公开(公告)号：US20230023529A1

公开(公告)日：2023-01-26

申请号：US17385401

申请日：2021-07-26

Applicant: VMware, Inc.

Inventor： Akeem JENKINS ,  Mark BENSON ,  Daniel James BEVERIDGE ,  Marc Wayne BROTHERSON ,  Sean HUNTLEY ,  David OTT

IPC: H04L9/08 ,  H04L9/06 ,  H04L29/08

Abstract: The disclosure provides an approach for cryptographic agility. Embodiments include establishing, by a proxy component associated with a cryptographic agility system, a first secure connection with an application. Embodiments include receiving, by the proxy component, via the first secure connection, a communication from the application directed to an endpoint. Embodiments include selecting, by the cryptographic agility system, a cryptographic technique based on contextual information related to the communication. Embodiments include establishing, by the proxy component, a second secure connection with the endpoint based on the cryptographic technique. Embodiments include transmitting, by the proxy component, a secure communication to the endpoint via the second secure connection based on the communication.

公开(公告)号：US20190253408A1

公开(公告)日：2019-08-15

申请号：US15895844

申请日：2018-02-13

Applicant: VMware, Inc.

Inventor： Mark BENSON ,  Emily Hong XU ,  Brett SCHOPPERT

IPC: H04L29/06 ,  H04L9/32 ,  G06F9/455

Abstract: Disclosed is a system and technique for validating a user for a single sign on without exposing secure information about the user to any part of the system except the connection server and the identity provider. In the technique, instead of relying directly on a SAML assertion, the technique uses an artifact representing the assertion and wraps the artifact in an access token. The access token is able to carry the artifact through one or more gateways on its way to a connection server without revealing any security information. Upon the access token being verified by either the gateway or the connection server, the artifact can be extracted from the access token and verification of the user for the single sign on can proceed between only the connection server and the identity provider.