Assertion Proxy for Non-Intrusive SSO Security

The patent introduces an assertion proxy as an intermediary component that sits between the IDP and SP. The proxy receives assertions from the IDP, enforces security policies, and then forwards validated assertions to the SP. This mediator approach allows security enforcement without requiring the CASB to directly modify or access sensitive assertion contents, thereby preserving the trust relationship while maintaining security control capability.

The patent extracts the security policy enforcement functionality from the assertion content itself and implements it as a separate validation layer in the assertion proxy. Instead of modifying assertion contents to enforce security, the system validates security requirements against the assertion metadata and structure without altering the protected assertion data. This extraction approach maintains both security enforcement and SLA compliance.

The patent implements a universal assertion proxy that can handle multiple SaaS applications through a single federated SSO infrastructure. The proxy is designed to work with various assertion formats and security policies across different applications, providing multi-functional security enforcement. This universal approach maintains identity management efficiency while managing policy enforcement complexity through a standardized interface.