Intercept-based multifactor authentication enrollment of clients as a network service

• US 10,701,056 B2
• Filed: 01/18/2019
• Issued: 06/30/2020
• Est. Priority Date: 09/30/2016
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Palo Alto Networks Incorporated
• Inventors: Murthy, Ashwath Sreenivasa
• Primary Examiner(s): Su, Sarah
• Application Number:
  US16/252,430
• Publication Number:
  US 20190158480A1
• Time in Patent Office: 529 Days
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Techniques for intercept-based multifactor authentication client enrollment as a network service are disclosed. In some embodiments, a system, process, and/or computer program product for intercept-based multifactor authentication client enrollment as a network service includes monitoring a session at a firewall, intercepting a request for access to a resource while monitoring the session at the firewall, determining that a user associated with the session is not enrolled for multifactor authentication, and initiating enrollment of the user for the multifactor authentication.

Claims

1. A system, comprising:

a processor configured to;

monitor a session at a firewall;

intercept a request for access to a resource while monitoring the session at the firewall;

determine that a user associated with the session is not enrolled for multifactor authentication;

trigger a workflow for a multifactor authentication client enrollment service provided by the firewall to initiate enrollment of the user for the multifactor authentication if the resource is associated with an authentication profile for multifactor authentication; and

allow access to the resource prior to completing the enrollment of the user for the multifactor authentication, wherein the user is allowed access to the resource for a predetermined grace period of time prior to being required to complete the enrollment of the user for the multifactor authentication; and

register each authentication factor of the multifactor authentication only one time per user using the multifactor authentication client enrollment service, independent of a number of applications or resources protected by the multifactor authentication, wherein the firewall enforces an authentication policy that includes one or more multifactor authentication rules for the resource and one or more distinct multifactor authentication rules for another resource; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1, wherein the firewall performs the multifactor authentication as a network service.

3. The system recited in claim 1, wherein the authentication profile is for a first authentication factor and a second authentication factor.

4. The system recited in claim 1, wherein the authentication profile is for a plurality of authentication factors for performing the multifactor authentication.

5. The system recited in claim 1, wherein the authentication profile is a multifactor authentication profile.

6. The system recited in claim 1, wherein the processor is further configured to:

complete the enrollment of the user for the multifactor authentication.

7. The system recited in claim 1, wherein the processor is further configured to:

complete the enrollment of the user for the multifactor authentication; and

allow access to the resource after completing the enrollment of the user for the multifactor authentication.

8. The system recited in claim 1, wherein the processor is further configured to:

block access to the resource prior to completing the enrollment of the user for the multifactor authentication if the predetermined period of time has expired.

9. A method, comprising:

monitoring a session at a firewall;

intercepting a request for access to a resource while monitoring the session at the firewall;

determining that a user associated with the session is not enrolled for multifactor authentication;

triggering a workflow for a multifactor authentication client enrollment service provided by the firewall to initiate enrollment of the user for the multifactor authentication if the resource is associated with an authentication profile for multifactor authentication; and

allowing access to the resource prior to completing the enrollment of the user for the multifactor authentication, wherein the user is allowed access to the resource for a predetermined grace period of time prior to being required to complete the enrollment of the user for the multifactor authentication, and

registering each authentication factor of the multifactor authentication only one time per user using the multifactor authentication client enrollment service, independent of a number of applications or resources protected by the multifactor authentication, wherein the firewall enforces an authentication policy that includes one or more multifactor authentication rules for the resource and one or more distinct multifactor authentication rules for another resource.

10. The method of claim 9, wherein the authentication profile is for a first authentication factor and a second authentication factor.

11. The method of claim 9, wherein the authentication profile is for a plurality of authentication factors for performing the multifactor authentication.

12. The method of claim 9, wherein the authentication profile is a multifactor authentication profile.

13. The method of claim 9, further comprising:

completing the enrollment of the user for the multifactor authentication.

14. The method of claim 9, further comprising:

completing the enrollment of the user for the multifactor authentication; and

allowing access to the resource after completing the enrollment of the user for the multifactor authentication.

15. The method of claim 9, further comprising:

blocking access to the resource prior to completing the enrollment of the user for the multifactor authentication if the predetermined period of time has expired.

16. The method of claim 9, wherein the firewall performs the multifactor authentication as a network service.

17. A computer program product, the computer program product being embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:

monitoring a session at a firewall;

intercepting a request for access to a resource while monitoring the session at the firewall;

determining that a user associated with the session is not enrolled for multifactor authentication;

triggering a workflow for a multifactor authentication client enrollment service provided by the firewall to initiate enrollment of the user for the multifactor authentication if the resource is associated with an authentication profile for multifactor authentication; and

allowing access to the resource prior to completing the enrollment of the user for the multifactor authentication, wherein the user is allowed access to the resource for a predetermined grace period of time prior to being required to complete the enrollment of the user for the multifactor authentication, and

registering each authentication factor of the multifactor authentication only one time per user using the multifactor authentication client enrollment service, independent of a number of applications or resources protected by the multifactor authentication, wherein the firewall enforces an authentication policy that includes one or more multifactor authentication rules for the resource and one or more distinct multifactor authentication rules for another resource.

18. The computer program product recited in claim 17, further comprising computer instructions for:

completing the enrollment of the user for the multifactor authentication.

19. The computer program product recited in claim 17, further comprising computer instructions for:

completing the enrollment of the user for the multifactor authentication; and

allowing access to the resource after completing the enrollment of the user for the multi factor authentication.

20. The computer program product recited in claim 17, further comprising computer instructions for:

blocking access to the resource prior to completing the enrollment of the user for the multifactor authentication if the predetermined period of time has expired.