Mobile Iron, Inc.

Ivanti, Inc.

Vijay Pawar

Kumara Das Karunakaran

Jian Liu

Alexei Volkov

Atul Vijay Tulshibagwale

Ivan Golovenko

Renchi Raju

Nimrod Reich-Zilberman

A request generated by an unmanaged app to access a resource is received from a mobile device. A notification is sent to the mobile device. A device level VPN connection to the mobile device is established. A unique identifier is associated with the device level VPN. App level traffic received via the device level VPN is tagged with the unique identifier. Access to the resource is allowed in response to the request based at least in part on a determination based on the tags that app level traffic from a trusted app and app level traffic from the unmanaged app are associated with the same mobile device.

Asserting user, app, and device binding in an unmanaged mobile device

In an embodiment, a system for asserting a mobile identity to users and devices in an enterprise authentication system includes a communication interface and a processor coupled to the interface. The processor is configured to receive, via the communication interface and from a first device, a request to authenticate a user to a service using a unique identity associated with a second device. The processor is configured to determine, based at least in part on the unique identity, an identity certificate associated with the request, generate an identity assertion based at least in part on the identity certificate, and provide the identity assertion via the communication interface to a requesting node with which the request to authenticate is associated.

Asserting a mobile identity to users and devices in an enterprise authentication system

Techniques to provide secure access to a cloud service are disclosed. In various embodiments, enterprise mobility management (EMM) data associated with a set of enterprise users of mobile devices associated with an enterprise is received. Cloud service data associated with use of a cloud service of the cloud service provider by users associated with the enterprise is received and correlated with the EMM data. Usage of the cloud service by said users associated with the enterprise is analyzed, including one or both of access of the cloud service using one or more unmanaged devices and access of the cloud service using one or more unmanaged mobile apps.

Correlating mobile device and app usage with cloud service usage to provide security

Techniques are disclosed to provide VPN and identity based authentication to cloud-based services. In various embodiments, a request to authenticate a user to a service is received. A user identity associated with one or both of the user and the request is determined based at least in part on data comprising the request. An identity assertion is generated based at least in part on the user identity. The identity assertion is provided to a requesting node with which the request to authenticate is associated.

Unified VPN and identity based authentication to cloud-based services

Techniques to provide secure access to a cloud-based service are disclosed. In various embodiments, a request is received from a client app on a device to connect to a security proxy associated with the cloud-based service. A secure tunnel connection between the device and a node with which the security proxy is associated is used to establish the requested connection to the security proxy. Information associated with the secure tunnel is used to determine that the requesting client app is authorized to access the cloud-based service from the device and to obtain from an identity provider associated with the cloud-based service a security token to be used by the client app to authenticate to the cloud-based service.

Identity proxy to provide access control and single sign on

Techniques to provide secure mobile access to a cloud-based service are disclosed. In various embodiments, a request to access the cloud-based service is received from a mobile device. A security certificate associated with the request is used to synthesize a basic authentication header associated with the request. The synthesized basic authentication header is sent to the cloud-based service on behalf of the mobile device.

Secure access to cloud-based services

An authentication-related request sent from a mobile device to an authentication server is received at a proxy server. A posture of the mobile device is dynamically determined based at least in part on information included in the request. The request is validated based at least in part on the dynamically-determined posture. The proxy server communicates with an authentication server on behalf of the mobile device to obtain authentication information usable by the mobile device to access a service.

Growing community of inventors

Palo Alto, CA, United States of America

Vijay Pawar