System and method for enforcing a policy for an authenticator device

• US 9,524,388 B2
• Filed: 01/06/2015
• Issued: 12/20/2016
• Est. Priority Date: 10/07/2011
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Duo Security Incorporated (Cisco Systems, Inc.)
• Inventors: Oberheide, Jon, Song, Douglas, Goodman, Adam
• Primary Examiner(s): Bayou, Yonas
• Application Number:
  US14/590,512
• Publication Number:
  US 20150161378A1
• Time in Patent Office: 714 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication

Abstract

A system and method including defining at least one device authentication policy; at a policy engine, initializing authentication policy processing for an authenticator device; collecting device status assessment; evaluating policy compliance of the device status assessment to an associated defined device authentication policy; and enforcing use of the authenticator device according to the policy compliance.

Claims

1. A method comprising:

within a policy engine, defining at least one authenticator device authentication policy through an administration interface;

collecting a device status assessment from an authenticator device;

evaluating policy compliance of the device status assessment to an associated device authentication policy of the policy engine; and

enforcing use of the authenticator device according to the policy compliance comprising;

if the policy compliance indicates the authenticator device status assessment is in compliance with the authenticator device authentication policy, allowing the authenticator device to be used in an authentication process; and

if the policy compliance indicates the authenticator device status assessment is not in compliance with the authenticator device authentication policy, preventing the authenticator device to be used in the authentication process.

2. The method of claim 1, wherein the authentication process is approving a secondary-factor of authentication of a login attempt.

3. The method of claim 1, wherein the authentication process is registration of the authenticator device for completing two-factor authentication of an account.

4. The method of claim 1, wherein the device status assessment is associated with an individually assigned device authentication policy.

5. The method of claim 1, wherein the device status assessment is associated with a device authentication policy that is assigned to a group of accounts;

wherein an account of the authenticator device is included in the group of accounts.

6. The method of claim 1, wherein the device status assessment is associated with a device authentication policy assigned to the device type of the authenticator device.

7. The method of claim 1, wherein collecting a device status assessment from an authenticator device includes device status properties that include device passcode lock activation status, GPS/GeoIP location, full disk encryption status, HSM support, and number of apps with communication app access.

8. The method of claim 1, wherein evaluating policy compliance of the device status assessment to an associated defined device authentication policy is periodically evaluated.

9. The method of claim 8, further comprising transmitting a notification to a destination endpoint if the authenticator device status assessment is not in compliance with the authenticator device authentication policy.

10. The method of claim 1, further comprising transmitting a notification to a destination endpoint if the authenticator device status assessment is not in compliance with the authenticator device authentication policy.

11. The method of claim 1, wherein the authentication process comprises completing one-time passcode authentication;

wherein evaluating policy compliance of the device status assessment to an associated device authentication policy comprises verifying the authenticator device prevents access to a telephony messaging inbox; and

wherein the authenticator device status assessment is not in compliance with the authenticator device authentication policy if an application has access to a telephony messaging inbox.

12. The method of claim 1, wherein allowing the authentication process includes permitting approval of a login request notification in a two-factor authentication application.

13. The method of claim 1, wherein the login request notification is a push notification of the two-factor authentication application.

14. A method comprising:

defining at least one authenticator device authentication policy through an administration interface;

collecting a device status assessment from an authenticator device;

evaluating policy compliance of the device status assessment to an associated device authentication policy; and

receiving an authentication push notification at an authentication application on the authenticator device;

enforcing use of the authenticator device according to the policy compliance comprising;

if the policy compliance indicates the authenticator device status assessment is in compliance with the authenticator device authentication policy, allowing the authenticator application to be used in authenticating a login attempt associated with the authentication push notification; and

if the policy compliance indicates the authenticator device status assessment is not in compliance with the authenticator device authentication policy, preventing the authenticator application in authenticating the login attempt associated with the authentication push notification.

15. The method of claim 14, wherein the push notification is two-factor authentication request is initiated from an application on the same device as the authenticator device.

16. A method comprising:

defining at least one authenticator device authentication policy through an administration interface;

collecting a device status assessment from an authenticator device;

establishing a passcode secondary factor authentication request in a passcode authentication application on the authenticator device;

evaluating policy compliance of the device status assessment to an associated device authentication policy; and

enforcing use of the authenticator device according to the policy compliance comprising;

if the policy compliance indicates the authenticator device status assessment is in compliance with the authenticator device authentication policy, allowing the authenticator device to be used in authenticating a passcode secondary-factor authentication request; and

if the policy compliance indicates the authenticator device status assessment is not in compliance with the authenticator device authentication policy, preventing the authenticator device from authenticating the passcode secondary factor authentication request.

17. The method of claim 16, wherein the passcode two-factor authentication request is initiated from an application on the same device as the authenticator device.

18. The method of claim 16, wherein allowing the authenticator device to be used in authenticating the passcode secondary-factor authentication request comprises displaying the passcode;

and wherein preventing the authenticator device from authenticating the passcode secondary-factor authentication request comprises not displaying the passcode.

19. The method of claim 16, wherein preventing the authenticator device from authenticating the passcode secondary-factor authentication request comprises invalidating the passcode for authentication.