Monitoring security of a client device to provide continuous conditional server access
An identity broker receives a request for access by a client device to a service provided by a server. In response to the request, the identity broker determines an identity of the client device using a client certificate. The identity broker also determines whether the client device is in a secure state. If the client device is secure, the identity broker sends an authentication request to an identity provider. After the identity provider authenticates the client device, the identity broker passes the authentication to the server, which establishes a session with the client device to provide the service.
1. A method comprising:
receiving, by an identity broker, a request regarding access by a client device to a service provided by a service provider;
in response to receiving the request, determining, by the identity broker, an identity of the client device, and continuously monitoring, by the identity broker, in real time whether the client device is in a secure state;
transmitting a challenge to the client device to provide a client certificate, wherein determining the identity of the client device comprises identifying the client device using the client certificate;
in response to determining that the client device is in the secure state, sending, by the identity broker, an authentication request for the client device to an identity provider, the authentication request including the identity of the client device;
receiving, by the identity broker from the identity provider in response to the authentication request, an authentication that authorizes the access by the client device; and
in response to receiving the authentication from the identity provider, sending, by the identity broker, a communication to the service provider that approves the access by the client device.
2. The method of claim 1 , further comprising:
receiving an indication that the client device is not able to provide the client certificate; and
in response to receiving the indication that the client device is not able to provide the client certificate, initiating a procedure for the client device to obtain the client certificate.
3. The method of claim 1 , wherein:
the client certificate is a digital certificate of the client device, and the digital certificate includes a name of the client device and a public encryption key; and
determining the identity of the client device further comprises confirming validity of the digital certificate.
4. The method of claim 3 , further comprising, in response to confirming validity of the digital certificate, generating a session key for use in a secure connection used by the client device to access the service.
5. The method of claim 1 , wherein the continuously monitoring comprises determining whether the client device is in compliance with a policy.
6. The method of claim 5 , wherein the policy is a first policy, the method further comprising:
maintaining, by the identity broker, a data repository of policies associated with an administrator server that provides mobile device management for the client device;
receiving, by the identity broker from the administrator server, an update to the first policy; and
determining, by the identity broker, whether the client device is in compliance with the update to the first policy.
7. The method of claim 1 , wherein the continuously monitoring comprises determining a context in which the client device is operating.
8. The method of claim 1 , further comprising:
after the client device has been granted access to the service, monitoring the client device;
determining, based on the monitoring, that the client device has become insecure; and
in response to determining that the client device has become insecure, requesting that a remediation action associated with the client device be performed.
9. The method of claim 8 , wherein determining that the client device has become insecure comprises determining that the client device is not in compliance with a policy that has been updated after the client device has been granted access to the server, or determining that a context in which the client device is operating is no longer secure.
10. The method of claim 1 , further comprising:
after the client device has been granted access to the service, monitoring a risk level of the client device;
determining whether the risk level exceeds a predetermined threshold; and
in response to determining that the risk level exceeds the predetermined threshold, sending a revocation of access to at least one of the service provider or the identity provider.
11. The method of claim 10 , further comprising, in response to determining that the risk level exceeds the predetermined threshold, performing at least one of closing an open session of the client device with the service, or revoking at least one token of the client device that indicates a safe configuration of the client device.
12. The method of claim 10 , wherein the client device is a first client device, and the service provider is an enterprise server that enforces policy for a plurality of client devices including the first client device, the method further comprising:
receiving, by the identity broker from the enterprise server, a communication that updates the threshold; and
determining whether the monitored risk level exceeds the updated threshold.
13. The method of claim 1 , wherein the continuously monitoring comprises determining whether a software component is installed on the client device, the method further comprising:
in response to determining that the software component is not installed on the client device, causing a communication to the client device that requests installation of the software component, or causes automatic installation of the software component on the client device;
wherein the continuously monitoring further comprises determining that the software component has been installed on the client device.
14. The method of claim 13 , wherein the software component generates or obtains data regarding a risk configuration of the client device, and wherein a user action in a user interface of the client device causes the software component to send an access request to the service provider to obtain access to the service.
15. The method of claim 14 , wherein the software component further sends the access request to the identity broker, wherein the request received by the identity broker is the access request, and wherein the continuously monitoring further comprises performing a security evaluation of a configuration of the client device based on data received from the software component.
16. The method of claim 1 , wherein the request regarding access by the client device to the service is received by the identity broker from at least one of the service provider or the client device, the method further comprising receiving, by the identity broker, aggregated information used in a security evaluation by the identity broker to determine whether the client device is in the secure state, wherein:
the aggregated information comprises user authentication information and source information; and
the source information includes information about at least one of:
a state of an initiating or originating computing device associated with the request regarding access to the service;
an attribute or identity of an application associated with the request regarding access to the service; or
information from an intermediate application or computing device associated with the request regarding access to the service.
17. The method of claim 1 , wherein the service provider is configured to solely use the identity broker for authentication of the client device as regards access to the service.
18. A system comprising:
at least one processor; and
memory storing instructions configured to instruct the at least one processor to:
receive a request regarding access by a client device to a service;
in response to receiving the request, determine an identity of the client device, and continuously monitor, by an identity broker, in real time whether the client device is in a secure state;
transmit a challenge to the client device to provide a client certificate, wherein determining the identity of the client device comprises identifying the client device using the client certificate;
in response to determining that the client device is in the secure state, send an authentication request for the client device to an identity provider;
receive, from the identity provider in response to the authentication request, an authentication that authorizes the access by the client device; and
in response to receiving the authentication from the identity provider, send a communication that approves the access by the client device.
19. A non-transitory computer-readable storage medium storing computer-readable instructions, which when executed, cause a computing device at least to:
receive, by an identity broker, a request regarding access by a client device to a service;
in response to receiving the request, determine, by the identity broker, an identity of the client device, and continuously monitor, by the identity broker, in real time whether the client device is in a secure state;
transmit a challenge to the client device to provide a client certificate, wherein determining the identity of the client device comprises identifying the client device using the client certificate;
in response to determining that the client device is in the secure state, send, by the identity broker, an authentication request for the client device to an identity provider, the authentication request including the identity of the client device;
receive, by the identity broker from the identity provider in response to the authentication request, an authentication that authorizes the access by the client device; and
in response to receiving the authentication from the identity provider, send, by the identity broker, a communication that approves the access by the client device.