Risk based session resumption
The present disclosure relates to systems and methods for risk-based session resumption. The present disclosure addresses the security gaps in the access control workflow of an organization while significantly enhancing the user experience. Instead of users being inquired to reauthenticate at a periodic interval, the present disclosure provides risk-based session resumption and reauthentication established on a verdict determination based on changes detected in metadata. The present disclosure not only prevents unnecessary prompts for user to authenticate again but also improves the security profile of an organization as users need to reauthenticate only if something has changed, malicious activity is detected, and there is a real risk to access control.
1. A method implemented by a user device, the method comprising steps of:
requesting a resource, by an agent operating on the user device, from a server, the resource is associated with any of an online application and a cloud service;
prompting the user for identity;
receiving user entry input for the identity and metadata, and providing the user entry input and metadata to the server for an authentication request;
receiving and storing a session cookie for the resource, wherein the user device has a session for the resource based on the session cookie;
after authenticating the request, listening for a change in the metadata, wherein the listening occurs continuously via the agent operating in a secure location on the user device;
responsive to the listening detecting a change in the metadata, providing the session cookie and the change in the metadata via the agent to the server; and
receiving a response from the server based on the change in the metadata, and accessing the resource based thereon.
2. The method of claim 1 , wherein the accessing the resource based thereon is based on a verdict issued by the server includes one of
resuming the session,
blocking the session, and
reauthenticating the session.
3. The method of claim 2 , wherein the reauthenticating the session based on the verdict issued by the server and is one of with or without one of multifactor authentication or post authentication.
4. The method of claim 1 , wherein the metadata includes an internet protocol (IP) address, and wherein, when there is a change in the IP address, the response includes accessing the resource via reauthenticating the session.
5. The method of claim 1 , wherein the metadata includes details related to the user device and wherein, when there is a change in the details, the response includes accessing the resource via reauthenticating the session with multifactor authentication.
6. The method of claim 1 , wherein the metadata includes installed applications on the user device, and wherein the steps comprise:
responsive to identifying, via the agent operating on the user device, a change in the installed applications on the user device, providing the session cookie and the change in the installed applications to the server; and
receiving a response from the server based thereon.
7. The method of claim 1 , wherein the metadata includes any of details related to the user device, user provided details, internet protocol (IP) address, network configuration, installed applications, installed certificates, geolocation, and network type.
8. The method of claim 7 , wherein the accessing the resource based thereon includes resuming the session based on minor changes to the metadata.
9. A non-transitory computer-readable medium comprising instructions that, when executed, cause a processor to perform the steps of:
requesting a resource, by an agent operating on a user device, from a server, the resource is associated with any of an online application and a cloud service;
prompting the user for identity;
receiving user entry input for the identity and metadata, and providing the user entry input and metadata to the server for an authentication request;
receiving and storing a session cookie for the resource, wherein the user device has a session for the resource based on the session cookie;
after authenticating the request, listening for a change in the metadata, wherein the listening occurs continuously via the agent operating in a secure location on the user device;
responsive to the listening detecting a change in the metadata, providing the session cookie and the change in the metadata via the agent to the server; and
receiving a response from the server based on the change in the metadata, and accessing the resource based thereon.
10. The non-transitory computer-readable medium of claim 9 , wherein the accessing the resource based thereon includes one of
resuming the session,
blocking the session, and
reauthenticating the session.
11. The non-transitory computer-readable medium of claim 10 , wherein the reauthenticating the session is one of with or without multifactor authentication.
12. The non-transitory computer-readable medium of claim 9 , wherein the metadata includes an internet protocol (IP) address, and wherein, when there is a change in the IP address, the response includes accessing the resource via reauthenticating the session.
13. The non-transitory computer-readable medium of claim 9 , wherein the metadata includes details related to the user device and wherein, when there is a change in the details, the response includes accessing the resource via reauthenticating the session with multifactor authentication.
14. The non-transitory computer-readable medium of claim 9 , wherein the metadata includes installed applications on the user device, and wherein the steps comprise:
responsive to identifying, via the agent operating on the user device, a change in the installed applications on the user device, providing the session cookie and the change in the installed applications to the server; and
receiving a response from the server based thereon.
15. The non-transitory computer-readable medium of claim 9 , wherein the metadata includes any of details related to the user device, internet protocol (IP) address, network configuration, installed applications, installed certificates, geolocation, and network type.
16. The non-transitory computer-readable medium of claim 15 , wherein the accessing the resource based thereon includes resuming the session based on minor changes to the metadata.
17. A user device comprising:
a processing device;
a memory device configured to store a computer program having instructions that, when executed, cause the processing device to perform the steps of:
requesting a resource, by an agent operating on the user device, from a server, the resource is associated with any of an online application and a cloud service;
prompting the user for identity;
receiving user entry input for the identity and metadata, and providing the user entry input and metadata to the server for an authentication request;
receiving and storing a session cookie for the resource, wherein the user device has a session for the resource based on the session cookie;
after authenticating the request, listening for a change in the metadata, wherein the listening occurs continuously via the agent operating in a secure location on the user device;
responsive to the listening detecting a change in the metadata, providing the session cookie and the change in the metadata via the agent to the server; and
receiving a response from the server based on the change in the metadata, and accessing the resource based thereon.
18. The server of claim 17 , wherein the accessing the resource based thereon includes one of
resuming the session,
blocking the session, and
reauthenticating the session.
19. The server of claim 18 , wherein the metadata includes details related to the user device and wherein, when there is a change in the details, the response includes accessing the resource via reauthenticating the session with or without multifactor authentication.
20. The server of claim 17 , wherein the metadata includes an internet protocol (IP) address, and wherein, when there is a change in the IP address, the response includes accessing the resource via reauthenticating the session.