Technologies for authentication and single-sign-on using device security assertions

• US 9,749,310 B2
• Filed: 03/27/2015
• Issued: 08/29/2017
• Est. Priority Date: 03/27/2015
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Li, Hong, Sharma, Suman, Vicente, John B., Gimenez, Luis A., Ashley, Carlton D., Malpani, Navneet
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): TENG, LOUIS C
• Application Number:
  US14/670,955
• Publication Number:
  US 20160285858A1
• Time in Patent Office: 886 Days
• Field of Search: None
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Technologies for remote device authentication include a client computing device, an identity provider, and an application server in communication over a network. The identity provider sends an authentication challenge to the client. A capability proxy of the client intercepts an authentication challenge response and retrieves one or more security assertions from a secure environment of the client computing device. The capability proxy may be an embedded web server providing an HTTP interface to platform features of the client. The client sends a resource access token based on the security assertions to the identity provider. The identity provider verifies the resource access token and authenticates the client computing device based on the resource access token in addition to user authentication factors such as username and password. The identity provider sends an authentication response to the client, which forwards the authentication response to the application server. Other embodiments are described and claimed.

Claims

1. A computing device for remote device authentication, the computing device comprising:

a user authentication module to;

receive an authentication challenge from an identity provider; and

generate an authentication challenge response to authenticate a user of the computing device in response to receipt of the authentication challenge; and

a device capability module to;

intercept the authentication challenge response in response to generation of the authentication challenge response;

retrieve a security assertion from a secure environment of the computing device in response to interception of the authentication challenge response;

generate a resource access token as a function of the security assertion; and

transmit the authentication challenge response including the resource access token to the identity provider;

wherein the device capability module comprises an embedded technology access server of the computing device;

wherein to retrieve the security assertion comprises to (i) issue an HTTP request to the embedded technology access server and (ii) retrieve, by the embedded technology access server, the security assertion in response to issuance of the HTTP request; and

wherein the computing device further comprises a manageability engine to execute the embedded technology access server.

2. The computing device of claim 1, wherein:

to receive the authentication challenge from the identity provider comprises to receive the authentication challenge via a public network connection with the identity provider; and

to transmit the authentication challenge response comprises to transmit the authentication challenge response via the public network connection.

3. The computing device of claim 1, wherein:

the authentication challenge comprises an interactive form; and

to intercept the authentication challenge response comprises to intercept a submit action of the interactive form.

4. The computing device of claim 1, wherein to retrieve the security assertion from the secure environment comprises to retrieve the security assertion from a manageability engine of the computing device.

5. The computing device of claim 1, wherein the security assertion comprises an indication that the computing device is subject to a device management policy.

6. The computing device of claim 1, wherein the security assertion comprises a device trust level assertion associated with the computing device.

7. One or more computer-readable storage media comprising a plurality of instructions that in response to being executed cause a computing device to:

receive an authentication challenge from an identity provider;

generate an authentication challenge response to authenticate a user of the computing device in response to receiving the authentication challenge;

intercept, by a device capability module of the computing device, the authentication challenge response in response to generating the authentication challenge response;

retrieve, by the device capability module, a security assertion from a secure environment of the computing device in response to intercepting the authentication challenge response, wherein to retrieve the security assertion comprises to (i) issue an HTTP request to an embedded technology access server of the computing device and (ii) retrieve, by the embedded technology access server, the security assertion in response to issuing the HTTP request;

generate, by the device capability module, a resource access token as a function of the security assertion;

transmit, by the device capability module, the authentication challenge response including the resource access token to the identity provider; and

execute, by a manageability engine of the computing device, the embedded technology access server.

8. The one or more computer-readable storage media of claim 7, wherein:

to receive the authentication challenge from the identity provider comprises to receive the authentication challenge via a public network connection with the identity provider; and

to transmit the authentication challenge response comprises to transmit the authentication challenge response via the public network connection.

9. The one or more computer-readable storage media of claim 7, wherein:

to receive the authentication challenge comprises to receive an interactive form from the identity provider; and

to intercept the authentication challenge response comprises to intercept a submit action of the interactive form.

10. The one or more computer-readable storage media of claim 7, wherein to retrieve the security assertion comprises to retrieve an indication that the computing device is subject to a device management policy.

11. The one or more computer-readable storage media of claim 7, wherein to retrieve the security assertion comprises to retrieve a device trust level assertion associated with the computing device.

12. A method for remote device authentication, the method comprising:

receiving, by a computing device, an authentication challenge from an identity provider;

generating, by the computing device, an authentication challenge response to authenticate a user of the computing device in response to receiving the authentication challenge;

intercepting, by a device capability module of the computing device, the authentication challenge response in response to generating the authentication challenge response;

retrieving, by the device capability module, a security assertion from a secure environment of the computing device in response to intercepting the authentication challenge response, wherein retrieving the security assertion comprises (i) issuing an HTTP request to an embedded technology access server of the computing device and (ii) retrieving, by the embedded technology access server, the security assertion in response to issuing the HTTP request;

generating, by the device capability module, a resource access token as a function of the security assertion;

transmitting, by the device capability module, the authentication challenge response including the resource access token to the identity provider; and

executing, by a manageability engine of the computing device, the embedded technology access server.

13. The method of claim 12, wherein:

receiving the authentication challenge from the identity provider comprises receiving the authentication challenge via a public network connection with the identity provider; and

transmitting the authentication challenge response comprises transmitting the authentication challenge response via the public network connection.

14. The method of claim 12, wherein:

receiving the authentication challenge comprises receiving an interactive form from the identity provider; and

intercepting the authentication challenge response comprises intercepting a submit action of the interactive form.

15. The method of claim 12, wherein retrieving the security assertion comprises retrieving an indication that the computing device is subject to a device management policy.

16. The method of claim 12, wherein retrieving the security assertion comprises retrieving a device trust level assertion associated with the computing device.