System and method for enforcing a policy for an authenticator device

• US 8,763,077 B2
• Filed: 10/08/2012
• Issued: 06/24/2014
• Est. Priority Date: 10/07/2011
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Duo Security Incorporated (Cisco Systems, Inc.)
• Inventors: Oberheide, Jon, Song, Douglas, Goodman, Adam
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US13/647,166
• Publication Number:
  US 20130091544A1
• Time in Patent Office: 624 Days
• Field of Search: 726/1
• US Class Current: 726/1
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication

Abstract

A system and method including defining at least one device authentication policy; at a policy engine, initializing authentication policy processing for an authenticator device; collecting device status assessment; evaluating policy compliance of the device status assessment to an associated defined device authentication policy; and enforcing use of the authenticator device according to the policy compliance.

Claims

1. A method comprising:

defining at least one authenticator device authentication policy through an administration interface;

at a policy engine, initializing authentication policy processing for an authenticator device;

collecting an authenticator device status assessment;

evaluating policy compliance of the authenticator device status assessment to an associated defined device authentication policy; and

enforcing use of the authenticator device according to the policy compliance comprising;

if the policy compliance indicates the authenticator device status assessment is in compliance with the authenticator device authentication policy, allowing the authenticator device to be used in authenticating a primary client device, wherein the primary client device is distinct from the authenticator device; and

if the policy compliance indicates the authenticator device status assessment is not in compliance with the authenticator device authentication policy, preventing the authenticator device to be used in authenticating the primary client device.

2. The method of claim 1, wherein upon receiving an authentication policy request at the policy engine, initializing authentication policy processing.

3. The method of claim 1, wherein collecting authenticator device status assessment includes collecting at least one application version number of an application on the authenticator device.

4. The method of claim 3, wherein collecting authenticator device status assessment is performed at an authenticator on the authenticator device, and further comprises, the authenticator communicating the device status assessment to the policy engine.

5. The method of claim 1, wherein collecting authenticator device status assessment includes collecting a vulnerability assessment.

6. The method of claim 5, wherein collecting a vulnerability assessment includes identifying a vulnerability assessment from an object identifier for an operative object of the authenticator device.

7. The method of claim 5, further comprising periodically collecting a vulnerability assessment and generating a historical view of the device status as part of the authenticator device status assessment used in evaluating policy compliance.

8. The method of claim 1, wherein the at least one authenticator device authentication policy is defined through an administrator user interface.

9. The method of claim 8, wherein a plurality of different authenticator device authentication policies are defined for a plurality of different accounts of an authentication system;

and the policy engine selects the authenticator device authentication policy for evaluation according to a mapping between the authenticator device and an account.

10. The method of claim 1, wherein the policy engine is integrated with an authentication system in a cloud computing environment.

11. The method of claim 1, wherein allowing the authenticator device to be used in authenticating a primary client device comprises allowing the authenticator device to facilitate transferring a passcode in authenticating the primary client device;

and preventing the authenticator device to be used in authenticating the primary client device comprises preventing the authenticator device from facilitating transfer of the passcode in authenticating the primary client device.

12. The method of claim 11, wherein enforcing use of the authenticator device further includes facilitating an authenticator device update to comply with the associated authenticator device authentication policy.

13. The method of claim 12, further comprising upon completing the authenticator device update, evaluating policy compliance and enforcing use of the authenticator device for at least a second time.

14. The method of claim 11, wherein allowing the authenticator device to be used in authenticating a primary client device and preventing the authenticator device from authenticating the primary client device are executed on the authenticator device.

15. The method of claim 11, wherein allowing the authenticator device to be used in authenticating a primary client device and preventing the authenticator device from authenticating the primary client device are executed in an authentication system.

16. The method of claim 11, wherein allowing the authenticator device to be used in authenticating a primary client device and preventing the authenticator device from authenticating the primary client device are executed on the authenticator device and in an authentication cloud system.

17. The method of claim 11, further comprising at an authenticator of the authenticator device, receiving the passcode;

wherein allowing the authenticator device to be used in authenticating a user includes displaying the passcode; and

wherein preventing the authenticator device from authenticating a user includes not displaying the passcode.

18. The method of claim 11, further comprising at an authenticator of the authenticator device receiving the passcode;

and wherein preventing the authenticator device from authenticating a user includes invalidating the passcode for authentication.