System and method for transparent multi-factor authentication and security posture checking

1. A method for creating a secure connection between a remote client computing device and an enterprise asset platform, the method comprising:

receiving at a server a request from a client computing device in communication with the server across an electronic communication network, the request being one of a registration request and a request to access the asset platform, the request including a client computing device unique identifier;

if the request is to access the asset platform, based on a determination that the client computing device is previously blocked from accessing the asset platform, terminating the method;

if the request is to access the asset platform, based on a determination that the client computer device is not previously blocked from accessing the asset platform providing a validation query to the client computing device, the validation query containing questions based on a particular authentication policy previously assigned to the client computing device;

based on a determination that a response to the validation query is correct, providing an access token to the client computing device, the access token verifiable at the asset platform;

receiving at the asset platform the access token from the client computing device with the access request;

decrypting the access token;

verifying the decrypted access token;

if the decrypted access token is not successfully verified, terminating the method;

if the decrypted access token is successfully verified, then:

generating a certificate for the client computing device and an end user of the client computing device;

transmitting the generated certificate to the client computing device;

if the request is a registration request, then:

generating a disambiguation query in accordance with predefined policy at the server;

providing the disambiguation query the client computing device;

receiving a response to the disambiguation inquiry from the client computing device;

verifying the contents of the disambiguation query response in relation to a predefined criteria;

the verifying step being done remote from the client computing device in a manner transparent to a user of the client computing device;

evaluating the disambiguation query response by assigning points to a response for each portion of the disambiguation query;

based on the assigned points, associating the client computing device to the particular authentication policy; and

if the disambiguation query response does meet the predefined policy, associating the client computing device to the predefined policy.

2. The method of claim 1 , the determining step including comparing the client computing device unique identifier to a listing of blocked client computing devices in a data store that is in communication with the server.

3. The method of claim 1 , the disambiguation query including predefined questions resident in a data store in communication with the server.

4. The method of claim 3 , the predefined questions based on one or more client computing device configuration details, installed application revision number, listing of installed applications, hardware identifiers, and content from one or more image files.

5. The method of claim 1 , including if a cumulative point score is below a predetermined threshold, at least one of terminating the method and assigning a default policy.

6. The method of claim 1 , including:

examining at least one of device tables and device records in a data store in communication with server to locate an association between a client computing device identifier and the assigned policy; and

if no association is located, terminating the method.

7. The method of claim 6 , including:

inserting a timestamp into the access token; and

associating the access token with a predetermined expiration deadline.

8. The method of claim 1 , including establishing an active session between the client computing device and the asset platform.

9. The method of claim 8 , including renewing the token prior to expiration of a time stamp associated with the token.

10. The method of claim 8 , including performing security posture rechecks of the client computing device token validity during the session.

11. A non-transitory computer readable medium containing computer-readable instructions stored therein for causing a control processor to perform a method for creating a secure connection between a remote client computing device and an enterprise asset platform, the method comprising:

receiving at a server a request from a client computing device in communication with the server across an electronic communication network, the request being one of a registration request and a request to access the asset platform, the request including a client computing device unique identifier;

if the request is to access the asset platform, based on a determination that the client computing device is previously blocked from accessing the asset platform, terminating the method;

if the request is to access the asset platform, based on a determination that the client computer device is not previously blocked from accessing the asset platform providing a validation query to the client computing device, the validation query containing questions based on a particular authentication policy previously assigned to the client computing device;

based on a determination that a response to the validation query is correct, providing an access token to the client computing device, the access token verifiable at the asset platform;

receiving at the asset platform the access token from the client computing device with the access request;

decrypting the access token;

verifying the decrypted access token;

if the decrypted access token is not successfully verified, terminating the method;

if the decrypted access token is successfully verified, then:

generating a certificate for the client computing device and an end user of the client computing device;

transmitting the generated certificate to the client computing device;

if the request is a registration request, then:

generating a disambiguation query in accordance with predefined policy at the server;

providing the disambiguation query the client computing device;

receiving a response to the disambiguation inquiry from the client computing device;

verifying the contents of the disambiguation query response in relation to a predefined criteria;

the verifying step being done remote from the client computing device in a manner transparent to a user of the client computing device;

evaluating the disambiguation query response by assigning points to a response for each portion of the disambiguation query;

based on the assigned points, associating the client computing device to the particular authentication policy; and

if the disambiguation query response does meet the predefined policy, associating the client computing device to the predefined policy.

12. The non-transitory computer readable medium of claim 11 containing computer-readable instructions stored therein to cause the control processor to perform the method including:

establishing an active session between the client computing device and the asset platform;

renewing the token prior to expiration of a time stamp associated with the token; and

performing security posture rechecks of the client computing device token validity during the session.

13. A system for creating a secure connection between a remote client computing device and an enterprise asset platform, the system comprising:

a server including a control processor in communication with a client computing device across an electronic communication network, the server in communication with a data store and at least one asset platform across the electronic communication network;

the server including an encryption/decryption module configured to receive from the client computing device a request being one of a registration request and a request to access the asset platform, the request including a client computing device unique identifier;

the server control processor configured to access executable program instructions that cause the server control processor to:

if the request is to access the asset platform, based on a determination that the client computing device is previously blocked from accessing the asset platform by accessing at least one of a device record store and a device table store, terminate creation of the secure connection;

if the request is to access the asset platform, based on a determination that the client computer device is not previously blocked from accessing the asset platform provide a validation query to the client computing device, the validation query containing questions based on a particular authentication policy previously assigned to the client computing device;

based on a determination that a response to the validation query is correct, provide an access token to the client computing device, the access token verifiable at the asset platform;

receive at the asset platform the access token from the client computing device with the access request;

decrypt the access token;

verify the decrypted access token;

if the decrypted access token is not successfully verified, terminate creation of the secure connection;

if the decrypted access token is successfully verified, then:

generate a certificate for the client computing device and an end user of the client computing device; and

transmit the generated certificate to the client computing device;

if the request is a registration request, then:

generate at the server a disambiguation query in accordance with a predefined policy;

provide the disambiguation query the client computing device;

receive a response to the disambiguation inquiry from the client computing device;

verify the contents of the disambiguation query response in relation to a predefined criteria;

the verifying step being done remote from the client computing device in a manner transparent to a user of the client computing device;

evaluate the disambiguation query response by assigning points to a response for each portion of the disambiguation query;

based on the assigned points, associate the client computing device to the particular authentication policy; and

if the disambiguation query response does meet the predefined policy, associate the client computing device to the predefined policy.

14. The system of claim 13 , the server control processor configured to access executable program instructions that cause the server control processor to, if the request is an access request:

establish an active session between the client computing device and the asset platform;

renew the token prior to expiration of the session; and

perform security posture rechecks of the client computing device token validity during the session.