Back to results
US 10,375,055 B2Granted
Device authentication based upon tunnel client network requests
AssigneeAirWatch LLC
InventorsCraig Farley Newell, Jonathan Blake Brannon, Kabir Barday, Ashish Jain
Life of this patent
Estimating the term…
Abstract
Disclosed are various approaches for providing authentication of a user and a client device. A user's credentials can be authenticated by an identity provider. In addition, a device posture assessment that analyzes the device from which the authentication request originates is also performed. An authentication request can be authenticated based upon whether the device posture assessment reveals that device to be a managed device that is in compliance with compliance rules.
Claims20
A system for authenticating a user and determining a device posture during authentication, comprising:
- a client device comprising a processor and a memory;
- and
- machine readable instructions stored in the memory that, when executed by the processor, cause the client device to at least:
- transmit to a management service a request to enroll the client device as a managed device;
- obtain a security certificate from the management service;
- receive a command from the management service to install a particular application on the client device;
- initiate installation of the particular application in response to receiving the command to install the particular application;
- obtain a virtual private network (VPN) configuration from the management service, the VPN configuration specifying that at least authentication requests transmitted from the particular application be routed through a VPN connection specified by the VPN configuration, wherein the VPN configuration further defines a security layer applied to network traffic routed through the VPN connection;
- obtain an authentication request generated by the particular application;
- apply a transport layer security (TLS) security layer to the authentication request as specified by the VPN configuration, wherein the TLS security layer is applied by a tunnel client executed by the client device, and wherein the security layer comprises at least one device identification parameter embedded into packets transmitted by the tunnel client to a destination;
- transmit the authentication request through the VPN connection to the destination;
- obtain an authentication assertion encoded in Security Assertion Markup Language (SAML);
- and
- provide the authentication assertion to the particular application installed on the client device.
11 more elements
A method for authenticating a user and determining a device posture during authentication, comprising:
- transmitting, from a client device to a management service, a request to enroll the client device as a managed device;
- obtaining, in the client device, a security certificate from the management service;
- receiving, in the client device, a command from the management service to install a particular application on the client device;
- initiating, in the client device, installation of the particular application in response to receiving the request to install the particular application;
- obtaining, in the client device, a virtual private network (VPN) configuration from the management service, the VPN configuration specifying that at least authentication requests transmitted from the particular application be routed through a VPN connection specified by the VPN configuration, the VPN configuration further defining a security layer applied to network routed through the VPN connection;
- obtaining, in the client device, an authentication request generated by the particular application;
- applying, in the client device, a transport layer security (TLS) security layer to the authentication request as specified by the VPN configuration, wherein the TLS security layer is applied by a tunnel client executed by the client device, and wherein the security layer comprises at least one device identification parameter embedded into packets transmitted by the tunnel client to a destination;
- transmit, from the client device, the authentication request through the VPN connection to the destination;
- obtaining, in the client device, an authentication assertion encoded in Security Assertion Markup Language (SAML);
- and
- providing, in the client device, the authentication assertion to the particular application installed on the client device.
8 more elements
A non-transitory computer-readable medium comprising executable instructions for authenticating a user and determining a device posture during authentication, the executable instructions, when executed by a client device, cause the client device to at least:
- transmit to a management service a request to enroll the client device as a managed device;
- obtain a security certificate from the management service;
- receive a command from the management service to install a particular application on the client device;
- initiate installation of the particular application in response to receiving the request to install the particular application
- obtain a virtual private network (VPN) configuration from the management service, the VPN configuration specifying that at least authentication requests transmitted from the particular application be routed through a VPN connection specified by the VPN configuration, the VPN configuration further defining a security layer applied to network routed through the VPN connection;
- obtain an authentication request generated by the particular application;
- apply a transport layer security (TLS) security layer to the authentication request as specified by the VPN configuration, wherein the TLS security layer is applied by a tunnel client executed by the client device, and wherein the security layer comprises at least one device identification parameter embedded into packets transmitted by the tunnel client to a destination;
- transmit the authentication request through the VPN connection to the destination;
- obtain an authentication assertion encoded in Security Assertion Markup Language (SAML);
- and
- provide the authentication assertion to the particular application installed on the client device.
8 more elements
Dependencies are inferred from the claim text.