US 2025/0053632 A1 · FLEXIBLY OBTAINING DEVICE POSTURE SIGNALS IN MULTI-TENANT AUTHENTICATION SYSTEM

Abstract

An identity provider (IdP) defines an interface for obtaining device posture signals in a flexible manner. Third-party signal providers author plug-ins that conform to the defined interface and make the plug-ins available to the organizations that use their services. The plug-ins incorporate the third-party signals into the authentication logic of the IdP, allowing the authentication logic to obtain organization-defined information about client device posture of the client devices on which user authentication is taking place. This permits different organizations that use the IdP to tailor their authentication processes to the particular types of signals available to them, and to their own particular organization policies. This allows, for example, conformity to organization policies such as user data use policies.

Claims20

Dependent claims

An apparatus for authentication by a client device, comprising:

a processor;
memory coupled with the processor;
and
instructions stored in the memory and executable by the processor configured to cause the apparatus to:
receive, from a one or more third-party signal providers, via a corresponding one or more authentication plug-ins, and based on detection of an authentication event, device posture signals, wherein each authentication plug-in indicates how an authenticator component is to communicate with a corresponding third-party signal provider to obtain a corresponding device posture signal associated with the client device, and wherein the device posture signals provide an indication of a safety of the client device based on one or more characteristics of the client device;
send, to an identity provider system, the device posture signals;
and
receive, from the identity provider system, an indication of whether a user of the client device is authenticated.

5 more elements

An apparatus for authentication by an identity provider system, comprising:

a processor;
memory coupled with the processor;
and
instructions stored in the memory and executable by the processor configured to cause the apparatus to:
define an authentication plug-in interface for authentication plug-ins implemented at one or more client devices;
send, to the one or more client devices for installation, an authenticator component that obtains device posture signals from the authentication plug-ins implemented at the one or more client devices;
receive, from a client device of the one or more client devices, a one or more device posture signals, the one or more device posture signals generated by one or more third-party signal providers and obtained from one or more of the authentication plug-ins implemented at the client device, wherein the one or more device posture signals provide an indication of a safety of the client device based on one or more characteristics of the client device;
and
determine, based on the one or more device posture signals, whether to authenticate a user of the client device.

6 more elements

Dependencies are inferred from the claim text.

Flexibly obtaining device posture signals in multi-tenant authentication system

Life of this patent

Flexibly obtaining device posture signals in multi-tenant authentication system

Life of this patent

Abstract

Claims20