Abstract:
A system and method for providing secure access to an organization&#39;s internal directory service from external hosted services. The system includes a remote directory service configured to accept directory service queries from an application running on hosted services. The remote directory service passes the queries to a directory service proxy server inside a firewall of the organization via a secure rendezvous service. The directory service proxy server passes the queries to the internal directory service inside said firewall. Request responses from the internal directory service pass through the directory service proxy server to the remote directory service through said firewall via the secure rendezvous service. The remote directory servicer returns the response to the requesting application.

Description:
BRIEF DESCRIPTION OF THE INVENTION 
       [0001]    Embodiments of this invention provide secure access to an organization&#39;s internal directory service from external hosted services located on the Internet. An embodiment of this invention allows an application running outside the organization&#39;s network firewalls to use the organization&#39;s internal directory service for authenticating and authorizing user accounts. Embodiments of this invention do not require duplicating the directory service outside of the organization&#39;s internal network, nor do they require special incoming connections through the organization&#39;s firewall, both of which are difficult to set up and can compromise security. 
       BACKGROUND 
       [0002]    Enterprises and other organizations are moving more of their internal network activities to hosted services outside their internal networks. Hosted services provide underlying hardware and support for applications, web sites, content distribution, and more under the care of a hosting business. Organization members/employees can use hosted services to perform work outside of the organization&#39;s internal-network premises. 
         [0003]    As an organization&#39;s network activities migrate outside of its internal network, those activities often require access to the organization&#39;s internal directory service to authenticate and authorize users. 
         [0004]    Hosted services do not currently have access to an organization&#39;s internal directory service. To provide authentication and authorization, hosted services may set up their own directory service in the same hosted environment. That directory service may have its own set of user and computer records, or it may duplicate the records stored in the organization&#39;s internal directory service. 
         [0005]    Maintaining a separate external directory service in a hosted services environment has a serious problem: the external hosted directory service is separate from an organization&#39;s own internal directory service. The hosted service must create and maintain its own set of user and computer records. 
         [0006]    The hosted directory service can create records one at a time as users and computers sign up for hosted services and create new accounts. If so, the hosted directory service is completely independent of the internal directory service. The organization&#39;s users may have completely different account names, passwords, and rights on hosted services than they do within the organization&#39;s internal network. 
         [0007]    None of the comprehensive and carefully created user and computer accounts from the internal directory service apply to externally hosted services. Users must remember completely different account names and passwords for hosted services and internal network services. Authorizations defined within the internal directory service cannot apply to hosted services. 
         [0008]    To provide access to internal records, the hosted directory service may create a copy of the internal directory service&#39;s records in the hosted environment and then use those records for authentication and authorization. This has two major problems: 
         [0009]    a) The records now reside on a platform outside the security of the organization&#39;s own network firewalls where they might be read and altered by unauthorized individuals, posing a substantial security risk. 
         [0010]    b) The hosted records must be constantly synchronized with the internal records to be effective. Any changes in the hosted directory service must be written to the internal directory service and vice versa. Complex mechanisms are necessary to make sure that the hosted and internal directory services do not try to change the same record simultaneously. 
         [0011]      FIG. 1  shows hosted and internal directory services as they exist in the prior art wherein applications on hosted services use an external hosted directory service for authentication and authorization. The hosted directory service may or may not be a synchronized copy of an organization&#39;s internal directory service. 
       SUMMARY OF THE INVENTION 
       [0012]    Embodiments of the invention eliminate the need for an external hosted directory service by replacing it with a secure direct connection to an organization&#39;s internal directory service located behind the organization&#39;s firewall. An embodiment of the invention requires very little setup by an organization, and the organization&#39;s internal services are not exposed to direct public access. 
         [0013]    An embodiment of the invention stands between these two existing components: 
         [0014]    a) An internal directory service which is an organization&#39;s directory service running behind a firewall inside the organization&#39;s internal network. A typical example is Microsoft Active Directory, but it may also be another type of directory service. 
         [0015]    b) An application which is a computer process (typically a web application) that runs on hosted services and makes use of directory service. The application may use the directory service for user log-ons, for checking a user&#39;s permissions, or for other typical directory service information. Multiple applications on hosted services may request directory service. 
         [0016]    An embodiment of the invention has as one component a remote directory service that resides on hosted services. 
         [0017]    A remote directory service is a process that accepts queries from applications for directory service and passes those queries on to directory service proxy servers located in organizations&#39; internal networks. The remote directory service manages connections with directory service proxy servers and determines which directory service proxy server to contact with a query. 
         [0018]    An embodiment of the invention uses this existing component that provides a connection between hosted services and an organization&#39;s internal network: 
         [0019]    A rendezvous service which is an internet service that provides a secure connection between the remote directory service in hosted services and directory service proxy servers within organizations&#39; internal networks so that the two sides can exchange data with each other. These components contact the rendezvous service; the rendezvous service does not contact any component. The rendezvous service is typically provided by a commercial internet service vendor. An example is the service bus provided by Microsoft Azure. 
         [0020]    An embodiment of the invention has as one component a directory service proxy server that resides within an organization&#39;s internal network. 
         [0021]    A directory service proxy server is an application that communicates via the rendezvous service with the remote directory service. The proxy server receives requests from the remote directory service. It communicates directly with the internal directory service, passing on directory service requests, receiving responses from the service, and passing those responses back to the remote directory service via the rendezvous service. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0022]    Embodiments of the invention are illustrated by way of example and not by way of limitation in the figures of the accompanying drawings in which like references indicate similar elements. It should be noted that references to “an” or “one” embodiment in this disclosure are not necessarily to the same embodiment, and such references mean “at least one.” 
           [0023]      FIG. 1  shows hosted and internal directory services as they exist in the prior art. 
           [0024]      FIG. 2  is a block diagram showing the elements of the invention and their connections to each other and existing elements. 
           [0025]      FIG. 3  is a flowchart that shows the processing performed by the invention&#39;s components to handle an authentication request from a hosted application. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0026]    The invention performs its functions using several primary mechanisms. 
       Secure Directory Service Connections Without Allowing Inbound Connections 
       [0027]    To provide secure connections from external hosted services to an organization&#39;s secure internal directory service, the invention links a directory service proxy server within the organization&#39;s internal network with a remote directory service running externally on hosted services. To ensure trust between the two components, the human who installs the directory service proxy server in the internal network initiates the proxy server&#39;s first contact with the remote directory service via a rendezvous service. During that first contact, the two components exchange security certificates with each other. The certificates authoritatively identify the components to each other in subsequent connections. 
         [0028]    The directory service proxy server and remote directory service communicate with each other via a secure connection, a rendezvous server that uses well-known security mechanisms such as polling and long reads. This method of communication allows a secure connection between components behind an organization&#39;s firewall and components outside the firewall without setting up a dedicated computer in the organization&#39;s firewall or accepting any inbound connections from external components. 
       Secure Directory Service Access for Hosted Applications 
       [0029]    Hosted applications receive internal directory service through a chain of components. Within hosted services, an application makes requests of the remote directory service, which connects through the rendezvous service to components behind an organization&#39;s firewall: the directory service proxy server and the directory service itself. Each of these connections has appropriate security. They are not public connections, and occur between components running on the same platform. The components will only connect with known and valid security certificates. 
         [0030]    As an added level of security, the remote directory service may define an API that provides a non-destructive subset of internal directory services. The API does not, for example, include calls that remove records from the directory service. This limits the damage that a malicious application might do. The details regarding such API are not important for a proper understanding of the invention, and, therefore are not further described herein. 
         [0031]    Preferably, the directory service proxy server provides an additional level of security: it responds only to requests that provide a valid certificate issued by the remote directory service to approved applications. When an application requests service, it must provide the certificate along with a key that specifies that the certificate can be used for a proxy call. The directory service proxy server denies any service request without the appropriate certificate and key. 
       Multi-Tenancy 
       [0032]    The invention may serve multiple organizations from its location in hosted services. The remote directory service in hosted services has connections to multiple directory service proxy servers located within different organizations&#39; internal networks. The invention accepts directory service requests for any connected proxy, sorts them out to go to the proper proxy, and ensures complete separation of directory service for different proxies. In other words, it provides multi-tenanted directory service: each directory service proxy is a tenant, and requests and data exchange never occur across tenants. 
         [0033]    When a directory service proxy server is first installed in an internal network, the human installing it first connects it to a local directory service and then connects the proxy server for the first time to the remote directory service. The remote directory service assigns a unique human-memorable ID for the proxy server. This ID is called the proxy ID. 
         [0034]    An organization may set up multiple directory service proxy servers for a single directory service to provide redundant proxy servers for load sharing or failover. If so, these proxy servers get the same proxy ID because they connect to the same service. 
         [0035]    When an application wants directory service, it specifies the proxy ID of the tenant it wants to query. The application uses the ID in its query to the remote directory service. 
         [0036]    The remote directory service reads the ID, determines which directory service proxy server to contact through the rendezvous service, and passes the request on to that directory service proxy server to handle. The proxy&#39;s response goes back to the remote directory service and then directly back to the requesting application in response to the original request. 
       Implementation Details 
       [0037]    Referring now to  FIG. 2 , the invention is implemented to allow a remote directory service  15  in one hosted services environment to communicate with one or more directory service proxy servers  19 . Each proxy server is an independent tenant. A directory request goes to a single tenant. Data exchange does not cross tenants. 
       The Hosting Service and Rendezvous Service 
       [0038]    The invention components that are external to the organization&#39;s internal network run on hosted services  13  such as Microsoft Azure. Azure is a hosting service provided by Microsoft that provides underlying service hardware and a service development environment. 
         [0039]    The Azure service bus in one embodiment is a rendezvous service  11 . It is a standard feature offered by Azure. The invention uses service buses to connect the remote directory service  15  on hosted services to directory service proxy servers  19  in an organization&#39;s internal networks. The service buses provide the secure connections described earlier as part of the invention. No changes are required to be made to existing hosted services such as Microsoft Azure to enable them to be used with the present invention. 
         [0040]    The rendezvous service is only one possible mechanism that might be used by the invention to connect the remote directory service  15  to a directory service proxy server  19 . Any secure connection such as a virtual private network (VPN) connection would work as well, although it might require more setup than a rendezvous service  11 . 
       The Application 
       [0041]    The application  17  that uses the invention runs on hosted services  13  where the invention is located and has access to the remote directory service  15  to make directory service requests. This application is not part of the invention, and can be any application running on hosted services with access to the remote directory service. The application must provide a directory proxy ID to identify which internal directory service it wants to use, it must provide a valid certificate and key, and it must know the directory query syntax to use to make requests of the directory service. 
         [0042]    One example of a hosted application that uses the invention is a mobile device enrollment application. The enrollment application allows a device owner to register the device with an organization. The user connects the device to the enrollment application and provides a user name, a password, and the directory proxy ID of the organization with which the device should be enrolled. The enrollment application then contacts the directory service interface, requests authentication with the user name and password, and provides the directory proxy ID along with a valid certificate and key. 
         [0043]    When the invention has used its components and connections to get authentication through the internal directory service, the invention reports the success or failure of the authentication through the directory service interface back to the requesting application. The application has no knowledge of how the authentication took place; it simply requested authentication from the remote directory service and got that authentication. 
         [0044]    A hosted application may make any number of directory service queries to the remote directory service as long as the process understands the query. Applications are not restricted solely to authentication queries, but may make any number of directory service queries. Although the description provided herein focuses on authentication queries, the same mechanisms are used for other types of directory service queries. Examples of such other directory service queries include, without limitation adding a user to a group, checking group membership among many others. However, the mechanism used for handling queries as described herein is the same. However, as noted above, the remote directory service may define an API that provides a non-destructive subset of internal directory services so as to, for example, prohibit calls that remove records from the directory service, or any other activity that may damage the directory. 
       The Remote Directory Service 
       [0045]    The remote directory service  15  provides a directory service interface that accepts directory service queries and passes them on to the directory service proxy server within an organization&#39;s internal network. The remote directory service manages connections with directory service proxies on customers&#39; premises (through the rendezvous service), assigns proxy IDs to registering directory service proxies, determines to which proxies queries should go, and so on. 
       The Directory Service Proxy Server 
       [0046]    The application  17  preferably installs one or more directory service proxy servers  19  within an organization&#39;s internal network, that is, behind a firewall  21  which normally blocks inbound network traffic. A directory service proxy server is an application that in one embodiment runs in the Windows Server environment. 
         [0047]    The directory service proxy server  19  handles the connection with the Azure service bus (rendezvous service  11 ) to the remote directory service  15 . It also has direct contact with the organization&#39;s directory service  23  which in one embodiment is Microsoft&#39;s Active Directory. The directory service proxy server can present queries to directory service  23  and receive responses. 
       Handling an Application&#39;s Directory Service Request 
       [0048]      FIG. 3  illustrates the process that occurs when a hosted application  17  requests directory service of the invention through the remote directory service  15 . 
         [0049]    The hosted application  17  requests  31  authentication from the remote directory service  15 . The application  17  uses the request format defined by the remote directory service&#39;s  19  API. The application  17  provides a user name, a password, a proxy ID to identify the directory service proxy server  19  to use to provide directory service, and a valid certificate and key for that directory service proxy server  19 . To application  17 , remote directory service  15  appears to be a prior art hosted directory service of the type described with reference to  FIG. 1 . 
         [0050]    When the remote directory service  15  receives the authentication query from the hosted application  17 , the remote directory service  15  reads and uses  33  the proxy ID to determine the appropriate directory service proxy server  19  to receive the query, then uses the rendezvous service  11  to contact  35  that directory service proxy server  19  and present the query. The directory service proxy server  19  checks  37  the provided certificate and key to ensure that the request comes from a valid application and rejects  39  the request if the certificate is not valid. 
         [0051]    The directory service proxy server queries  41   a  the internal directory service  23  to authenticate  41   b  the provided user data, receives a response  41   c  from the internal directory service  23  with authentication success or failure, then passes  43  that response back to the remote directory service  15  via the rendezvous service  11 . The remote directory service  15  passes  45  the response on to the hosted application  17  which then acts  47  according to the provided results. 
         [0052]    Further details regarding application  17 , rendezvous service  11 , firewall  21  and internal directory service  25  are not set forth herein as such elements are well known in the art and while necessary for complete operation of the invention do not need to be modified for use with the invention.