TRANSPARENT PROXY SYSTEM WITH AUTOMATED SUPPLEMENTAL AUTHENTICATION FOR PROTECTED ACCESS RESOURCES
Techniques are disclosed herein for facilitating dynamic risk assessment and automated triggering of supplemental authentication for protected access resources. More specifically, the techniques described herein provide security mechanisms that can be triggered in response to a risk assessment determined in response to request to establish a connection between an access system and a protected resource. Alternatively or additionally, the security mechanisms can transparently monitor an authenticated connection between an access system and a resource and automatically trigger supplemental authentication based on a dynamic risk assessment. In some embodiments, a feature set of the authenticated connection and commands initiated over the authenticated connection are monitored and underlying information captured to dynamically generate the risk assessment or score. The supplemental authentication can be triggered when the risk score exceeds a risk threshold.
1 . A transparent proxy system comprising:
one or more processors; and
one or more computer readable storage media having program instructions stored thereon which, when executed by the one or more processors, cause the transparent proxy system to:
intercept a command initiated by a resource access system over an authenticated connection, wherein the command is initiated for delivery to and execution by a protected resource;
generate a risk score based on a type of the command and a feature set corresponding to the authenticated connection; and
trigger a supplemental authentication if the risk score exceeds a risk threshold.
2 . The transparent proxy system of claim 1 , wherein the instructions, when executed by the one or more processors, further cause the transparent proxy system to maintain records corresponding to each authenticated connection.
3 . The transparent proxy system of claim 2 , wherein the records include one or more of calendric and temporal data, executed command data, and one or more features of the feature set corresponding to the authenticated connection.
4 . The transparent proxy system of claim 2 , wherein the records comprises video data.
5 . The transparent proxy system of claim 1 , wherein the instructions, when executed by the one or more processors, further cause the transparent proxy system to perform the supplementation authentication.
6 . The transparent proxy system of claim 5 , wherein the instructions, when executed by the one or more processors, further cause the transparent proxy system to relay the command to the protected resource for execution when the supplemental authentication is satisfied.
7 . The transparent proxy system of claim 5 , wherein the instructions, when executed by the one or more processors, further cause the transparent proxy system to perform one or more pre-determined actions when the supplemental authentication is not satisfied.
8 . The transparent proxy system of claim 5 , wherein the supplemental authentication comprises authenticating the user via a second device associated with the user.
9 . The transparent proxy system of claim 8 , wherein to perform the supplementation authentication, the instructions, when executed by the one or more processors, further cause the transparent proxy system to request geolocation information including one or more of GPS information or Internet Protocol address information from the second device, wherein the supplemental authentication comprises a geofencing policy that is satisfied when the second device is determined to be located within a predetermined area.
10 . The transparent proxy system of claim 8 , wherein to perform the supplementation authentication, the instructions, when executed by the one or more processors, further cause the transparent proxy system to request proximity information indicating a proximity between the second device and the resource access system, wherein the supplemental authentication comprises a proximity policy that is satisfied when the second device is within a predetermined distance to the resource access system.
11 . The transparent proxy system of claim 10 , wherein an established Bluetooth connection is indicative of the second device and the resource access system being sufficiently proximate to satisfy the proximity policy.
12 . The transparent proxy system of claim 8 , wherein to perform the supplementation authentication, the instructions, when executed by the one or more processors, further cause the transparent proxy system to request fingerprint, retina, face, voice or biometric based identification from the user via the second device.
13 . The transparent proxy system of claim 1 , further comprising extracting the feature set in response to a resource connection request initiated by the resource access system.
14 . The transparent proxy system of claim 1 , wherein the command is initiated by the resource access system via one or more of Secure Shell (SSH) or File Transfer Protocol (FTP).
15 . A method of operating a transparent proxy system, the method comprising:
intercepting a command initiated by a resource access system over an authenticated connection,
wherein the command is initiated for delivery to and execution by a protected resource;
generating a risk score based on a type of the command and a feature set corresponding to the authenticated connection; and
performing a supplemental authentication if the risk score exceeds a risk threshold.
16 . The method of claim 14 , further comprising maintain records corresponding to each authenticated connection, wherein the records include one or more of calendric and temporal data, executed command data, and one or more features of the feature set corresponding to the authenticated connection.
17 . The method of claim 15 , wherein the records comprises video data.
18 . The method of claim 14 , further comprising:
relaying the command to the protected resource for execution when the supplemental authentication is satisfied.
19 . The method of claim 14 , wherein the supplemental authentication comprises authenticating the user via a second device associated with the user.
20 . A computer readable storage media having program instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to:
intercept a command initiated by a resource access system over an authenticated connection, wherein the command is initiated for delivery to and execution by a protected resource;
generate a risk score based on a feature set corresponding to the authenticated connection and the command; and
trigger a supplemental authentication if the risk score exceeds a risk threshold.