Device authentication based upon tunnel client network requests

Patent metadata

Field	Value
Publication number	US-10122761-B2
Application number	US-201615168398-A
Country	US
Kind code	B2
Filing date	May 31, 2016
Priority date	May 31, 2016
Publication date	Nov 6, 2018
Grant date	Nov 6, 2018

Abstract

Disclosed are various approaches for providing authentication of a user and a client device. A user's credentials can be authenticated by an identity provider. In addition, a device posture assessment that analyzes the device from which the authentication request originates is also performed. An authentication request can be authenticated based upon whether the device posture assessment reveals that device to be a managed device that is in compliance with compliance rules.

First claim

We claim the following:

1. A system for authenticating a user and determining a device posture during authentication, comprising:
at least one computing device comprising a processor and a memory; and
an identity provider executable by the at least one computing device, the identity provider causing the at least one computing device to at least:
obtain an authentication request from an authentication proxy, the authentication proxy being received from a tunnel client executed by a client device, the tunnel client terminating a virtual private network (VPN) connection at the authentication proxy, the authentication proxy removing an encryption layer used in the VPN connection, and authentication proxy storing: at least one device identification parameter from the authentication request, and a signature of a certificate used to encrypt the encryption layer;
query the authentication proxy for the at least one device identification parameter associated with the authentication request;
provide the at least one device identification parameter to a management service;
obtain an indication from the management service of whether the client device corresponding to the at least one device identification parameter is compliant with a plurality of compliance rules;
authenticate the authentication request in response to receiving an indication that the client device is compliance with the compliance rules; and
transmit an indication that the authentication request has been authenticated to the client device over the VPN connection.

2. The system of claim 1 , wherein the at least one device identification parameter comprises at least one of: an application identifier associated with the application, a timestamp, a device identifier associated with the client device, an operating system version of the client device, geolocation parameters, or a network address of the client device.

3. The system of claim 1 , wherein the authentication request is secured with transport layer security (TLS) and the security layer comprises an additional TLS layer applied to the authentication request.

4. The system of claim 1 , wherein the indication of whether the client device is compliant with a plurality of compliance rules is further based upon at least one of: whether the client device is enrolled with the management service as a managed device or whether a particular installation of the application is a managed application.

5. The system of claim 1 , wherein the tunnel client is configured using a virtual private network (VPN) configuration installed on the client device and associated with a particular application installed on the client device.

6. The system of claim 1 , wherein the indication of whether the authentication request has been authenticated comprises an authentication assertion encoded in Security Assertion Markup Language (SAML).

7. The system of claim 1 , wherein the indication of whether the authentication request has been authenticated is generated by the client device without requiring an additional credential to be entered by the user.

8. A method for authenticating a user and determining a device posture during authentication, comprising:
obtaining, by a management service executed in a computing device in communication with a client device, an authentication request from an authentication proxy, the authentication proxy being received from a tunnel client executed by a client device, the tunnel client terminating a virtual private network (VPN) connection at the authentication proxy, the authentication proxy removing an encryption layer used in the VPN connection, and authentication proxy storing: at least one device identification parameter from the authentication request, and a signature of a certificate used to encrypt the encryption layer;
querying, by the management service, the authentication proxy for the at least one device identification parameter associated with the authentication request
providing, by the management service, the at least one device identification parameter to a management service;
obtaining, by the management service, an indication from the management service of whether the client device corresponding to the at least one device identification parameter is compliant with a plurality of compliance rules;
authenticating, by the management service, the authentication request in response to receiving an indication that the client device is compliance with the compliance rules; and
transmitting, by the management service, an indication that the authentication request has been authenticated to the client device over the VPN connection.

9. The method of claim 8 , wherein the at least one device identification parameter comprises at least one of: an application identifier associated with the application, a timestamp, a device identifier associated with the client device, an operating system version of the client device, geolocation parameters, or a network address of the client device.

10. The method of claim 8 , wherein the authentication request is secured with transport layer security (TLS) and the security layer comprises an additional TLS layer applied to the authentication request.

11. The method of claim 8 , wherein the indication of whether the client device is compliant with a plurality of compliance rules is further based upon at least one of: whether the client device is enrolled with the management service as a managed device or whether a particular installation of the application is a managed application.

12. The method of claim 8 , wherein the tunnel client is configured using a virtual private network (VPN) configuration installed on the client device and associated with a particular application installed on the client device.

13. The method of claim 8 , wherein the indication of whether the authentication request has been authenticated comprises an authentication assertion encoded in Security Assertion Markup Language (SAML).

14. The method of claim 8 , wherein the indication of whether the authentication request has been authenticated is generated by the client device without requiring an additional credential to be entered by the user.

15. A non-transitory computer-readable medium comprising executable instructions for authenticating a user and determining a device posture during authentication, the instructions, when executed, causing at least one computing device to at least:
obtaining an authentication request from an authentication proxy, the authentication proxy being received from a tunnel client executed by a client device, the tunnel client terminating a virtual private network (VPN) connection at the authentication proxy, the authentication proxy removing an encryption layer used in the VPN connection, and authentication proxy storing: at least one device identification parameter from the authentication request, and a signature of a certificate used to encrypt the encryption layer;
querying the authentication proxy for the at least one device identification parameter associated with the authentication request;
providing the at least one device identification parameter to a management service;
obtaining an indication from the management service of whether the client device corresponding to the at least one device identification parameter is compliant with a plurality of compliance rules;
authenticating the authentication request in response to receiving an indication that the client device is compliance with the compliance rules; and
transmitting an indication that the authentication request has been authenticated to the client device over the VPN connection.

Assignees

• Airwatch Llc

Inventors

• Newell Craig Farley
• Brannon Jonathan Blake
• Barday Kabir
• Jain Ashish

Classifications

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• H04L63/166

  at the transport layer · CPC title