Network access using hardware-based security
An endpoint device uses hardware-based security to authenticate to an enterprise network. For example, an endpoint device such as network hardware or an end user device can request authentication in order to join an enterprise network that is managed by a computing platform such as a threat management facility. In one aspect, an authenticator at the computing platform sends a challenge payload in response to the request from the endpoint device. The endpoint device may then sign the challenge payload with a hardware-based security system that was bound to the endpoint device at manufacture, and return a response to the authenticator that includes the signed challenge payload. The authenticator can cryptographically validate the response and generate an authentication token for use by the endpoint device when joining the enterprise network.
1 . A method for operating a computing platform to authenticate an endpoint device at the computing platform, the method comprising:
receiving a request from the endpoint device for authentication at the computing platform, wherein the endpoint device is a network device for an enterprise network managed by the computing platform and the computing platform is a threat management facility;
generating a data packet;
signing the data packet with a key, thereby providing a first digital signature;
sending a challenge payload to a hardware-based security system on the endpoint device, the challenge payload including the data packet and the first digital signature;
receiving a response to the challenge payload from the endpoint device, the response including an endpoint device certificate, the challenge payload, and a second digital signature for the challenge payload from the endpoint device;
validating the response to the challenge payload by:
validating a certificate chain for the endpoint device certificate,
validating the second digital signature for the challenge payload, and
validating an expiry of the data packet in the challenge payload;
in response to validating the challenge payload, sending an authentication token to the endpoint device for access to security services of the computing platform for the enterprise network;
in response to an unsuccessful validation of the response to the challenge payload, generating a security alert to address a failed authentication; and
in response to an expiration of the authentication token, reauthenticating the endpoint device without a refresh token by transmitting a second challenge payload to the hardware-based security system on the endpoint device.
2 . The method of claim 1 wherein validating the second digital signature for the challenge payload includes validating the second digital signature with a public key associated with the endpoint device certificate.
3 . The method of claim 1 , further comprising sending an alert to the endpoint device in response to a first failure to validate the certificate chain or a second failure to validate the second digital signature.
4 . The method of claim 1 , wherein the method further includes receiving a reauthentication request at the computing platform when the authentication token has expired.
5 . The method of claim 1 , wherein the computing platform includes a cloud computing platform.
6 . The method of claim 1 wherein validating the response to the challenge payload includes validating a second expiry of one or more digital signatures in the certificate chain for the endpoint device certificate.
7 . The method of claim 1 , wherein the authentication token allows access to a partial list of at least one of services, network locations, and resources.
8 . A method for operating an endpoint device to authenticate the endpoint device at a computing platform, the method comprising:
sending a request for authentication to the computing platform, wherein the computing platform is a threat management facility;
receiving a challenge payload from the computing platform;
fetching an endpoint device certificate from a hardware-based security system on the endpoint device, wherein the endpoint device is a network device for an enterprise network managed by the computing platform;
signing the challenge payload with a digital signature from the hardware-based security system;
sending a challenge response to the computing platform based on the challenge payload, the challenge response including the endpoint device certificate, the challenge payload, and the digital signature;
receiving an authentication token for access to security services of the computing platform for the enterprise network from the computing platform in response to the challenge response;
authenticating the endpoint device at the computing platform with the authentication token;
in response to an expiration of the authentication token, reauthenticating the endpoint device without a refresh token by transmitting a second challenge payload to the hardware-based security system on the endpoint device; and
accessing services of the computing platform from the endpoint device with the authentication token.
9 . The method of claim 8 , wherein the challenge payload includes a random data segment and an expiration date.
10 . The method of claim 9 , wherein the challenge payload includes a second digital signature for the random data segment from the computing platform.
11 . The method of claim 10 , further comprising validating the computing platform at the endpoint device with the second digital signature and the random data segment.
12 . The method of claim 8 , wherein sending the request for authentication includes sending a reauthentication request in response to an expiration of a prior authentication token.
13 . The method of claim 8 , wherein sending the request for authentication includes sending the request for authentication in response to a boot up of the endpoint device.
14 . The method of claim 8 , wherein the authentication token has a valid time of an hour or less.
15 . The method of claim 8 , further comprising sending a second request to the computing platform in response to an expiration of the authentication token.
16 . The method of claim 8 , wherein the hardware-based security system includes a trusted platform module, the method further comprising installing the trusted platform module and the endpoint device certificate in a trusted platform module chip during manufacturing of the endpoint device.
17 . The method of claim 8 , wherein the endpoint device includes security hardware for the enterprise network.
18 . The method of claim 8 , wherein the endpoint device includes at least one of a gateway, a firewall, a wireless access point, and a switch.
19 . A system comprising:
an endpoint device connected to an enterprise network, wherein the endpoint device is a network device for the enterprise network; and
a computing platform including an authenticator embodied in computer executable code stored in a non-transitory computer readable medium for managing access by the endpoint device to the computing platform, wherein the computing platform is a threat management facility, and wherein the authenticator is configured:
to receive a request from the endpoint device for authentication at the computing platform,
to generate a random data segment,
to send the random data segment to the endpoint device,
to receive a response data packet from the endpoint device,
to determine a validity of the response data packet with one or more cryptographic validation tests of the response data packet,
to send an authentication token to the endpoint device for access to security services of the computing platform for the enterprise network if the response data packet passes the one or more cryptographic validation tests, and
in response to an expiration of the authentication token, to reauthenticate the endpoint device without a refresh token by transmitting a second challenge payload to a hardware-based security system on the endpoint device.
20 . The system of claim 19 , wherein the authenticator is configured to allow access to a partial list of at least one of services, network locations, and resources based on the authentication token.