Centralized Access Management Server for Heterogeneous Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity systems face challenges in managing user permissions across heterogeneous applications and terminating authenticated sessions without exposing access credentials, leading to potential security breaches and complex permission management.
Innovation Solution
A centralized access management system that relays application-layer messages between client web browsers and destination servers, using a server at a first domain to terminate authenticated access by modifying access tokens stored in the client web browser memory, while circumventing same-origin policies and maintaining a secure, tamper-evident, immutable data repository for logging access requests and permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a centralized access management system relays messages between client web browsers and destination servers to manage user permissions, then permission management across heterogeneous applications is simplified and security is enhanced, but the system complexity increases due to the need to circumvent same-origin policies and manage access tokens across multiple domains
Solution Approach 1:
The patent introduces a centralized access management server as an intermediary between client web browsers and destination servers. This server relays application-layer messages, manages access tokens centrally, and circumvents same-origin policies by acting as a trusted mediator that can access and modify browser memory across different domains. The intermediary handles permission management operations without requiring direct client-server communication for each operation, thereby simplifying the user interface and control logic while centralizing the complexity in the server infrastructure.
2Reliability
If the system terminates authenticated access by modifying access tokens stored in client web browser memory, then session termination security is improved and unauthorized access is prevented, but the reliability of the same-origin policy is compromised
Solution Approach 1:
The centralized access management server acts as an intermediary that gains controlled access to client web browser memory to modify access tokens. By positioning itself as a trusted mediator between the client and destination servers, it can terminate sessions by deleting or modifying tokens in browser memory without requiring direct compromise of the same-origin policy implementation in the browser. The intermediary's authority is established through the initial message relaying setup, allowing it to override domain restrictions for security-critical operations.
Solution Approach 2:
The system performs preliminary actions to establish the intermediary's authority and capabilities before session termination is needed. During the initial authentication and message relaying phase, the centralized server establishes trusted communication channels and gains the ability to access browser memory. This preliminary setup enables secure token modification later without requiring real-time negotiation or compromising the same-origin policy under attack conditions.
3Productivity
If access tokens are obtained and stored in client web browser memory for authenticated access to destination servers, then authentication efficiency is improved, but security risks increase due to potential exposure of credentials
Solution Approach 1:
The centralized access management server serves as an intermediary that manages access tokens centrally rather than storing them permanently in client browser memory. The server can issue, revoke, and modify tokens as needed, reducing the window of exposure. Tokens are obtained efficiently for authenticated access, but their lifecycle is controlled by the intermediary, which can invalidate them remotely without requiring client-side security measures or user actions.
Solution Approach 2:
The system dynamically changes the state and validity parameters of access tokens based on security requirements. Tokens can be modified in terms of their expiration times, scopes, and validity conditions by the centralized server. This parameter control allows efficient authentication during valid periods while maintaining the ability to revoke or alter token properties to respond to security threats, thereby balancing productivity and security.
Data Source
AI summary
Provided is a process including: processing, with a permission-management application requests to manage permissions of one or more users to access resources with client computing devices, wherein: the permission-management application is configured to manage permissions for users of an organization to access a plurality of network-accessible applications; the plurality of different network-accessible applications have different permission-management application program interfaces; and the permission-management application is configured to manage permissions for users to access respective instances of a plurality of different native applications executing on the client computing devices.