Access Proxy for Multi-Identity Application Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to securely authenticate applications running on user devices outside an organization's network, preventing them from accessing cloud resources while ensuring access control and security.
Innovation Solution
An access proxy system that identifies user, device, and application identifiers, verifies their combination against access policies, and grants access only if they satisfy the policy, using an authentication module and application provisioning service to ensure secure access to cloud resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods are used for applications on user devices outside the network, then user access to cloud resources is enabled, but security control and application-level authentication are insufficient
Solution Approach 1:
The authentication system segments the identification into three distinct components: user identifier, device identifier, and application identifier. This segmentation allows each component to be independently verified against access policies, enabling fine-grained security control while maintaining ease of operation through automated multi-factor authentication.
Solution Approach 2:
The access proxy acts as an intermediary between user devices and cloud resources. It receives authentication requests, extracts and verifies the triplet identifiers against access policies, and mediates access decisions. This intermediary layer enhances security control without requiring changes to user devices or applications.
2Ease of operation
If access is granted to all applications on a user device, then ease of access is improved, but security and unauthorized access risk increase
Solution Approach 1:
The system applies local quality by granting access permissions specifically to authorized applications on a user device rather than universally to all applications. Each application's identifier is individually verified against access policies, allowing selective authorization that maintains convenience for legitimate apps while blocking unauthorized ones.
3Reliability
If multiple authentication factors are verified, then security is improved, but authentication complexity and processing time increase
Solution Approach 1:
The system performs preliminary action by pre-configuring access policies that define valid combinations of user, device, and application identifiers. During authentication, the access proxy simply checks whether the presented triplet matches pre-approved policies rather than performing complex real-time analysis, reducing processing time while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer system receives, from a user device, a request to access a resource within a network of an organization and receives access credentials associated with an application, a user and the user device. The computer system identifies an application identifier, a user identifier and a device identifier and determines whether the combination of these identifiers satisfies an access policy. If the combination of application identifier, user identifier and device identifier satisfies the access policy, then the computer system grants the application access to the resource within the network of the organization.