Identity security gateway agent
Systems and methods for network security are provided. Various embodiments of the present technology provide an integrated security platform that combines PAM, CASB, identity access management, and multi-factor authentication onto one platform. This integration allows for a frictionless deployment that can be utilized by companies that may not have large teams of system administrators. As such, some embodiments provide a gateway solution and a proxy solution that is easy to deploy. The user equipment (e.g., computer, phone, point of sale terminal, etc.) can be used as a gateway. An agent can be included on each endpoint that combines gateway functionality of PAM and web rewrite and proxy functionality of a CASB deployment into an endpoint solution.
1. A system comprising:
a remote head end having one or more vaults having stored therein a plurality of usernames and passwords for target network components; and
a security agent under control of a processor associated with a client device, the security agent including an identity defined networking component to develop a device profile based on hardware and software configurations of the client device;
the security agent at the client device including a virtual private networking component to establish a tunnel between the client device and the remote head end and transfer from the client device, via the tunnel, an identifier from the client device to the remote head end to be validated at the remote head end and used to retrieve an encrypted username and password at the head end, the encrypted username and password associated with a selected target network component; and
the security agent at the client device including a web rewrite module to automatically inject at the client device, in response to receiving, at the client device, the encrypted username and password for the selected target network component from the remote head end, the encrypted username and password into a portal open at the client device to authenticate a user with, and establish a connection with, the selected target network component.
2. The system of claim 1 , wherein the security agent includes a plugin affinity and target testing module configured to monitor availability of the security agent and terminate the tunnel between the client device and the remote head end upon identifying the security agent is unavailable.
3. The system of claim 1 , wherein the security agent, upon injecting the encrypted username and password into the portal, causes a memory of the client device to erase the encrypted username and password from with a memory element of the memory.
4. The system of claim 1 , wherein the web rewrite module monitors one or more specific Transmission Control Protocol (TCP) ports to receive the encrypted username and password from the remote head end.
5. The system of claim 1 , further comprising a shell remote desktop protocol (RDP) manager to receive connection details from the remote head end to establish the connection with the selected target network component.
6. The system of claim 1 , wherein the selected target network component is a cloud-based application or an internal hardware component.
7. A method, comprising:
storing a plurality of usernames and passwords for target network components at one or more vaults of a remote head end; and
developing a device profile based on hardware and software configurations of a client device using an identity defined networking component included in a security agent under control of a processor associated with the client device;
establishing a tunnel between the client device and the remote head end using a virtual private networking component of the security agent at the client device, and transferring from the client device, via the tunnel, an identifier from the client device to the remote head end to be validated at the remote head end and used to retrieve an encrypted username and password at the head end, the encrypted username and password associated with a selected target network component; and
automatically injecting at the client device by a web rewrite module of the security agent at the client device, in response to receiving the encrypted username and password for the selected target network component from the remote head end at the client device, the encrypted username and password into a portal open at the client device to authenticate a user with, and establish a connection with, the selected target network component.
8. The method of claim 7 , wherein the security agent includes a plugin affinity and target testing module configured to monitor availability of the security agent and terminate the tunnel between the client device and the remote head end upon identifying the security agent is unavailable.
9. The method of claim 7 , wherein the security agent, upon injecting the encrypted username and password into the portal, causes a memory of the client device to erase the encrypted username and password from with a memory element of the memory.
10. The method of claim 7 , wherein the web rewrite module monitors one or more specific Transmission Control Protocol (TCP) ports to receive the encrypted username and password from the remote head end.
11. The method of claim 7 , further comprising receiving connection details from the remote head end to establish the connection with the selected target network at a shell remote desktop protocol (RDP) manager.
12. The method of claim 7 , wherein the selected target network component is a cloud-based application or an internal hardware component.
13. A non-transitory computer readable medium, comprising instructions for:
storing a plurality of usernames and passwords for target network components at one or more vaults of a remote head end; and
developing a device profile based on hardware and software configurations of a client device using an identity defined networking component included in a security agent under control of a processor associated with the client device;
establishing a tunnel between the client device and the remote head end using a virtual private networking component of the security agent at the client device, and transferring from the client device, via the tunnel, an identifier from the client device to the remote head end to be validated at the remote head end and used to retrieve an encrypted username and password at the head end, the encrypted username and password associated with a selected target network component; and
automatically injecting at the client device by a web rewrite module of the security agent at the client device, in response to receiving the encrypted username and password for the selected target network component from the remote head end at the client device, the encrypted username and password into a portal open at the client device to authenticate a user with, and establish a connection with, the selected target network component.
14. The non-transitory computer readable medium of claim 13 , wherein the security agent includes a plugin affinity and target testing module configured to monitor availability of the security agent and terminate the tunnel between the client device and the remote head end upon identifying the security agent is unavailable.
15. The non-transitory computer readable medium of claim 13 , wherein the security agent, upon injecting the encrypted username and password into the portal, causes a memory of the client device to erase the encrypted username and password from with a memory element of the memory.
16. The non-transitory computer readable medium of claim 13 , wherein the web rewrite module monitors one or more specific Transmission Control Protocol (TCP) ports to receive the encrypted username and password from the remote head end.
17. The non-transitory computer readable medium of claim 13 , further comprising a shell remote desktop protocol (RDP) manager to receive connection details from the remote head end to establish the connection with the selected target network component.
18. The non-transitory computer readable medium of claim 13 , wherein the selected target network component is a cloud-based application or an internal hardware component.