Patent ID: 11916907
Assignee: SOPHOS LIMITED
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 11:
12. A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs steps of:
receiving a request from a compute instance belonging to a first enterprise network at a firewall directly associated with a second enterprise network that is independent from the first enterprise network, the request received through the second enterprise network and addressed to a network resource coupled to a public internetwork separated from the second enterprise network by the firewall, the firewall coupled to the second enterprise network through a first network interface and coupled to the public internetwork through a second network interface, the compute instance coupled through the second enterprise network to the first network interface of the firewall;
verifying an association of a user of the compute instance with the first enterprise network with a cryptographic authentication of the user of the compute instance at a remote threat management facility that is external to the first enterprise network and the second enterprise network and is coupled to the firewall through the public internetwork, wherein the remote threat management facility is configured to provide security services independently for a first plurality of authenticated users associated with the first enterprise network and for a second plurality of authenticated users associated with the second enterprise network and is configured to manage a security policy for the firewall;
based on authentication of the user with respect to the first enterprise network and a policy for trusted guests, transmitting an authorization from the remote threat management facility to the firewall directly associated with the second enterprise network for the compute instance belonging to the first enterprise network to access the network resource coupled to the public internetwork via the second enterprise network and through the first and second interfaces and the firewall; and
in response to the authorization, transmitting the request from the compute instance through the firewall of the second enterprise network to the network resource.