Application Window Blanking for Unattended Device Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions are inadequate in hybrid work environments, where devices are used in varying security levels, leading to risks of information exposure and unauthorized access due to long screen saver timeouts and lack of control over personal devices.
Innovation Solution
Implementing a device access control system that dynamically blanks or removes content from application windows based on a timeout threshold and requires user re-authentication, with optional process memory dump prevention and process stopping, tailored by application-specific policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If screen saver timeout is extended to maintain user convenience, then ease of operation is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The system dynamically adjusts the timeout threshold based on application protection policies. Different applications can have different timeout values, and the timeout behavior can change based on the security sensitivity of the content being accessed. This allows the system to be more convenient for low-security applications while maintaining strong security for high-security applications.
Solution Approach 2:
The patent applies different timeout and security policies to different applications and content types. Each application can have its own protection policy with customized timeout thresholds, allowing sensitive applications to have shorter timeouts while non-sensitive applications maintain longer timeouts for user convenience.
2Reliability
If content is removed from application window to prevent unauthorized access, then security is improved, but user productivity deteriorates
Solution Approach 1:
The system periodically monitors user input activity and resets the timeout threshold based on detected interactions. When user input is detected, the system resets the timeout counter, preventing content removal during active use. This periodic monitoring ensures content is only removed during genuine unattended periods, maintaining both security and productivity.
Solution Approach 2:
The system uses feedback from user input detection to dynamically control content visibility. The timeout threshold is adjusted based on whether user input is detected, creating a feedback loop that prevents premature content removal while maintaining security during unattended periods.
3Reliability
If process memory dump is disabled to protect sensitive information, then security is improved, but ease of repair deteriorates
Solution Approach 1:
The patent applies memory dump restrictions selectively based on application protection policies. Only applications marked as sensitive or protected have their memory dump functionality disabled, while non-sensitive applications maintain full debugging and repair capabilities. This localized approach ensures security for critical applications without impacting the ease of repair for standard applications.
Data Source
AI summary
Device access control can be implemented on a protected device to determine, based on a user input to the device, that a timeout threshold has been exceeded and to cause, in response to determining that the timeout threshold has been exceeded, an application graphical user interface (GUI) on the device to remove or blank content, such as text, images, or graphics, from the application window. The removal or blanking of the content can be performed on a window-by-window basis; that is, content is removed only from application windows of applications that are protected by an associated application protection policy. In some examples, the application protection policy can be established by an administrator of a digital workspace within which the protected application executes. Such a digital workspace can be implemented via a type of virtual processing environment that can be accessed via client computing devices.