Personalized secure communication session management
The techniques herein are directed generally to personalized secure communication session management, such as for virtual private networks (VPNs). In one embodiment, a user is authenticated at a client device to verify that the user is present at the client device and authorized to access one or more secured resources, and in response, a secure communication session is established for the client device to access the secured resources. At a later time during the secure communication session, it is determined whether the user is still authenticated at the client device, such that if so, access to the one or more secured resources is maintained on the secure communication session, or else access is restricted to the one or more secured resources (e.g., the session is terminated, or access is otherwise limited).
1. A method, comprising:
authenticating, by a process, a user at a client device, the authenticating verifying that the user is both present at the client device and authorized to access one or more secured resources;
establishing, by the process in response to authenticating the user, a secure communication session for the client device to access the one or more secured resources;
confirming, by the process, at a later time during the secure communication session, whether the user is still authenticated at the client device;
maintaining, by the process, the access to the one or more secured resources on the secure communication session at the later time in response to the user still being authenticated at the client device at the later time;
restricting, by the process, the access to the one or more secured resources on the secure communication session at the later time in response to the user no longer being authenticated at the client device at the later time;
detecting, by the process, an additional person at the client device during the secure communication session;
determining, by the process, whether the additional person is authorized to access the one or more secured resources;
maintaining, by the process, the access to the one or more secured resources on the secure communication session in response to the additional person being authorized to access the one or more secured resources; and
restricting, by the process, the access to the one or more secured resources on the secure communication session in response to the additional person not being authorized to access the one or more secured resources.
2. The method as in claim 1 , wherein the secure communication session comprises a virtual private network (VPN) session.
3. The method as in claim 1 , further comprising:
triggering the later time based on one or more of a periodic timer, a random timer, and a continuous operation.
4. The method as in claim 1 , further comprising:
triggering the later time based on one or more security trigger events.
5. The method as in claim 4 , wherein the one or more security trigger events are selected from a group consisting of: a transaction; a specific type of transaction; a particular action; an increase in security access; accessing particular resources; administrator manual triggering; anomalous behavior of the user; and returning from an idle client device state.
6. The method as in claim 1 , wherein additional persons are never authorized to access the one or more secured resources, and wherein restricting the access to the one or more secured resources on the secure communication session occurs in response to the detecting of the additional person.
7. The method as in claim 1 , further comprising:
receiving an indication to expect the additional person during the secure communications session.
8. The method as in claim 1 , wherein detecting the additional person is based on one or more of: facial recognition; body detection; motion detection; video analysis; and audio detection.
9. The method as in claim 1 , further comprising, in response to the additional person not being authorized to access the one or more secured resources:
sharing information on the addition person for security analysis.
10. The method as in claim 1 , wherein verifying that the user is present at the client device is based on biometric attestation selected from a group consisting of: facial recognition; recognition of one or more fingerprints; and eye scans.
11. The method as in claim 1 , wherein authenticating the user at a client device comprises first verifying that the user is authorized to access the one or more secured resources based on a user login, and then verifying that the user is present at the client device based on biometric attestation of the user at the client device.
12. The method as in claim 1 , wherein confirming comprises:
instructing the client device to re-authenticate the user.
13. The method as in claim 1 , wherein the authenticating is local to the client device.
14. The method as in claim 1 , wherein the authenticating comprises a collaboration between the client device and one or more network devices associated with the one or more secured resources.
15. The method as in claim 1 , wherein the authenticating comprises a collaboration between the client device and one or more third-party facilitator devices, and wherein the establishing of the secure communication session is based on approval by the one or more third-party facilitator devices.
16. The method as in claim 15 , wherein network devices associated with the one or more secured resources are aware that the user is both present at the client device and authorized to access one or more secured resources, and are unaware of an identity of the user.
17. The method as in claim 1 , wherein restricting the access to the one or more secured resources comprises:
terminating the secure communication session.
18. The method as in claim 1 , wherein restricting the access to the one or more secured resources comprises:
limiting access to specific items within the secure communication session.
19. A tangible, non-transitory, computer-readable medium storing program instructions that cause a computer to execute a process comprising:
authenticating a user at a client device, the authenticating verifying that the user is both present at the client device and authorized to access one or more secured resources;
establishing, in response to authenticating the user, a secure communication session for the client device to access the one or more secured resources;
confirming, at a later time during the secure communication session, whether the user is still authenticated at the client device;
maintaining the access to the one or more secured resources on the secure communication session at the later time in response to the user still being authenticated at the client device at the later time;
restricting the access to the one or more secured resources on the secure communication session at the later time in response to the user no longer being authenticated at the client device at the later time;
detecting an additional person at the client device during the secure communication session;
determining whether the additional person is authorized to access the one or more secured resources;
maintaining the access to the one or more secured resources on the secure communication session in response to the additional person being authorized to access the one or more secured resources; and
restricting the access to the one or more secured resources on the secure communication session in response to the additional person not being authorized to access the one or more secured resources.
20. An apparatus, comprising:
one or more network interfaces to communicate with a computer network;
a processor coupled to the network interfaces and adapted to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed operable to perform a method comprising:
authenticating a user at a client device, the authenticating verifying that the user is both present at the client device and authorized to access one or more secured resources;
establishing, in response to authenticating the user, a secure communication session for the client device to access the one or more secured resources;
confirming, at a later time during the secure communication session, whether the user is still authenticated at the client device;
maintaining the access to the one or more secured resources on the secure communication session at the later time in response to the user still being authenticated at the client device at the later time;
restricting the access to the one or more secured resources on the secure communication session at the later time in response to the user no longer being authenticated at the client device at the later time;
detecting an additional person at the client device during the secure communication session;
determining whether the additional person is authorized to access the one or more secured resources;
maintaining the access to the one or more secured resources on the secure communication session in response to the additional person being authorized to access the one or more secured resources; and
restricting the access to the one or more secured resources on the secure communication session in response to the additional person not being authorized to access the one or more secured resources.