Cisco Technology, Inc.

Shayne Miel

Richard Edward Harang

David William Matteson

Josh Matz

Brian Lindauer

Joshua Terry

Vishal Satyendra Desai

Ardalan Alizadeh

Nancy Cam-Winget

Glenn J Stempeck

Laura Kristen Cole

Courtney Irwin

Jen Bammel

Edgar Calderon

Patrick McMahon

Robert Small

Ian Edward Beals

Gillian Gacusan

Joshua Brian Lindauer

Kevin Tyler Burchfield

Jake Ingman

The present technology provides for receiving communications at an authentication service, and the communication is indicative of a change in a security posture of an authenticated session between a user device and a secure service. The authentication service can then determine that the change in the security posture of the authenticated session impacts the trust level associated with the user device and causes the trust level to fall below the threshold. The authentication service can then send an enforcement signal to a security agent on a network device that provides remedial actions that a user can undertake to improve the security posture of the authenticated session.

Mid-session trust assessment

This disclosure describes techniques for using an anchored endpoint to enhance MFA authentication of a client device. A method performed at least in part by a security service includes authenticating of a client device connecting to a secure resource. The method also includes determining a first Wi-Fi fingerprint of the client device, determining that the client device is within a threshold proximity to an anchor device, and determining a second Wi-Fi fingerprint of the anchor device. The method also includes detecting a change to the first Wi-Fi fingerprint of the client device and determining that the second Wi-Fi fingerprint of the anchor device has not changed. The method also includes determining whether the client device is within the threshold proximity of the anchor device, if it is, access to the secured resource continues to be allowed, if it is not, a reauthentication of the client device is triggered.

Anchored Wi-Fi fingerprinting for risk-based authentication

The present technology provides for altering an authentication technique in response to a detection of a possible attack to which the authentication technique is vulnerable. An authentication provider can receive an authentication request to authenticate to a first resource, where the authentication to the first resource is permitted using a particular authentication technique, includes contextual information associated with the first access device and information identifying the first resource. Based on the contextual information, the authentication provider can determine that the authentication request is subject to an ongoing attack, and determine, an alternative authentication technique that is less vulnerable to the ongoing attack than the particular authentication technique. The authentication provider can require the first user account to authenticate with the first resource using the alternative authentication technique that is less vulnerable to the ongoing attack than the particular authentication technique.

Risk-based factor selection

The present disclosure provides protection to communications after establishing a secured connection to a secured website or application. An authentication service, after establishing a secured session, can calculate a trust score for a user. Based on the trust score, the security agent can encrypt access tokens used to authenticate a secure connection. The system can interrupt the secure connection based on the trust score of the user or the user device. The interruption takes place by ignoring requests to decrypt the access token. Without the decrypted access token, the browser is unable to authenticate the session, preventing further communications. After the user improves the security posture of the device or user, the security agent can recalculate the trust score. When the trust score is above a threshold, the security agent can being decrypting the access token, thereby authenticating communications from the browser.

Client-based enforcement for mid-session reauthentication

This disclosure describes techniques and mechanisms for authenticating user device(s) by ensuring that two user devices accessing the same online service are co-located, while protecting private information associated with a user's network landscape and/or Bluetooth device(s). The techniques may ensure that a second factor authentication device is in the same location as a first factor access device, and that a first factor access device is in the same location as it was during previous access attempts).

Privacy preserving zero knowledge proof of device co-location

Growing community of inventors

Durham, NC, United States of America

Shayne Miel