Gateway with access checkpoint

• US 10,728,218 B2
• Filed: 02/26/2018
• Issued: 07/28/2020
• Est. Priority Date: 02/26/2018
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Lancioni, German, Wuehler, Eric Donald
• Primary Examiner(s): Zhao, Don G
• Application Number:
  US15/905,606
• Publication Number:
  US 20190268307A1
• Time in Patent Office: 883 Days
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

There is disclosed in one example a gateway apparatus to operate on an intranet, including: a hardware platform; and an access proxy engine to operate on the hardware platform and configured to: intercept an incoming packet; determine that the incoming packet is an access request directed to an access interface of a resource of the intranet; present an access checkpoint interface; receive an authentication input response; validate the authentication input response; and provide a redirection to the access interface of the device.

Claims

1. A gateway apparatus to operate on an intranet, comprising:

a hardware platform; and

an access proxy engine to operate on the hardware platform and configured to;

intercept an access request directed to an access interface of a resource of the intranet;

present an access checkpoint interface that requests an authentication input to the gateway apparatus;

receive the authentication input;

perform an authentication to the resource, based on a validation of the authentication input; and

provide a redirection to the access interface of the resource.

2. The gateway apparatus of claim 1, further comprising

an access proxy rules table (APRT) comprising data to correlate the resource with a host device and a security policy for the resource.

3. The gateway apparatus of claim 2, wherein the APRT further comprises stored login credentials for the resource, wherein the access proxy engine is configured to perform the authentication before providing the redirection.

4. The gateway apparatus of claim 2, wherein the access proxy engine is further configured to determine whether a session exists, based on identifying the resource has an existing entry in the APRT.

5. The gateway apparatus of claim 2, wherein the access proxy engine is further configured to determine that the resource does not have an existing entry in the APRT, and to create an entry for the resource in the APRT.

6. The gateway apparatus of claim 2, wherein the APRT further comprises a severity field indicating a potential harm or severity of an unauthorized access to the resource, and the access proxy engine is further configured to craft the security policy based on the severity field.

7. The gateway apparatus of claim 1, wherein the access proxy engine is further configured to establish a session for accessing the resource.

8. The gateway apparatus of claim 7, wherein the access proxy engine is further configured to receive a second access request for the resource, and determine that there is an existing session for the resource.

9. The gateway apparatus of claim 8, wherein the access proxy engine is configured to provide a redirection without presenting the access checkpoint interface after determining that the second access request is within scope of the existing session.

10. The gateway apparatus of claim 8, wherein the access proxy engine is further configured to present the access checkpoint interface based on a determination that a current request is out of scope of the existing session.

11. The gateway apparatus of claim 1, wherein the access proxy engine is further configured to periodically scan the intranet for devices, and to add APRT entries for the devices.

12. The gateway apparatus of claim 1, wherein the access proxy engine is further configured to determine that a new device has been added to the intranet, and to add APRT entry for the new device.

13. The gateway apparatus of claim 1, wherein the access proxy engine is further configured to attempt to identify authentication credentials for a device by testing a dictionary of common credentials.

14. The gateway apparatus of claim 1, wherein the access proxy engine is further configured to attempt to identify authentication credentials for a device by querying a credentials service for possible credentials.

15. A gateway apparatus to operate on an intranet, comprising:

a hardware platform; and

an access proxy engine to operate on the hardware platform and configured to;

intercept an incoming packet;

determine that the incoming packet is an access request directed to an access interface of a resource of the intranet;

present an access checkpoint interface;

receive an authentication input response;

validate the authentication input response; and

provide a redirection to the access interface of the resource, wherein the resource is an internet of things (IoT) device.

16. One or more tangible, non-transitory computer-readable storage mediums having stored thereon instructions to instruct a device to provide an access proxy engine configured to:

intercept an access request directed to an access interface of a resource of an intranet;

present an access checkpoint interface that requests an authentication input to the device;

receive the authentication input;

perform an authentication to the resource, based on a validation of the authentication input; and

provide a redirection to the access interface of the resource.

17. The one or more tangible, non-transitory computer-readable storage mediums of claim 16, wherein the instructions are further to provide an access proxy rules table (APRT) comprising data to correlate the resource with a host device and a security policy for the resource.

18. The one or more tangible, non-transitory computer-readable storage mediums of claim 17, wherein the APRT further comprises stored login credentials for the resource, and the access proxy engine is configured to perform the authentication before providing the redirection.

19. The one or more tangible, non-transitory computer-readable storage mediums of claim 17, wherein the access proxy engine is further configured to determine whether a session exists, based on identifying the resource has an existing entry in the APRT.

20. The one or more tangible, non-transitory computer-readable storage mediums of claim 17, wherein the access proxy engine is further configured to determine that the resource does not have an existing entry in the APRT, and to create an entry for the resource in the APRT.

21. The one or more tangible, non-transitory, computer-readable storage mediums of claim 17, wherein the APRT further comprises a severity field indicating a potential harm or severity of an unauthorized access to the resource, and the access proxy engine is further configured to craft the security policy based on the severity field.

22. The one or more tangible, non-transitory, computer-readable storage mediums of claim 16, wherein the access proxy engine is further configured to establish a session for accessing the resource.

23. A computer-implemented method of a gateway device, comprising:

intercepting an access request directed to an access interface of a resource of an intranet;

presenting an access checkpoint interface that requests an authentication input to the gateway device;

receiving the authentication input;

performing an authentication to the resource, based on a validation of the authentication input; and

providing a redirection to the access interface of the resource.

24. The method of claim 23, further comprising

providing an access proxy rules table (APRT) comprising data to correlate the resource with a host device and a security policy for the resource.

25. The method of claim 24, further comprising

storing login credentials for the resource, and performing the authentication before providing the redirection.