# US 10,375,055 B2 · Device authentication based upon tunnel client network requests > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,055 B2 - Document ID: US10375055B2 - Status: Granted - Kind: B2 - Application number: 15/168,404 - Filed: 2016-05-31 - Published: 2017-11-30 - Granted: 2019-08-06 - Earliest claimed: 2016-05-31 - Assignees: AirWatch LLC - Applicants: AirWatch LLC - Inventors: Craig Farley Newell; Jonathan Blake Brannon; Kabir Barday; Ashish Jain - Web page: https://patentgrep.com/patent/US10375055B2 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 63/0272: {Virtual private networks} - H04L 63/166: {at the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed are various approaches for providing authentication of a user and a client device. A user's credentials can be authenticated by an identity provider. In addition, a device posture assessment that analyzes the device from which the authentication request originates is also performed. An authentication request can be authenticated based upon whether the device posture assessment reveals that device to be a managed device that is in compliance with compliance rules. ## Claims ### Claim 1 A system for authenticating a user and determining a device posture during authentication, comprising: a client device comprising a processor and a memory; and machine readable instructions stored in the memory that, when executed by the processor, cause the client device to at least: transmit to a management service a request to enroll the client device as a managed device; obtain a security certificate from the management service; receive a command from the management service to install a particular application on the client device; initiate installation of the particular application in response to receiving the command to install the particular application; obtain a virtual private network (VPN) configuration from the management service, the VPN configuration specifying that at least authentication requests transmitted from the particular application be routed through a VPN connection specified by the VPN configuration, wherein the VPN configuration further defines a security layer applied to network traffic routed through the VPN connection; obtain an authentication request generated by the particular application; apply a transport layer security (TLS) security layer to the authentication request as specified by the VPN configuration, wherein the TLS security layer is applied by a tunnel client executed by the client device, and wherein the security layer comprises at least one device identification parameter embedded into packets transmitted by the tunnel client to a destination; transmit the authentication request through the VPN connection to the destination; obtain an authentication assertion encoded in Security Assertion Markup Language (SAML); and provide the authentication assertion to the particular application installed on the client device. ### Claim 2 (depends on 1) The system of claim 1, wherein the at least one device identification parameter comprises a network address of the client device. ### Claim 3 (depends on 1) The system of claim 1, wherein the authentication request is secured with transport layer security (TLS) by the particular application. ### Claim 4 (depends on 1) The system of claim 1, wherein the authentication assertion is generated by an identity provider in response to at least one of: a determination that the client device is compliant with at least one compliance rule, a determination that the client device is enrolled with a management service as a managed device, or a determination that the particular application is a managed application. ### Claim 5 (depends on 1) The system of claim 1, wherein the authentication request is generated in response to receiving a redirection to an identity provider. ### Claim 6 (depends on 1) The system of claim 1, wherein the at least one device identification parameter comprises geolocation parameters. ### Claim 7 (depends on 1) The system of claim 1, wherein the at least one device identification parameter comprises an operating system version of the client device. ### Claim 8 (depends on 1) The system of claim 1, wherein the at least one device identification parameter comprises a device identifier associated with the client device. ### Claim 9 (depends on 1) The system of claim 1, wherein the at least one device identification parameter comprises a timestamp. ### Claim 10 (depends on 1) The system of claim 1, wherein the at least one device identification parameter comprises an application identifier associated with the particular application. ### Claim 11 A method for authenticating a user and determining a device posture during authentication, comprising: transmitting, from a client device to a management service, a request to enroll the client device as a managed device; obtaining, in the client device, a security certificate from the management service; receiving, in the client device, a command from the management service to install a particular application on the client device; initiating, in the client device, installation of the particular application in response to receiving the request to install the particular application; obtaining, in the client device, a virtual private network (VPN) configuration from the management service, the VPN configuration specifying that at least authentication requests transmitted from the particular application be routed through a VPN connection specified by the VPN configuration, the VPN configuration further defining a security layer applied to network routed through the VPN connection; obtaining, in the client device, an authentication request generated by the particular application; applying, in the client device, a transport layer security (TLS) security layer to the authentication request as specified by the VPN configuration, wherein the TLS security layer is applied by a tunnel client executed by the client device, and wherein the security layer comprises at least one device identification parameter embedded into packets transmitted by the tunnel client to a destination; transmit, from the client device, the authentication request through the VPN connection to the destination; obtaining, in the client device, an authentication assertion encoded in Security Assertion Markup Language (SAML); and providing, in the client device, the authentication assertion to the particular application installed on the client device. ### Claim 12 (depends on 11) The method of claim 11, wherein the at least one device identification parameter comprises at least one of: an application identifier associated with the particular application, a timestamp, a device identifier associated with the client device, an operating system version of the client device, geolocation parameters, or a network address of the client device. ### Claim 13 (depends on 11) The method of claim 11, wherein the security layer comprises an additional TLS layer applied to the authentication request by a tunnel client executed by the client device. ### Claim 14 (depends on 11) The method of claim 11, wherein the authentication assertion is generated by an identity provider in response to at least one of: a determination that the client device is compliant with at least one compliance rule, a determination that the client device is enrolled with a management service as a managed device, or a determination that the particular application is a managed application. ### Claim 15 (depends on 11) The method of claim 11, wherein the authentication request is generated in response to receiving a redirection to an identity provider. ### Claim 16 A non-transitory computer-readable medium comprising executable instructions for authenticating a user and determining a device posture during authentication, the executable instructions, when executed by a client device, cause the client device to at least: transmit to a management service a request to enroll the client device as a managed device; obtain a security certificate from the management service; receive a command from the management service to install a particular application on the client device; initiate installation of the particular application in response to receiving the request to install the particular application obtain a virtual private network (VPN) configuration from the management service, the VPN configuration specifying that at least authentication requests transmitted from the particular application be routed through a VPN connection specified by the VPN configuration, the VPN configuration further defining a security layer applied to network routed through the VPN connection; obtain an authentication request generated by the particular application; apply a transport layer security (TLS) security layer to the authentication request as specified by the VPN configuration, wherein the TLS security layer is applied by a tunnel client executed by the client device, and wherein the security layer comprises at least one device identification parameter embedded into packets transmitted by the tunnel client to a destination; transmit the authentication request through the VPN connection to the destination; obtain an authentication assertion encoded in Security Assertion Markup Language (SAML); and provide the authentication assertion to the particular application installed on the client device. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the at least one device identification parameter comprises at least one of: an application identifier associated with the particular application, a timestamp, a device identifier associated with the client device, an operating system version of the client device, geolocation parameters, or a network address of the client device. ### Claim 18 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the authentication request is secured with transport layer security (TLS) by the particular application. ### Claim 19 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the authentication assertion is generated by an identity provider in response to at least one of: a determination that the client device is compliant with at least one compliance rule, a determination that the client device is enrolled with a management service as a managed device, or a determination that the particular application is a managed application. ### Claim 20 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the authentication request is generated in response to receiving a redirection to an identity provider.