Network access session detection to provide single-sign on (SSO) functionality for a network access control device

• US 9,729,539 B1
• Filed: 03/28/2014
• Issued: 08/08/2017
• Est. Priority Date: 03/28/2014
• Status: Active Grant

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Inventors: Agrawal, Ankur, Rajagopalan, Chandrasekaran
• Primary Examiner(s): Williams, Jeffery
• Application Number:
  US14/228,734
• Time in Patent Office: 1,229 Days
• Field of Search: None
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols

Abstract

This disclosure describes techniques for verifying the identity of a user with a network access control (NAC) device in response to receiving a security assertion request for the user. To verify the identity of a user, an NAC device may, in response to receiving a security assertion request from a user agent executing on a client device, cause the user agent to redirect a session verification request to an NAC client executing on the client device. The NAC client may detect the session verification request, and provide information indicative of a valid network access session for the user to the NAC device. The NAC device may verify the identity of the user based on the information indicative of the valid network access session. In this way, an NAC device may verify the identity of a user without requiring the user to re-authenticate with the NAC device.

Claims

1. A method comprising:

receiving, with a network access control (NAC) device, a security assertion request from a user agent executing on a client device, the security assertion request including a request for a security assertion to be made by the NAC device, the security assertion indicating that a user of the user agent has been authenticated by the NAC device;

sending, with the NAC device, a redirect message to the user agent in response to receiving the security assertion request, the redirect message including information indicative of the security assertion request; and

selectively issuing, with the NAC device, a security assertion that is responsive to the security assertion request without requiring the user to re-authenticate with the NAC device based on whether the NAC device receives session verification information from a NAC client executing on the client device in response to sending the redirect message to the user agent.

2. The method of claim 1, wherein the redirect message specifies that the redirect message is to be redirected to a hostname that is pre-negotiated between the NAC device and the NAC client.

3. The method of claim 1, wherein the redirect message specifies that the redirect message is to be redirected to a hostname, wherein the hostname is resolved by the client device to an internet protocol (IP) address that is listened to by the NAC client when a network access session has been established between the user agent and the NAC device.

4. The method of claim 3, wherein the IP address is a loopback IP address.

5. The method of claim 3, wherein the hostname is resolved to an IP address associated with the NAC device when the network access session has not been established between the user agent and the NAC device.

6. The method of claim 1, further comprising:

establishing, with the NAC device, a network access session between the user agent and the NAC device via the NAC client; and

sending, with the NAC device, a hostname to the NAC client in response to establishing the network access session, wherein the redirect message specifies that the redirect message is to be redirected to the hostname.

7. The method of claim 1, wherein selectively issuing, with the NAC device, the security assertion comprises:

receiving, with the NAC device, a session verification message from the NAC client in response to sending the redirect message to the user agent, the session verification message including the information indicative of the security assertion request and the session verification information;

determining, with the NAC device, that the session verification message corresponds to the security assertion request based on the information indicative of the security assertion request included in the session verification message; and

issuing the security assertion that is responsive to the security assertion request without requiring the user to re-authenticate with the NAC device in response to determining that the session verification message corresponds to the security assertion request.

8. The method of claim 1, wherein selectively issuing, with the NAC device, the security assertion comprises:

receiving, with the NAC device, a session verification message from the NAC client in response to sending the redirect message to the user agent, the session verification message including the information indicative of the security assertion request and the session verification information;

determining, with the NAC device, that the session verification message corresponds to the security assertion request based on the information indicative of the security assertion request included in the session verification message;

determining, with the NAC device, that the user agent has a network access session established between the user agent and the NAC device based on the session verification information; and

issuing the security assertion for the user that is responsive to the security assertion request without requiring the user to re-authenticate with the NAC device in response to determining that the user agent has the network access session established between the user agent and the NAC device.

9. The method of claim 8,

wherein determining, with the NAC device, that the user agent has the network access session established between the user agent and the NAC device comprises:

determining, with the NAC device, a session that corresponds to the session verification message based on the session verification information;

determining, with the NAC device, that the user that is associated with the session has the network access session established between the user agent and the NAC device, and

wherein selectively issuing, with the NAC device, the security assertion further comprises;

generating the security assertion such that the security assertion includes information that identifies the user and a statement that indicates that the user has authenticated with the NAC device.

10. The method of claim 1, wherein selectively issuing, with the NAC device, the security assertion comprises issuing, with the NAC device, the security assertion without requiring the user to re-authenticate with the NAC device in response to the NAC device receiving the session verification information from the NAC client.

11. The method of claim 10, wherein selectively issuing, with the NAC device, the security assertion further comprises:

in response to the NAC device not receiving the session verification information from the NAC client and instead receiving a response to the redirect message from the user agent, authenticating the user and issuing the security assertion for the user in response to successfully authenticating the user.

12. The method of claim 1, wherein selectively issuing, with the NAC device, the security assertion comprises selectively issuing, with the NAC device, the security assertion that is responsive to the security assertion request without requiring the user to re-authenticate with the NAC device based on whether the NAC device receives the session verification information from the NAC client or instead receives a response to the redirect message from the user agent.

13. The method of claim 1, wherein selectively issuing, with the NAC device, the security assertion further comprises:

in response to the NAC device receiving the session verification information from the NAC client, issuing, with the NAC device, the security assertion without requiring the user to re-authenticate with the NAC device; and

in response to the NAC device receiving a response to the redirect message from the user agent, authenticating, with the NAC device, the user and issuing the security assertion for the user in response to successfully authenticating the user.

14. The method of claim 1, wherein selectively issuing, with the NAC device, the security assertion comprises:

sending, with the NAC device, the security assertion to the NAC client when the NAC device receives the session verification information from the NAC client; and

sending, with the NAC device, the security assertion to the user agent when the NAC device receives a response to the redirect message from the user agent.

15. The method of claim 1,

wherein the security assertion request is generated by a service provider and sent by the service provider to the user agent in response to the user agent requesting access to a resource provided by the service provider, and

wherein the user agent forwards the security assertion request to the NAC device.

16. The method of claim 1, wherein the user agent comprises a web-browser.

17. The method of claim 1, wherein the user agent comprises a Hypertext Transfer Protocol (HTTP) user agent.

18. A network access control (NAC) device comprising:

one or more processors configured to;

receive a security assertion request from a user agent executing on a client device, the security assertion request including a request for a security assertion to be made by the NAC device, the security assertion indicating that a user of the user agent has been authenticated by the NAC device;

send a redirect message to the user agent in response to receiving the security assertion request, the redirect message including information indicative of the security assertion request; and

selectively issue a security assertion that is responsive to the security assertion request without requiring the user to re-authenticate with the NAC device based on whether the NAC device receives session verification information from an NAC client executing on the client device in response to sending the redirect message to the user agent.

19. The NAC device of claim 18, wherein the redirect message specifies that the redirect message is to be redirected to a hostname, wherein the hostname is resolved by the client device to an internet protocol (IP) address that is listened to by the NAC client when a network access session has been established between the user agent and the NAC device.

20. The NAC device of claim 19, wherein the IP address is a loopback IP address.

21. The NAC device of claim 18, wherein the one or more processors are further configured to:

establish a network access session between the user agent and the NAC device via the NAC client; and

send a hostname to the NAC client in response to establishing the network access session, wherein the redirect message specifies that the redirect message is to be redirected to the hostname.

22. The NAC device of claim 18, wherein the one or more processors are further configured to:

issue the security assertion without requiring the user to re-authenticate with the NAC device in response to the NAC device receiving the session verification information from the NAC client;

authenticate the user in response to the NAC device not receiving the session verification information from the NAC client; and

issue the security assertion for the user in response to successfully authenticating the user when the NAC device does not receive the session verification information from the NAC client.

23. The NAC device of claim 18, wherein the one or more processors are further configured to:

issue the security assertion without requiring the user to re-authenticate with the NAC device in response to the NAC device receiving the session verification information from the NAC client;

authenticate the user in response to the NAC device receiving a response to the redirect message from the user agent; and

issue the security assertion for the user in response to successfully authenticating the user when the NAC device receives the response to the redirect message from the user agent.

24. The NAC device of claim 18, wherein the user agent comprises a web-browser.

25. The NAC device of claim 18, wherein the user agent comprises a Hypertext Transfer Protocol (HTTP) user agent.