Authenticating to a hybrid cloud using intranet connectivity as silent authentication factor
A technique for performing authentication to a hybrid-cloud service includes selectively applying varying authentication requirements based on whether a client device can be confirmed to be connected to a private intranet. The technique includes operating a set of local agents on one or more computing machines on the intranet. When a client device requests access to the hybrid-cloud service, the client device attempts to contact one or more of the local agents. If the client device succeeds in contacting a local agent, then the client device is confirmed to be connected to the private intranet and receives relatively trusting treatment during authentication. However, if the client device fails to contact at least one local agent, the client device is not confirmed to be connected to the private intranet and receives relatively less trusting treatment.
1. A method of authenticating users to a hybrid-cloud service, the method comprising:
operating a set of local agents on respective computing machines connected to a private intranet, the private intranet connected to a public network via a gateway, the gateway configured to block incoming connection requests arriving over the public network and directed to any of the set of local agents; and
in response to (i) receipt from a first client device of a first resource request for accessing a cloud resource of the hybrid-cloud service, the cloud resource disposed outside the private intranet, and (ii) a reachable agent of the set of agents then receiving an incoming connection request from the first client device,
transmitting a silent authentication factor to the first client device, the silent authentication factor providing an indication that that first client device is connected to the private intranet,
receiving a first authentication request from the first client device, the first authentication request specifying a first set of authentication factors which includes the silent authentication factor, and
performing a first authentication operation on the first authentication request,
wherein the method further comprises, in response to (i) receipt from a second client device of a second resource request for accessing the cloud resource and (ii) no agent of the set of agents then receiving any incoming connection request from the second client device, (a) receiving a second authentication request from the second client device, the second authentication request specifying a second set of authentication factors, the second set of authentication factors including no silent authentication factor that indicates that the second client device is connected to the private intranet, and (b) performing a second authentication operation on the second authentication request using the second set of authentication factors.
2. The method of claim 1 , further comprising blocking, by the gateway, an inbound connection request issued by the second client device, the inbound connection request from the second client device directed to a target agent of the set of local agents and arriving at the gateway over the public network, the target agent not receiving the inbound connection request issued by the second client device.
3. The method of claim 1 , further comprising generating the silent authentication factor by a cloud-based server, wherein transmitting the silent authentication factor to the first client device includes sending the silent authentication factor over the public network.
4. The method of claim 3 , wherein generating the silent authentication factor includes creating a one-time-token (OTT), the OTT expiring after being used in a single authentication request.
5. The method of claim 3 , wherein the second set of authentication factors includes an additional authentication factor that is not one of the first set of authentication factors.
6. The method of claim 5 , wherein the additional authentication factor requires a user of the second client device to perform a manual operation that is not required of a user of the first client device when providing the first authentication request.
7. The method of claim 3 , further comprising:
registering each of the set of local agents with the cloud-based server, the cloud-based server storing network addresses for each of the set of local agents; and
in response to receiving a discovery request from the first client device, providing an agent list of the set of local agents and their respective network addresses to the first client device.
8. The method of claim 7 wherein, when receiving the inbound connection request by the reachable agent, the inbound connection request is directed to one of the network addresses on the agent list.
9. The method of claim 7 , further comprising, in response to receiving a discovery request from the second client device, providing the agent list to the second client device.
10. The method of claim 1 , further comprising requiring users of computing devices that are not connected to the private intranet to enter a greater number of authentication factors for accessing the cloud-based resource than users of computing devices that are connected to the private intranet.
11. An electronic system configured to operate as part of a hybrid-cloud service and comprising control circuitry that includes a set of processors coupled to memory, the control circuitry constructed and arranged to:
operate a set of local agents on respective computing machines connected to a private intranet, the private intranet connected to a public network via a gateway, the gateway configured to block incoming connection requests arriving over the public network and directed to any of the set of local agents; and
in response to (i) receipt from a first client device of a first resource request for accessing a cloud resource of the hybrid-cloud service, the cloud resource disposed outside the private intranet, and (ii) a reachable agent of the set of agents then receiving an incoming connection request from the first client device,
transmit a silent authentication factor to the first client device, the silent authentication factor providing an indication that that first client device is connected to the private intranet,
receive a first authentication request from the first client device, the first authentication request specifying a first set of authentication factors which includes the silent authentication factor, and
perform a first authentication operation on the first authentication request,
wherein the control circuitry is further constructed and arranged to, in response to (i) receipt from a second client device of a second resource request for accessing the cloud resource and (ii) no agent of the set of agents then receiving any incoming connection request from the second client device, (a) receive a second authentication request from the second client device, the second authentication request specifying a second set of authentication factors, the second set of authentication factors including no silent authentication factor that indicates that the second client device is connected to the private intranet, and (b) perform a second authentication operation on the second authentication request using the second set of authentication factors.
12. A computer program product including a set of non-transitory, computer-readable media having instructions which, when executed by control circuitry of an electronic system, cause the electronic system to perform a method of authenticating users to a hybrid-cloud service, the method comprising:
operating a set of local agents on respective computing machines connected to a private intranet, the private intranet connected to a public network via a gateway, the gateway configured to block incoming connection requests arriving over the public network and directed to any of the set of local agents; and
in response to (i) receipt from a first client device of a first resource request for accessing a cloud resource of the hybrid-cloud service, the cloud resource disposed outside the private intranet, and (ii) a reachable agent of the set of agents then receiving an incoming connection request from the first client device,
transmitting a silent authentication factor to the first client device, the silent authentication factor providing an indication that that first client device is connected to the private intranet,
receiving a first authentication request from the first client device, the first authentication request specifying a first set of authentication factors which includes the silent authentication factor, and
performing a first authentication operation on the first authentication request,
wherein the method further comprises, in response to (i) receipt from a second client device of a second resource request for accessing the cloud resource and (ii) no agent of the set of agents then receiving any incoming connection request from the second client device, (a) receiving a second authentication request from the second client device, the second authentication request specifying a second set of authentication factors, the second set of authentication factors including no silent authentication factor that indicates that the second client device is connected to the private intranet, and (b) performing a second authentication operation on the second authentication request using the second set of authentication factors.
13. The computer program product of claim 12 , wherein the method further comprises generating the silent authentication factor by a cloud-based server, wherein transmitting the silent authentication factor to the first client device includes sending the silent authentication factor over the public network.
14. The computer program product of claim 13 , wherein generating the silent authentication factor includes creating a one-time-token (OTT), the OTT expiring after being used in a single authentication request.
15. The computer program product of claim 13 , wherein the second set of authentication factors includes an additional authentication factor that is not one of the first set of authentication factors.
16. The computer program product of claim 15 , wherein the additional authentication factor requires a user of the second client device to perform a manual operation that is not required of a user of the first client device when providing the first authentication request.
17. The computer program product of claim 13 , wherein the method further comprises:
registering each of the set of local agents with the cloud-based server, the cloud-based server storing network addresses for each of the set of local agents; and
in response to receiving a discovery request from the first client device, providing an agent list of the set of local agents and their respective network addresses to the first client device.
18. The computer program product of claim 17 wherein, when receiving the inbound connection request by the reachable agent, the inbound connection request is directed to one of the network addresses on the agent list.
19. The computer program product of claim 17 , wherein the method further comprises, in response to receiving a discovery request from the second client device, providing the agent list to the second client device.