Systems and methods for endpoint management

Patent metadata

Field	Value
Publication number	US-11019057-B2
Application number	US-202016741858-A
Country	US
Kind code	B2
Filing date	Jan 14, 2020
Priority date	Jun 29, 2016
Publication date	May 25, 2021
Grant date	May 25, 2021

Abstract

A system and method for mitigating security vulnerabilities of a computer network by detecting a management status of an endpoint computing device attempting to authenticate to one or more computing resources accessible via the computer network includes: detecting an authentication attempt by the endpoint computing device to the computer network; during the authentication attempt, collecting management status indicia from the endpoint computing device, wherein the management status indicia comprise data used to determine a management status of the endpoint computing device; using the management status indicia to identify the management status of the endpoint computing device and identifying the management status of the endpoint computing device; and controlling access to the computer network based on (a) whether the authentication attempt by the endpoint computing device is successful and (b) the identified management status of the endpoint computing device.

First claim

What is claimed is:

1. A method comprising:
at a remote computer security platform comprising one or more servers:
identifying an authentication request on behalf of a user from an endpoint computing device associated with the user for accessing a computer resource;
in response to identifying the authentication request, authenticating the user using first-factor authentication and second-factor authentication based on obtaining possession factor data;
in response to authenticating the user, collecting management status indicia from the endpoint computing device, wherein the management status indicia comprise data usable to determine a management status of the endpoint computing device, the management status indicating whether a software management agent is installed on the endpoint computing device that is accessible to the endpoint computing device and that enforces an access policy associated with the computer resource, wherein collecting management status indicia from the endpoint computing device includes contemporaneously receiving at a web page the authentication request and the management status indicia;
identifying the management status of the endpoint computing device based on the management status indicia; and
controlling access to the computer resource based on whether authenticating the user is successful and an identified management status of the endpoint computing device.

2. The method of claim 1 , wherein identifying the management status of the endpoint computing device includes:
determining that the endpoint computing device is an unmanaged device; and
in response to determining that the endpoint computing device is the unmanaged device, generating authentication requirements that define an additional authentication requirement for the endpoint computing device distinct from a primary authentication requirement for accessing the computer resource.

3. The method of claim 1 , wherein identifying the management status of the endpoint computing device includes:
determining that the endpoint computing device is an unmanaged device; and
in response to determining that the endpoint computing device is the unmanaged device, automatically blocking or limiting access of the endpoint computing device to the computer resource even if the authentication request is successful.

4. The method of claim 1 , wherein the data of the software management agent installed on the endpoint computing device is controllable by an entity maintaining the computer resource or by an affiliate of the entity maintaining the computer resource.

5. The method of claim 1 , further comprising:
using an inline frame to transmit to the endpoint computing device one or more probes to obtain management status indicia from the endpoint computing device.

6. The method of claim 1 , wherein the management status indicia comprise a non-response or an inadequate response from the endpoint computing device;
wherein identifying the management status of the endpoint computing device includes identifying that the endpoint computing device is an unmanaged device based on the non-response or the inadequate response; and
wherein controlling access to the computer resource includes blocking or limiting access of the endpoint computing device to the computer resource.

7. The method of claim 1 , wherein identifying the management status of the endpoint computing device includes identifying that the endpoint computing device is an unmanaged device based on the management status indicia;
wherein the method further comprises form:
configuring the endpoint computing device to operate as a managed endpoint computing device, wherein configuring the endpoint computing device includes:
generating management status configuration parameters for the endpoint computing device;
transmitting the management status configuration parameters to the endpoint computing device; and
confirming that the endpoint computing device is configured as the managed endpoint computing device based on implementation of the management status configuration parameters at the endpoint computing device.

8. The method of claim 1 , wherein identifying the management status of the endpoint computing device includes identifying that the endpoint computing device is an unmanaged device or an indeterminate device based on the management status indicia;
wherein the method further comprises:
in response to identifying the endpoint computing device as the unmanaged device or the indeterminate device, referencing the access policy associated with the computer resource;

wherein controlling access to the computer resource is further based on the access policy.

9. The method of claim 1 , wherein collecting management status indicia from the endpoint computing device includes:
at a proxy service comprising one or more remote computing servers and that is positioned operably between the endpoint computing device and an entity or an affiliate of the entity that maintains the computer resource:
monitoring network traffic passing through the proxy service to collect authentication attempt data and management status indicia from the endpoint computing device.

10. The method of claim 1 , wherein the management status indicia further comprise cookies transmitted by the endpoint computing device, wherein the cookies comprise one or more of expiring cookies and one-time use cookies, wherein the expiring cookies expire after a predetermined period of time, and wherein the one-time use cookies can only be used or transmitted one time by the endpoint computing device.

11. The method of claim 1 , wherein the management status indicia further comprise Hypertext Transfer Protocol (HTTP) headers and/or HTTP requests transmitted by the endpoint computing device,
wherein identifying the management status of the endpoint computing device is based on an analysis of one or more of the HTTP headers and the HTTP requests with respect to stored endpoint management data.

12. The method of claim 1 , wherein if the endpoint computing device comprises a managed endpoint:
prior to transmitting one or more of Hypertext Transfer Protocol (HTTP) headers and/or HTTP requests, using the software management agent operating on the endpoint computing device to modify the HTTP headers and/or the HTTP requests to include management status data.

13. The method of claim 1 , further comprising:
transmitting the management status indicia of the endpoint computing device to an entity maintaining the computer resource or to an affiliate of the entity that maintains the computer resource, wherein the management status indicia includes an indication of whether the endpoint computing device comprises a managed device or an unmanaged device.

14. The method of claim 1 , further comprising:
presenting via a graphical user interface (GUI) a plurality of endpoint computing devices accessing the computer resource or one or more digital resources accessible via a computer network;
identifying a management status for each of the plurality of endpoint computing devices presented via the GUI, wherein the management status comprises a managed device indicator or an unmanaged device indicator, and wherein the plurality of endpoints comprises one or more managed endpoint computing devices and one or more unmanaged endpoint computing devices; and
enabling access control capabilities to selectively limit or block the one or more unmanaged endpoint computing devices from accessing the computer resource.

15. A system comprising:
an endpoint computing device; and
a remote computer security platform comprising one or more servers,

Assignees

• Duo Security Inc

Inventors

• Oberheide Jon
• Goodman Adam
• Hanley Michael
• Johnson Peter
• Abduljaber Omar
• Barclay James

Classifications

• H04L63/205

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04W12/08

  Access security · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title