Device authentication based upon tunnel client network requests
AssigneeAirWatch LLC
InventorsCraig Farley Newell, Jonathan Blake Brannon, Kabir Barday, Ashish Jain
Life of this patent
Estimating the term…
Abstract
Disclosed are various approaches for providing authentication of a user and a client device. A user's credentials can be authenticated by an identity provider. In addition, a device posture assessment that analyzes the device from which the authentication request originates is also performed. An authentication request can be authenticated based upon whether the device posture assessment reveals that device to be a managed device that is in compliance with compliance rules.
Claims20
A system for authenticating a user and determining a device posture during authentication, comprising:
- at least one computing device comprising a processor and a memory;
- and
- an identity provider executable by the at least one computing device, the identity provider causing the at least one computing device to at least:
- obtain an authentication request from an authentication proxy, the authentication proxy being received from a tunnel client executed by a client device, the tunnel client terminating a virtual private network (VPN) connection at the authentication proxy, the authentication proxy removing an encryption layer used in the VPN connection, and authentication proxy storing:
- at least one device identification parameter from the authentication request, and a signature of a certificate used to encrypt the encryption layer;
- query the authentication proxy for the at least one device identification parameter associated with the authentication request;
- provide the at least one device identification parameter to a management service;
- obtain an indication from the management service of whether the client device corresponding to the at least one device identification parameter is compliant with a plurality of compliance rules;
- authenticate the authentication request in response to receiving an indication that the client device is compliance with the compliance rules;
- and
- transmit an indication that the authentication request has been authenticated to the client device over the VPN connection.
A method for authenticating a user and determining a device posture during authentication, comprising:
- obtaining, by a management service executed in a computing device in communication with a client device, an authentication request from an authentication proxy, the authentication proxy being received from a tunnel client executed by a client device, the tunnel client terminating a virtual private network (VPN) connection at the authentication proxy, the authentication proxy removing an encryption layer used in the VPN connection, and authentication proxy storing:
- at least one device identification parameter from the authentication request, and a signature of a certificate used to encrypt the encryption layer;
- querying, by the management service, the authentication proxy for the at least one device identification parameter associated with the authentication request
- providing, by the management service, the at least one device identification parameter to a management service;
- obtaining, by the management service, an indication from the management service of whether the client device corresponding to the at least one device identification parameter is compliant with a plurality of compliance rules;
- authenticating, by the management service, the authentication request in response to receiving an indication that the client device is compliance with the compliance rules;
- and
- transmitting, by the management service, an indication that the authentication request has been authenticated to the client device over the VPN connection.
A non-transitory computer-readable medium comprising executable instructions for authenticating a user and determining a device posture during authentication, the instructions, when executed, causing at least one computing device to at least:
- obtaining an authentication request from an authentication proxy, the authentication proxy being received from a tunnel client executed by a client device, the tunnel client terminating a virtual private network (VPN) connection at the authentication proxy, the authentication proxy removing an encryption layer used in the VPN connection, and authentication proxy storing:
- at least one device identification parameter from the authentication request, and a signature of a certificate used to encrypt the encryption layer;
- querying the authentication proxy for the at least one device identification parameter associated with the authentication request;
- providing the at least one device identification parameter to a management service;
- obtaining an indication from the management service of whether the client device corresponding to the at least one device identification parameter is compliant with a plurality of compliance rules;
- authenticating the authentication request in response to receiving an indication that the client device is compliance with the compliance rules;
- and
- transmitting an indication that the authentication request has been authenticated to the client device over the VPN connection.
Dependencies are inferred from the claim text.