Systems and methods for endpoint management classification

Patent metadata

Field	Value
Publication number	US-10009344-B2
Application number	US-201715626421-A
Country	US
Kind code	B2
Filing date	Jun 19, 2017
Priority date	Jun 29, 2016
Publication date	Jun 26, 2018
Grant date	Jun 26, 2018

Abstract

A system and method for mitigating security vulnerabilities of a computer network by detecting a management status of an endpoint computing device attempting to authenticate to one or more computing resources accessible via the computer network includes: detecting an authentication attempt by the endpoint computing device to the computer network; during the authentication attempt, collecting management status indicia from the endpoint computing device, wherein the management status indicia comprise data used to determine a management status of the endpoint computing device; using the management status indicia to identify the management status of the endpoint computing device and identifying the management status of the endpoint computing device; and controlling access to the computer network based on (a) whether the authentication attempt by the endpoint computing device is successful and (b) the identified management status of the endpoint computing device.

First claim

What is claimed is:

1. A method for mitigating security vulnerabilities of a computer network by detecting a management status of an endpoint computing device attempting to authenticate to one or more computing resources accessible via the computer network, the method comprising:
at a computer security platform comprising one or more servers that function to:
(i) detect an authentication attempt by the endpoint computing device to the computer network, wherein detecting the authentication attempt comprises receiving an authentication request originating from the endpoint computing device for accessing the computer network;
(ii) during the authentication attempt, collect management status indicia from the endpoint computing device, wherein the management status indicia comprise data used to determine a management status of the endpoint computing device, the management status indicating whether the endpoint computing device is actively managed by an entity maintaining the computer network or by an affiliate of the entity maintaining the computer network, wherein collecting management status indicia from the endpoint computing device includes:
implementing at least one inline frame within a web interface; and
using the at least one inline frame to collect (a) authentication attempt data and (b) the management status indicia during the authentication attempt, wherein the authentication attempt data comprises identifying data of the endpoint computing device and authentication credentials;

(iii) use the management status indicia to identify the management status of the endpoint computing device and identifying the management status of the endpoint computing device; and
(iv) control access to the computer network based on (a) whether the authentication attempt by the endpoint computing device is successful and (b) the identified management status of the endpoint computing device.

2. The method of claim 1 , wherein using the at least one inline frame to collect the management status indicia includes:
using the inline frame to transmit to the endpoint computing device one or more management status indicia probes seeking management status indicia from the endpoint computing device.

3. The method of claim 1 , wherein the management status indicia comprise a non-response or inadequate response from the endpoint computing device;
wherein identifying the management status of the endpoint computing device includes identifying that the endpoint computing device comprises an unmanaged device based on the non-response or inadequate response; and
wherein controlling access by the endpoint computing device to the computer network includes blocking or limiting access of the unmanaged endpoint computing device to the computer network.

4. The method of claim 1 , wherein identifying the management status of the endpoint computing device includes identifying that the endpoint computing device comprises an unmanaged device based on the management status indicia;
wherein at the computer security platform further functions to:
configure the endpoint computing device to a managed endpoint computing device, wherein configuring the endpoint computing device includes:
(a) generating management status configuration indicia for the endpoint computing device;
(b) transmitting the management status configuration indicia to the endpoint computing device; and
(c) confirming that the endpoint computing device is configured as the managed endpoint computing device based on implementation of the management status configuration indicia at the endpoint computing device.

5. The method of claim 1 , wherein identifying the management status of the endpoint computing device includes identifying that the endpoint computing device comprises an unmanaged device or an indeterminate device based on the management status indicia;
wherein at the computer security platform further functions to:
in response to identifying the endpoint computing device as the unmanaged device or the indeterminate device, referencing access policy associated with the computer network;

wherein controlling access to the computer network if further based on (c) the access policy.

6. The method of claim 1 , wherein collecting management status indicia from the endpoint computing device includes:
at a proxy service comprising one or more remote computing servers and that is positioned operably between the endpoint computing device and the entity or the affiliate of the entity that maintains the computer network:
monitoring network traffic passing through the proxy service to collect authentication attempt data and management status indicia from the endpoint computing device.

7. The method of claim 1 , wherein the management status indicia comprise cookies transmitted by the endpoint computing device to the computer security platform,
wherein identifying the management status of the endpoint computing device includes:
(a) analyzing the cookies to identify management status data, wherein the management status data relates to information useable by the computer security platform to verify the management status of the endpoint computing device;
(b) comparing the management status data to stored endpoint management data; and
(c) determining the management status of the endpoint computing device based on results of the comparison.

8. The method of claim 7 , wherein the cookies transmitted by the endpoint computing device comprise one or more of ephemeral cookies and one-time use cookies, wherein the cookies expire after a predetermined period of time, and wherein the one-time use cookies can only be used or transmitted one time by the endpoint computing device.

9. The method of claim 1 , wherein the management status indicia comprise HTTP headers and/or HTTP requests transmitted by the endpoint computing device to the computer security platform,
wherein identifying the management status of the endpoint computing device includes:
(a) analyzing the HTTP headers and/or the HTTP requests to identify management status data, wherein the management status data relates to information useable by the computer security platform to verify the management status of the endpoint computing device;
(b) comparing the management status data from the HTTP headers and/or the HTTP requests to stored endpoint management data; and
(c) determining the management status of the endpoint computing device based on results of the comparison.

10. The method of claim 9 , wherein if the endpoint computing device comprises a managed endpoint:
prior to transmitting the HTTP headers and/or the HTTP requests, using a software application operating on the endpoint computing device to modify the HTTP headers and/or the HTTP requests to include the management status data.

11. The method of claim 1 , wherein the management status indicia comprise a digital certificate transmitted by the endpoint computing device to the computer security platform, wherein the digital certificate is provided to the endpoint computing device by an issuing authority,
wherein identifying the management status of the endpoint computing device includes:
(a) analyzing the digital certificate to identify management status data, wherein the management status data relates to information useable by the computer security platform to verify the management status of the endpoint computing device;
(b) comparing the management status data from the digital certificate to stored endpoint management data; and
(c) determining the management status of the endpoint computing device based on results of the comparison.

12. The method of claim 1 , wherein collecting the management status ind

Assignees

• Duo Security Inc

Inventors

• Oberheide Jon
• Goodman Adam
• Hanley Michael
• Johnson Peter
• Abduljaber Omar
• Barclay James

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• H04L63/205

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04L63/102

  Entity profiles · CPC title