User authentication in a cloud environment

Embodiments are directed to authenticating a user to a remote application provisioning service. In one scenario, a client computer system receives authentication credentials from a user at to authenticate the user to a remote application provisioning service that provides virtual machine-hosted remote applications. The client computer system sends the received authentication credentials to an authentication service, which is configured to generate an encrypted token based on the received authentication credentials. The client computer system then receives the generated encrypted token from the authentication service, stores the received encrypted token and the received authentication credentials in a data store, and sends the encrypted token to the remote application provisioning service. The encrypted token indicates to the remote application provisioning service that the user is a valid user.

BACKGROUND

Cloud computing has become increasingly popular for a variety of reasons. For instance, cloud computing allows applications and their associated data to be processed and stored on remote cloud servers. These cloud servers could be physically located anywhere in the world. Typically, these cloud-based applications provide data to users once the user has authenticated to the cloud network. These cloud servers, however, are public-facing, and as such, some application providers may be reluctant to provide applications that require access to sensitive data.

BRIEF SUMMARY

Embodiments described herein are directed to authenticating a user to a remote application provisioning service. In one embodiment, a client computer system receives authentication credentials from a user at to authenticate the user to a remote application provisioning service that provides virtual machine-hosted remote applications. The client computer system sends the received authentication credentials to an authentication service, which is configured to generate an encrypted token based on the received authentication credentials. The client computer system then receives the generated encrypted token from the authentication service, stores the received encrypted token and the received authentication credentials in a data store, and sends the encrypted token to the remote application provisioning service. The encrypted token indicates to the remote application provisioning service that the user is a valid user.

Optionally, the client computer system further receives, from the remote application provisioning service, an indication of remote applications the user is allowed to access. The client computer system receives, from the user, an indication indicating that at least one of the remote applications is to be instantiated. The client computer system then sends the user's stored authentication credentials and the stored encrypted token to the virtual machine that is hosting the specified remote application and, upon being authenticated to the virtual machine that is hosting the specified remote application, accesses the specified remote application.

In another embodiment, a remote application provisioning service receives an encrypted token from a client computer system, where the encrypted token is generated based on authentication credentials provided by a user. The remote application provisioning service decrypts the received encrypted token, determines the user's identity from the decrypted token, determines, based on the user's identity, which remote applications the user is authorized to access, and provides to the user an indication of those remote applications that are available for use.

In yet another embodiment, a remote application provisioning service receives an indication from a user indicating that a specified remote application is to be instantiated. The indication includes an encrypted token that was generated based on the authentication credentials. The remote application provisioning service then decrypts the received encrypted token to determine the user's identity, verifies that the user has permission to access the specified remote application, and sends the encrypted token to a remote application virtual machine host that provides access to the specified remote application using the encrypted token and the user's authentication credentials.

Additional features and advantages will be set forth in the description which follows, and in part will be apparent to one of ordinary skill in the art from the description, or may be learned by the practice of the teachings herein. Features and advantages of embodiments described herein may be realized and obtained by means of the instruments and combinations particularly pointed out in the appended claims. Features of the embodiments described herein will become more fully apparent from the following description and appended claims.

DETAILED DESCRIPTION

Embodiments described herein are directed to authenticating a user to a remote application provisioning service. In one embodiment, a client computer system receives authentication credentials from a user at to authenticate the user to a remote application provisioning service that provides virtual machine-hosted remote applications. The client computer system sends the received authentication credentials to an authentication service, which is configured to generate an encrypted token based on the received authentication credentials. The client computer system then receives the generated encrypted token from the authentication service, stores the received encrypted token and the received authentication credentials in a data store, and sends the encrypted token to the remote application provisioning service. The encrypted token indicates to the remote application provisioning service that the user is a valid user.

Optionally, the client computer system further receives, from the remote application provisioning service, an indication of remote applications the user is allowed to access. The client computer system receives, from the user, an indication indicating that at least one of the remote applications is to be instantiated. The client computer system then sends the user's stored authentication credentials and the stored encrypted token to the virtual machine that is hosting the specified remote application and, upon being authenticated to the virtual machine that is hosting the specified remote application, accesses the specified remote application.

In another embodiment, a remote application provisioning service receives an encrypted token from a client computer system, where the encrypted token is generated based on authentication credentials provided by a user. The remote application provisioning service decrypts the received encrypted token, determines the user's identity from the decrypted token, determines, based on the user's identity, which remote applications the user is authorized to access, and provides to the user an indication of those remote applications that are available for use.

In yet another embodiment, a remote application provisioning service receives an indication from a user indicating that a specified remote application is to be instantiated. The indication includes an encrypted token that was generated based on the authentication credentials. The remote application provisioning service then decrypts the received encrypted token to determine the user's identity, verifies that the user has permission to access the specified remote application, and sends the encrypted token to a remote application virtual machine host that provides access to the specified remote application using the encrypted token and the user's authentication credentials.

The following discussion now refers to a number of methods and method acts that may be performed. It should be noted, that although the method acts may be discussed in a certain order or illustrated in a flow chart as occurring in a particular order, no particular ordering is necessarily required unless specifically stated, or required because an act is dependent on another act being completed prior to the act being performed.

Computer storage media includes RAM, ROM, EEPROM, CD-ROM, solid state drives (SSDs) that are based on RAM, Flash memory, phase-change memory (PCM), or other types of memory, or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store desired program code means in the form of computer-executable instructions, data or data structures and which can be accessed by a general purpose or special purpose computer.

A “network” is defined as one or more data links and/or data switches that enable the transport of electronic data between computer systems and/or modules and/or other electronic devices. When information is transferred or provided over a network (either hardwired, wireless, or a combination of hardwired or wireless) to a computer, the computer properly views the connection as a transmission medium. Transmission media can include a network which can be used to carry data or desired program code means in the form of computer-executable instructions or in the form of data structures and which can be accessed by a general purpose or special purpose computer. Combinations of the above should also be included within the scope of computer-readable media.

In this description and the following claims, “cloud computing” is defined as a model for enabling on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services). The definition of “cloud computing” is not limited to any of the other numerous advantages that can be obtained from such a model when properly deployed.

For instance, cloud computing is currently employed in the marketplace so as to offer ubiquitous and convenient on-demand access to the shared pool of configurable computing resources. Furthermore, the shared pool of configurable computing resources can be rapidly provisioned via virtualization and released with low management effort or service provider interaction, and then scaled accordingly.

Still further, system architectures described herein can include a plurality of independent components that each contribute to the functionality of the system as a whole. This modularity allows for increased flexibility when approaching issues of platform scalability and, to this end, provides a variety of advantages. System complexity and growth can be managed more easily through the use of smaller-scale parts with limited functional scope. Platform fault tolerance is enhanced through the use of these loosely coupled modules. Individual components can be grown incrementally as business needs dictate. Modular development also translates to decreased time to market for new functionality. New functionality can be added or subtracted without impacting the core system.

FIG. 1illustrates a computer architecture100in which at least one embodiment may be employed. Computer architecture100includes client computer system101and public cloud computer system110. Computer systems101and110may be any type of local or distributed computer system, including cloud computing systems. Each computing system includes modules for performing a variety of different functions. For instance, client computer system101includes a communications module102. The communications module allows for data to be received and transmitted at the client computer system. For instance, user105may send or input authentication credentials104which are then transferred from the client computer system101to the authentication service114of public cloud computer system110. At least in some embodiments, public cloud computer system110is a public-facing cloud computing system that can host a variety of different applications and services. These services may be spread over a variety of different physical computer systems or processors, which may be physically located substantially anywhere in the world.

The authentication service114may thus receive the authentication credentials104(which may include user name, password, biometric data or other credentials) from the client computer system101. The encrypted token generating module115of the authentication service114may then generate an encrypted token107based on the received user credential104. The encrypted token107may then be sent back to the client computer system101. At least in some embodiments, the encrypted token107, along with the user's credentials104, may be stored in a data store103, which may be local or remote to the client computer system101.

The client computer system101may then send the encrypted token107to the remote application provisioning service108, which is part of a virtual network113running on the public cloud computer system110. The virtual network may be a private network associated with a corporation or other entity. This virtual network may provide access to sensitive data and, as such, outside users will typically need to authenticate before being granted access to the virtual network113. In order to authenticate to the virtual network113, the client computer system101sends the encrypted token107that was generated based on the user's authentication credentials104. The user's credentials (at least in some embodiments), however, are not sent to the remote application provisioning service108. The token decrypting module109decrypts the encrypted token107, and determines who the user is, and whether they are a valid user. If they are a valid user, the remote application provisioning module108sends to the client computer system101an indication117of remote applications which are available to the user105.

The user105can then provide an indication106of which of the available applications they would like to open. This indication is sent to the remote application provisioning module108. At this point, the user's stored authentication credentials104and stored encrypted token107are sent to one or more of the virtual machines111that are running in the virtual network. These virtual machines are the computing systems that actually host the remote applications112of the corporation or other entity that owns or manages the virtual network113. The stored authentication credentials104and stored encrypted token107are then used to log in and authenticate to the virtual machines. Once authenticated, the virtual machines111provide the remote application data116for the remote application(s) requested by the user (i.e. in indication106).

In this manner, an end-user authentication and single sign-on (SSO) scheme is provided. This scheme includes client-side components that allow an end-user to connect to their remote applications by either going to a browser or subscribing to a feed that the corporation or other organization has set up for them. The user105enters their credentials104to connect to the application provisioning service108. The client-side components accept the user credentials104and talks to the authentication service114to obtain an encrypted token107. This token, along with the user credentials104are used subsequently to authenticate, authorize and complete a remote logon. The authentication service is configured to accept tokens for authentication. The authentication service114is able to make an authentication decision on the user using the token (e.g. end-user “x” is a valid account in company “y”).

In some cases, the customer of the remote application provisioning service108(e.g. an enterprise) has set up a specific group of employees that have access to specific remote resources (e.g. applications112). The service108then makes an authorization decision (e.g. is end-user “x” allowed access to remote resource “y”?) by making appropriate directory calls into the company's directory service. Once the user is authorized, a remote login may be established to the virtual machine application hosts. In some embodiments, the remote desktop protocol (RDP) may be used to establish a remote interactive login to the virtual machine(s) (VMs) that are joined to the customer's domain (i.e. are part of virtual network113. This allows the end-user105to access their remote applications112. As such, this provides enterprises a way to run their virtual desktop workloads using their corporate login accounts. These concepts will be explained further below with regard to methods200,300and400ofFIGS. 2,3and4, respectively.

FIG. 2illustrates a flowchart of a method200for authenticating a user to a remote application provisioning service. The method200will now be described with frequent reference to the components and data of environment100.

Method200includes an act of receiving one or more authentication credentials from a user at the client computing system to authenticate the user to a remote application provisioning service that provides virtual machine-hosted remote applications (act210). For example, client computer system101may receive authentication credentials104from user105who is using or providing inputs to the computer system101. The authentication credentials may include user name, password, biometric information or other information that may be used to validate and authenticate a user, especially a user that is trying to access virtual machine-hosted remote applications112. The communications module102of the client computer system101may then pass these authentication credentials on to the authentication service114running on the public cloud computing system110. The encrypted token generating module115may use the received credentials to generate encrypted token107. The encrypted token107is thus based on the authentication credentials104provided by the user105.

Method200next includes an act of receiving the generated encrypted token from the authentication service (act220). The client computer system101thus receives encrypted token107from the authentication service114running on the public cloud110. This encrypted token107is then stored in a data store103along with the received authentication credentials104(act230). As mentioned above, this data store103may be local or remote to the client computer system101, and may comprise a single storage device, or an array of such devices such as a storage area network (SAN) or other cloud storage system. The client computer system101then sends the encrypted token107to the remote application provisioning service108. The encrypted token indicates to the remote application provisioning service that the user is a valid user (act240). Because the user is a valid user, the remote application provisioning module108may further determine which remote applications112the user105has access to. An indication117may be sent to the client computer system101indicating a list of remote applications the user has access to.

The remote applications112to which the user has access may be displayed in a list or other arrangement. Each remote application may be represented by an icon, thumbnail or other image. To launch the remote application, the user may click on, touch or otherwise select an icon of the application. In response to the user's input106, the client computer system101sends the user's stored authentication credentials104and the stored encrypted token107to the virtual machine111that is hosting the specified remote application112. Then, upon being authenticated to the virtual machine that is hosting the specified remote application, the user is permitted to access the user-specified instantiated remote application112.

The encrypted token generating module115may generate the encrypted token107such that it is only decryptable by the remote application provisioning service108and/or the virtual machine111that is hosting the specified remote application112. Once the user has been authenticated using the token107and the credentials104, the remote application data116is sent to the user105. The user-specified remote application may be accessed using a remote desktop protocol (RDP) session established between the virtual machine112and the client computer system101. Within the RDP session, the user may also access other remote applications to which they have been given access by the entity managing the virtual network113.

In some embodiments, a previously generated, cached encrypted token107may be sent with the user's authentication credentials104to the remote application provisioning service. Thus, in cases where the user is accessing the remote applications through a browser, the browser can look in a cache (e.g. data store103), and if an encrypted token already exists, it can send that token instead of (at least in some cases) sending the user's credentials to the authentication service114for generation of an encrypted token. In some cases, connection data may be sent to the remote application provisioning service108in addition to the encrypted token107. The connection data indicates how the connection between the client computer system101and the remote application provisioning service108is to be established. The connection data may include port numbers, protocols, hardware IDs or any other data used to establish a connection.

As shown inFIG. 5, the authentication service502may further verify that the user (e.g.105) is a member of an organization that is providing the virtual machine-hosted remote applications. For example, enterprise508may be the organization providing or managing the virtual network113ofFIG. 1. The enterprise may have different groups of users509that are assigned different remote applications. The user may thus send their credentials504to the authentication service502, which generates an encrypted token505based on the credentials. The directory service503of the authentication service502may be used to send an enterprise group query507to determine, based on the user's credentials504, whether the user is allowed to access a specified application, or whether the user is a member of a group that has access to a specified remote application. If the directory service503determines that the user does belong to the enterprise group509that has access to a user-specified application, the user will be given access to that application, and the remote application provisioning service506will be notified of the user's group membership. At least in some cases, a relationship of trust exists between the authentication service and the remote application provisioning services within the public cloud501.

The client computer system101may present available applications to the user in a variety of ways. For example, the user may enter their authentication credentials104at a web page provided by the remote application provisioning service108(or by another service running on the cloud110). Once properly authenticated, the remote applications112available to the user may be presented on the web page. In other cases, the user may enter their authentication credentials104via a remote application that was presented in a list of remote applications to which the user is subscribed. This list of applications may be shown in a control panel or other window in the client computer system's operating system. In some embodiments, it should be noted that the client computer system101may determine that a specified period of time has elapsed since the encrypted token107was generated. If this specified amount of time expires, the user's authentication credentials104may be resent to the authentication service108for reissuance of the token. The token may then be sent to the remote application provisioning service in a hypertext transfer protocol (HTTP) header, for example, or via some other transport.

FIG. 3illustrates a flowchart of a method300for authenticating a user at a remote application provisioning service. The method300will now be described with frequent reference to the components and data of environment100.

Method300includes an act of receiving, at a remote application provisioning service, an encrypted token from a client computer system, the encrypted token being generated based on authentication credentials provided by a user (act310). As mentioned above, the remote application provisioning service108may receive encrypted token107from client computer system101, where the encrypted token was generated by module115based on the user's credentials104. The token decrypting module109may then decrypt the received encrypted token (act320).

The remote application provisioning module108may further determine the user's identity from the decrypted token (act330), determine, based on the user's identity, which remote applications the user is authorized to access (act340), and provide to the user an indication117of those remote applications that are available for use (act350). These applications may be provided to the user in a web interface, in an operating system (OS) folder, or in some other manner. The available applications may each have their own representative icon or thumbnail image. The web page or OS folder may include those remote applications to which the user is subscribed or is otherwise permitted access.

FIG. 4illustrates a flowchart of a method400for authenticating a user to a remote application provisioning service. The method400will now be described with frequent reference to the components and data of environment100.

Method400includes an act of receiving, at a remote application provisioning service, an indication from a user indicating that a specified remote application is to be instantiated, the indication including an encrypted token that was generated based on the authentication credentials (act410). The remote application provisioning service108may thus receive indication106from user105indicating that a user-specified remote application112is to be opened. The indication may include the encrypted token107that was generated based on the user's authentication credentials. The token and credentials may have been stored in data store103before transfer to the remote application provisioning service108. The token decrypting module109may then decrypt the received encrypted token to determine the user's identity (act420), and verify that the user has permission to access the specified remote application (act430). The remote application provisioning service108may then send the encrypted token107to remote application virtual machine host111that provides access to the specified remote application112using the encrypted token and the user's authentication credentials (act440).

The remote applications112provided by the virtual machines that are within the virtual network113may provide access to private resources belonging to the enterprise508or other organization to whom the user belongs. The user's authentication credentials may be used to both determine which applications are available to the user and to log the user in to the virtual machine host that provides the specified remote application. Thus, the embodiments illustrated inFIG. 1facilitate claims-based authentication (which typically involves a user name and password), and token-based authentication (which uses the encrypted token107). The encrypted token107can be sent (by itself) to the remote application provisioning service108to determine which applications are available to the user. The token and user name/password are then used to authenticate the user to the virtual machine(s) that provide the user-specified remote applications112. In this manner, two different and distinct authentication systems work together to authenticate the user and allow them access to their (enterprise-provided) remote applications. Accordingly, methods, systems and computer program products are provided which authenticate a user to a remote application provisioning service.