Virtual Authenticator for Remote Endpoint Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing use of remote end user devices and SaaS/IaaS reduces organizational control over endpoint devices, particularly in terms of context-based access control, and limits the ability to apply network-based access control and respond to malicious activity.
Innovation Solution
Implementing a virtual authenticator within the endpoint device to manage authentication and policy enforcement, allowing it to detect linkup events, request and enforce authorization results, and integrate with a VPN and DNS security measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If standard 802.1x-based access control using network device authenticators is used, then authentication is provided for devices within the network, but remote endpoint devices outside the corporate network cannot be authenticated or have policy enforcement applied
Solution Approach 1:
A virtual authenticator component is introduced as an intermediary within the endpoint device itself, mediating between the supplicant (authentication client) and remote authentication servers. This virtual authenticator enables authentication functionality to be embedded directly in endpoint devices, allowing them to authenticate themselves when connecting to corporate networks without requiring traditional network-based authenticators.
Solution Approach 2:
The authentication architecture transitions from a network-centric model (where authenticators are network devices) to a device-centric model (where authenticators are software components within endpoint devices). This dimensional shift allows authentication capabilities to follow the endpoint device wherever it connects, enabling remote authentication and policy enforcement.
2Ease of operation
If endpoint devices are allowed remote access outside corporate networks, then accessibility and flexibility are improved, but control over context-based access control and response to malicious activity is reduced
Solution Approach 1:
The virtual authenticator implements continuous feedback mechanisms by monitoring authentication states, policy compliance, and security events. It receives authentication results from remote servers and enforces policies in real-time, providing ongoing feedback loops that maintain security control even when devices operate remotely outside the corporate network perimeter.
Solution Approach 2:
Authentication and policy enforcement actions are taken preliminarily before full network access is granted. The virtual authenticator pre-evaluates device credentials, security posture, and policy compliance before allowing connectivity, ensuring that security controls are established in advance rather than reactively.
3Adaptability or versatility
If virtual authenticator and supplicant are implemented in the endpoint device, then authentication and policy enforcement are extended to remote devices, but device software complexity increases
Solution Approach 1:
The virtual authenticator is designed as a universal component that performs multiple functions: it acts as an authentication client communicating with remote servers, as an authentication server for local supplicants, and as a policy enforcement point. This multi-functionality reduces the need for separate components and simplifies the overall software architecture despite the added capabilities.
Data Source
AI summary
In one embodiment, a method includes detecting, at a virtual authenticator in an endpoint device, a linkup event, transmitting, to a supplicant in the endpoint device, a request for an identity associated with the endpoint device, receiving, at the virtual authenticator, a response from the supplicant, wherein the response comprises the identity, receiving, from an authentication server, an authorization result, wherein the authorization result is based on authenticating the endpoint device using the received identity, and enforcing, by the virtual authenticator, the authorization result at the endpoint device.