Multi-factor authentication
Security is improved by adding a security heartbeat for and endpoint as a factor in a multi-factor authentication system. The security heartbeat may be used directly as an authentication factor, e.g., where the heartbeat provides a reliable and verifiable indication of identity, or the security heartbeat may be used as a gating input for some other verification method, e.g., where a text message with a temporary security code can only be transmitted to a user when the user's endpoint is providing a secure heartbeat.
1. A computer program product comprising a non-transitory computer-readable medium embodying computer-executable code that, when executing on an authentication service accessible through a data network, causes the authentication service to perform steps comprising:
receiving a heartbeat from an endpoint through a data network, wherein the heartbeat indicates compliance of the endpoint with a security policy for an enterprise network associated with the endpoint, and wherein the heartbeat is cryptographically secured by the endpoint to permit verification of a source of the heartbeat with reference to a trusted third party;
receiving a request from the endpoint for an authentication token suitable for authenticating a user of the endpoint to a secure service accessible by the endpoint through the data network;
requesting a verification of the compliance of the endpoint with the security policy by verifying the heartbeat from the endpoint with reference to the trusted third party;
in response to receiving the request from the endpoint, and in response to using the compliance of the endpoint with the security policy as a security factor by verifying the heartbeat with reference to the trusted third party, providing the authentication token requested by the endpoint for authenticating to a remote service by performing steps comprising:
generating the authentication token requested by the endpoint;
generating verification information for use by an access control system in verifying the authentication token;
transmitting the verification information for verifying the authentication token to the access control system for accessing the secure service; and
returning the authentication token to the endpoint, wherein the authentication token is one of a plurality of authentication factors used in authenticating the user of the endpoint to the secure service with a multi-factor authentication system based at least in part on compliance of the endpoint with the security policy; and
in response to receiving the request from the endpoint, and in response to the endpoint not being in compliance with the security policy, not providing the authentication token to the remote service.
2. A method comprising:
receiving a heartbeat from an endpoint that is cryptographically secured, wherein the heartbeat indicates compliance of the endpoint with a security policy of an enterprise network associated with the endpoint;
receiving a request for authentication data for the endpoint;
requesting a verification of the compliance of the endpoint with the security policy by verifying the heartbeat from the endpoint with reference to a trusted third party;
in response to receiving the request from the endpoint, and in response to using the compliance of the endpoint with the security policy as a security factor by verifying the heartbeat with reference to the trusted third party, providing the authentication data requested by the endpoint for authenticating to a remote service by performing steps comprising:
generating the authentication data requested for the endpoint;
generating verification information for use by an access control system in verifying the authentication data;
transmitting the verification information for verifying the authentication data to the access control system; and
transmitting the authentication data to a recipient in response to the request, wherein the authentication data is used in authenticating to a secure service based at least in part on a state of compliance of the endpoint with the security policy; and
in response to receiving the request from the endpoint, and in response to the endpoint not being in compliance with the security policy, withholding authentication data from the recipient.
3. The method of claim 2 wherein content of the heartbeat is encrypted.
4. The method of claim 2 wherein the heartbeat is cryptographically signed.
5. The method of claim 2 wherein the request is received from the endpoint.
6. The method of claim 2 wherein the request is received from a hardware token.
7. The method of claim 2 wherein the request is received from a computing device other than the endpoint.
8. The method of claim 2 wherein compliance of the endpoint with the security policy includes a health status of at least one of a file on the endpoint, and a process executing on the endpoint.
9. The method of claim 2 further comprising digitally signing the authentication data.
10. The method of claim 2 further comprising encrypting the authentication data.
11. The method of claim 2 wherein the recipient includes the endpoint.
12. The method of claim 2 wherein the recipient includes a mobile device.
13. The method of claim 2 further comprising locally comparing the authentication data to an expected response at the recipient.
14. The method of claim 2 wherein transmitting the authentication data includes transmitting at least one of a text message to a mobile device of a user of the endpoint or an electronic mail message to an electronic mail account of the user of the endpoint.
15. The method of claim 2 wherein receiving the request for authentication data includes receiving the request at one or more of a cloud service, a firewall or a gateway.
16. The method of claim 2 , wherein the verification information includes cryptographic information.
17. The computer program product of claim 1 , wherein not providing the authentication token to the remote service includes at least one of generating a defective token or withholding authentication data.
18. A security appliance for providing an authentication token, the security appliance comprising:
a network interface configured to couple the security appliance in a communicating relationship with a data network;
a memory; and
a processor configured by computer code stored in the memory to perform the steps of:
receiving a heartbeat from an endpoint indicating compliance of the endpoint with a security policy for an enterprise network, wherein the heartbeat is cryptographically secured through the network interface,
receiving a request for an authentication token for the endpoint through the network interface,
requesting a verification of the compliance of the endpoint with the security policy by verifying the heartbeat from the endpoint with reference to a trusted third party, and
in response to receiving the request from the endpoint, and in response to using the compliance of the endpoint with the security policy as a security factor by verifying the heartbeat with reference to the trusted third party, providing the authentication token requested by the endpoint for authenticating to a remote service by performing steps comprising:
generating the authentication token requested for the endpoint,
generating verification information for use by an access control system in verifying the authentication token,
transmitting the verification information for verifying the authentication token to the access control system for accessing a secure service, and
transmitting the authentication token to a recipient in response to the request, wherein the authentication token is used in authenticating to a secure service based on the compliance of the endpoint with the security policy.
19. The security appliance of claim 18 , wherein the security appliance is a cloud service for supporting multi-factor authentication based on the heartbeat.
20. The security appliance of claim 18 , wherein the security appliance is a gateway for an enterprise network.