or more labels, grant the user of the client device access to sensitive data;
- disconnect the user of the client device from the session;
- after the disconnecting the user, receive a request to reconnect the user to the session;
- receive a second token indicating that the user is at a second geographic location different from the first geographic location;
- and
- based on the second token, grant the user access to general data and denying the user access to the sensitive data.
8 more elements
A system comprising:
- a computing device;
- and
- an identity provider comprising:
- one or more processors;
- and
- memory storing instructions that, when executed by the one or more processors of the identity provider, cause the identity provider to:
- send, to the computing device, a token indicating that a user of a client device is at a first geographic location,
- wherein the computing device comprises:
- one or more processors;
- and
- memory storing instructions that, when executed by the one or more processors of the computing device, cause the computing device to:
- determine, based on the token, one or more labels for a session associated with the user, wherein each label of the one or more labels is associated with a corresponding security group;
- based on the one or more labels, grant the user of the client device access to sensitive data;
- disconnect the user of the client device from the session;
- after the disconnecting the user, receive a request to reconnect the user to the session;
- receive a second token indicating that the user is at a second geographic location different from the first geographic location;
- and
- based on the second token, grant the user access to general data and denying the user access to the sensitive data.
15 more elements
Dependencies are inferred from the claim text.