Peer-to-peer secure mode authentication
The present disclosure relates to peer-to-peer (P2P) secure mode authentication. A secondary client device can request access to an enterprise resource. The secondary client device can establish a P2P communication channel with a primary client device during a P2P secure mode. The secondary client device can determine a proximity of the computing device to the client device and generate proximity data based at least in part on the proximity of the computing device to the client device. The secondary client device can receive an authorization to access the enterprise resource based at least in part on the proximity data and access the enterprise resource by loading the enterprise resource within a sandboxed environment.
1 . A system comprising:
at least one computing device comprising a processor and a memory, the at least one computing device being identified as a secondary client device by at least one server; and
machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
request access to an enterprise resource stored in the at least one server;
establish a P2P communication channel between the secondary client device and a primary client device, which is identified by the at least one server as being an active client device nearest to the secondary client device;
determine a first proximity of the at least one computing device to the primary client device based on communication with the primary client device through the P2P communication channel;
generate first proximity data based at least in part on the first proximity of the at least one computing device to the primary client device;
continually provide the first proximity data to the at least one server, enabling the at least one server to determine whether the P2P communication channel is compliant with a predetermined rule based on the first proximity data and second proximity data that is generated by and continually provided from the primary client device based at least in part of a second proximity of the at least one computing device to the primary client device determined by the primary client device;
receive an authorization to access the enterprise resource based at least in part on the proximity data from the at least one server that determined that the P2P communication channel is compliant with the predetermined rule;
upon receiving the authorization to access the enterprise resource, cause a content viewing application that runs in the at least one computing device to generate a containerized sandbox environment and load the enterprise resource within the containerized sandbox environment, thereby enabling a user of the at least one computing device to view and edit the enterprise resource stored in the at least one server within the containerized sandbox environment;
receive a notification that the authorization to access the enterprise resource has been removed from the at least one server that has determined that the P2P communication channel has become non-compliant with the predetermined rule; and
upon receiving the notification, cause the content viewing application to disable the user's ability to view and edit the enterprise resource stored in the at least one server within the containerized sandbox environment while the enterprise resource is still loaded within the containerized sandbox environment.
2 . The system of claim 1 , wherein the machine-readable instructions further cause the at least one computing device to at least:
receive a request to authenticate with an authentication service from the at least one server; and
provide authentication credentials for the authentication service to the at least one server.
3 . The system of claim 1 , wherein the authorization to access the enterprise resource comprises a command to load the enterprise resource in the containerized sandboxed environment.
4 . The system of claim 1 , wherein the proximity of the at least one computing device to the primary client device is determined based at least in part on at least one of: at least one nearby IEEE 802.11 network, Bluetooth IEEE 802.15 network, Bluetooth Low Energy, near-field communication, or sound detection.
5 . The system of claim 1 , wherein the machine-readable instructions further cause the at least one computing device to at least receive a notification that the primary client device has entered a P2P secure mode, the P2P communication channel being established in response to the primary client device entering the P2P secure mode.
6 . The system of claim 1 , wherein the machine-readable instructions further cause the at least one computing device to at least:
receive a second notification that the authorization to access the enterprise resource has been restored from the at least one server that has determined that the P2P communication channel has once again become compliant with the predetermined rule; and
upon receiving the second notification, cause the content viewing application to enable the user to view and edit the enterprise resource stored in the at least one server within the containerized sandbox environment while the enterprise resource is still loaded within the containerized sandbox environment.
7 . A method, comprising:
requesting access to an enterprise resource stored in at least one server from a secondary client device;
establishing a P2P communication channel between the secondary client device and a primary client device, which is identified by the at least one server as being an active client device nearest to the secondary client device;
determining, by the secondary client device, a first proximity of the computing secondary client device to the primary client device based on communication with the primary client device through the P2P communication channel;
generating, by the secondary client device, first proximity data based at least in part on the first proximity of the computing secondary client device to the primary client device;
continually providing, from the secondary client device, the first proximity data to the at least one server;
determining, by the primary client device, a second proximity of the secondary client device to the primary client device;
generating, by the primary client device, second proximity data based at least in part on the second proximity of the secondary client device to the primary client device;
continually providing, from the primary client device, the second proximity data to the at least one server;
determining, by the at least one server, whether the P2P communication channel is compliant with a predetermined rule based on the first proximity data and the second proximity data;
receiving an authorization to access the enterprise resource based at least in part on the proximity data from the at least one server that determined that the P2P communication channel is compliant with the predetermined rule;
upon receiving the authorization to access the enterprise resource, causing a content viewing application that runs in the at least one computing device to generate a containerized sandbox environment and loading the enterprise resource within the containerized sandbox environment, thereby enabling a user of the at least one computing device to view and edit the enterprise resource stored in the at least one server within the containerized sandbox environment;
receiving a notification that the authorization to access the enterprise resource has been removed from the at least one server that has determined that the P2P communication channel has become non-compliant with the predetermined rule; and
upon receiving the notification, causing the content viewing application to disable the user's ability to view and edit the enterprise resource stored in the at least one server within the containerized sandbox environment while the enterprise resource is still loaded within the containerized sandbox environment.
8 . The method of claim 7 , further comprising:
receiving a request to authenticate with an authentication service from the at least one server; and
providing authentication credentials for the authentication service to the at least one server.
9 . The method of claim 7 , wherein the authorization to access the enterprise resource comprises a command to load the enterprise resource in the containerized sandboxed environment.
10 . The method of claim 7 , wherein the proximity of the computing secondary client device to the primary client device is determined based at least in part on at least one of: at least one nearby IEEE 802.11 network, Bluetooth IEEE 802.15 network, Bluetooth Low Energy, near-field communication, or sound detection.
11 . The method of claim 7 , further comprising receiving a notification that the primary client device has entered a P2P secure mode, the P2P communication channel being established in response to the primary client device entering the P2P secure mode.
12 . The method of claim 7 , further comprising:
receiving a second notification that the authorization to access the enterprise resource has been restored from the at least one server that has determined that the P2P communication channel has once again become compliant with the predetermined rule; and
upon receiving the second notification, causing the content viewing application to enable the user to view and edit the enterprise resource stored in the at least one server within the containerized sandbox environment while the enterprise resource is still loaded within the containerized sandbox environment.
13 . A non-transitory computer-readable medium embodying program instructions that, when executed, cause a computing device that is identified as a secondary client device by at least one server to at least:
request access to an enterprise resource stored in the at least one server;
establish a P2P communication channel between the secondary client device and a primary client device, which is identified by the at least one server as being an active client device nearest to the secondary client device;
determine a first proximity of the computing device to the client device based on communication with the primary client device through the P2P communication channel;
generate first proximity data based at least in part on the first proximity of the computing device to the primary client device;
continually provide the first proximity data to the at least one server, enabling the at least one server to determine whether the P2P communication channel is compliant with a predetermined rule based on the first proximity data and second proximity data that is generated by and continually provided from the primary client device based at least in part of a second proximity of the at least one computing device to the primary client device determined by the primary client device;
receive an authorization to access the enterprise resource based at least in part on the proximity data from the at least one server that determined that the P2P communication channel is compliant with the predetermined rule;
upon receiving the authorization to access the enterprise resource, cause a content viewing application that runs in the at least one computing device to generate a containerized sandbox environment and load the enterprise resource within the containerized sandbox environment, thereby enabling a user of the at least one computing device to view and edit the enterprise resource stored in the at least one server within the containerized sandbox environment;
receive a notification that the authorization to access the enterprise resource has been removed from the at least one server that has determined that the P2P communication channel has become non-compliant with the predetermined rule; and
upon receiving the notification, cause the content viewing application to disable the user's ability to view and edit the enterprise resource stored in the at least one server within the containerized sandbox environment while the enterprise resource is still loaded within the containerized sandbox environment.
14 . The non-transitory computer-readable medium of claim 13 , wherein the machine-readable instructions further cause the computing device to at least:
receive a request to authenticate with an authentication service from the at least one server; and
provide authentication credentials for the authentication service to the at least one server.
15 . The non-transitory computer-readable medium of claim 13 , wherein the proximity of the computing device to the primary client device is determined based at least in part on at least one of: at least one nearby IEEE 802.11 network, Bluetooth IEEE 802.15 network, Bluetooth Low Energy, near-field communication, or sound detection.
16 . The non-transitory computer-readable medium of claim 13 , wherein the machine-readable instructions further cause the computing device to at least receive a notification that the primary client device has entered a P2P secure mode, the P2P communication channel being established in response to the primary client device entering the P2P secure mode.
17 . The non-transitory computer-readable medium of claim 13 , wherein the machine-readable instructions further cause the computing device to at least:
receive a second notification that the authorization to access the enterprise resource has been restored from the at least one server that has determined that the P2P communication channel has once again become compliant with the predetermined rule; and
upon receiving the second notification, cause the content viewing application to enable the user to view and edit the enterprise resource stored in the at least one server within the containerized sandbox environment while the enterprise resource is still loaded within the containerized sandbox environment.