# US 2019/0319962 A1 · Identity proxy to provide access control and single sign on > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319962 A1 - Document ID: US20190319962A1 - Status: Published application - Kind: A1 - Application number: 16/396,354 - Filed: 2019-04-26 - Published: 2019-10-17 - Earliest claimed: 2015-01-26 - Assignees: Mobile Iron, Inc. - Applicants: Mobile Iron, Inc. - Inventors: Kumara Das Karunakaran; Vijay Pawar; Jian Liu - Web page: https://patentgrep.com/patent/US20190319962A1 ## CPC - H04L 63/102: {Entity profiles} - G06F 21/33: using certificates - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 63/10: {for controlling access to devices or network resources} - H04W 12/06: Authentication - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - H04L 63/0272: {Virtual private networks} - H04L 63/0281: {Proxies} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Techniques to provide secure access to a cloud-based service are disclosed. In various embodiments, a request is received from a client app on a device to connect to a security proxy associated with the cloud-based service. A secure tunnel connection between the device and a node with which the security proxy is associated is used to establish the requested connection to the security proxy. Information associated with the secure tunnel is used to determine that the requesting client app is authorized to access the cloud-based service from the device and to obtain from an identity provider associated with the cloud-based service a security token to be used by the client app to authenticate to the cloud-based service. ## Claims ### Claim 1 A system, comprising: a processor configured to: receive a request associated with a first client app on a device to connect to a security proxy, wherein the first client app is associated with a first cloud-based service; determine that a secure tunnel exists between the device and a second cloud-based service, wherein a second client app is associated with the second cloud-based service, wherein the secure tunnel was used to authenticate the second client app to the second cloud-based service; use the existing secure tunnel to establish a connection to the security proxy; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system of claim 1, wherein the request is sent by the first client app in response to a redirect message received from the first cloud-based service. ### Claim 3 (depends on 2) The system of claim 2, wherein the redirect message includes a URL or other locator associated with the security proxy. ### Claim 4 (depends on 1) The system of claim 1, wherein the secure tunnel is established between the device and a tunnel server associated with the security proxy. ### Claim 5 (depends on 1) The system of claim 1, wherein to establish the secure tunnel, the processor is configured to receive from the device a security certificate. ### Claim 6 (depends on 5) The system of claim 5, wherein the processor is further configured to use information comprising the security certificate to determine one or more of device, app, user, and certificate information. ### Claim 7 (depends on 5) The system of claim 5, wherein the processor is further configured to use information associated with the security certificate to determine that the first client app is authorized to access the first cloud-based service. ### Claim 8 (depends on 1) The system of claim 1, wherein the secure proxy comprises an identity provider proxy configured to have a chained identity provider or other trust-based relationship to the identity provider associated with the second cloud-based service. ### Claim 9 (depends on 8) The system of claim 8, wherein the processor is further configured to determine that the secure tunnel has already been established and to establish the requested connection to the identity provider proxy on behalf of the first client app without requiring any further credential to be provided. ### Claim 10 (depends on 1) The system of claim 1, wherein the processor is further configured to provide a security token to the first client app, wherein the security token comprises a Security Assertion Markup Language (SAML) assertion. ### Claim 11 (depends on 8) The system of claim 8, wherein the security proxy comprises a delegated identity provider. ### Claim 12 (depends on 9) The system of claim 9, wherein the security proxy comprises a service provider proxy. ### Claim 13 (depends on 12) The system of claim 12, wherein the processor is configured to provide and sign a security token as and on behalf of an identity provider proxy associated with the first cloud-based service. ### Claim 14 A method, comprising: receiving a request associated with a first client app on a device to connect to a security proxy, wherein the first client app is associated with a first cloud-based service; determining that a secure tunnel exists between the device and a second cloud-based service, wherein a second client app is associated with the second cloud-based service, wherein the secure tunnel was used to authenticate the second client app to the second cloud-based service; and using the existing secure tunnel to establish a connection to the security proxy. ### Claim 15 (depends on 14) The method of claim 14, wherein the request is sent by the first client app in response to a redirect message received from the first cloud-based service. ### Claim 16 (depends on 15) The method of claim 15, wherein the redirect message includes a URL or other locator associated with a security proxy. ### Claim 17 (depends on 14) The method of claim 14, wherein a security proxy is associated with the system and the secure tunnel is established between the device and a tunnel server running on the system. ### Claim 18 (depends on 15) The method of claim 15, wherein establishing the secure tunnel includes receiving from the device a security certificate. ### Claim 19 A computer program product to provide secure access to a cloud-based service, the computer program product being embodied in a non-transitory computer readable storage device and comprising computer instructions for: receiving a request associated with a first client app on a device to connect to a security proxy, wherein the first client app is associated with a first cloud-based service; determining that a secure tunnel exists between the device and a second cloud-based service, wherein a second client app is associated with the second cloud-based service, wherein the secure tunnel was used to authenticate the second client app to the second cloud-based service; and using the existing secure tunnel to establish a connection to the security proxy. ### Claim 20 (depends on 19) The computer program product of claim 19, wherein the request is sent by the first client app in response to a redirect message received from the first cloud-based service.