Browser Policy Configuration via Segmented Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing client-server systems face challenges in securely configuring enterprise policy settings across different operating system families, leading to incompatibility issues and potential security risks when pushing policy data to client computing devices.
Innovation Solution
A computer-implemented method for installing browser policy settings on client computing devices, which involves receiving login credentials, transmitting browser policy data signed with a public key, authenticating the data, and automatically installing settings, allowing for secure configuration across arbitrary operating systems, including those from different manufacturers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If enterprise policy settings are pushed to client computing devices, then policy configuration is achieved, but security is compromised because users can copy and distribute policy settings across multiple devices
Solution Approach 1:
The policy settings are segmented into device-specific portions and user-specific portions. The device-specific portion is tied to the particular client device through device identifiers and cryptographic binding, preventing copying to other devices. The user-specific portion can be selectively applied. This segmentation allows the system to maintain security while enabling policy configuration.
Solution Approach 2:
A server acts as an intermediary between the enterprise policy source and client devices. The server authenticates devices, extracts device-specific policy portions, and distributes them through controlled channels. This intermediary layer prevents direct copying of full policy settings while enabling legitimate configuration, thereby maintaining security during the policy deployment process.
2Ease of operation
If enterprise policy settings are pushed to client computing devices, then policy configuration is achieved, but compatibility issues arise when client devices run operating systems from different manufacturers than the enterprise server
Solution Approach 1:
The policy configuration system is designed to be universal across different operating system families. Instead of requiring client devices to run the same operating system family as the enterprise server, the system extracts and applies only the portions of policy settings that are compatible with the client's specific operating system. This universal approach enables policy configuration across diverse hardware and software platforms.
Solution Approach 2:
The system applies local quality by tailoring policy settings to the specific characteristics of each client device's operating system. Rather than using a one-size-fits-all approach that requires OS family matching, the system identifies and applies only those policy portions that are appropriate for the specific OS version and platform, enabling compatibility across different manufacturers' operating systems.
3Reliability
If manual configuration of policy settings is performed on each client device, then security is maintained, but productivity decreases due to time-consuming manual processes
Solution Approach 1:
The system enables self-service by allowing client devices to automatically receive and apply their own device-specific policy portions without requiring manual intervention. The devices present their identifiers, receive authenticated policy data, and apply configurations automatically. This maintains security through authenticated distribution while dramatically improving productivity by eliminating manual configuration processes.
Solution Approach 2:
The enterprise administrator performs preliminary action by pre-configuring the full policy settings on the enterprise server before distribution. The system then automatically extracts device-specific portions and distributes them to appropriate clients. This preliminary configuration combined with automated extraction and distribution maintains security while improving productivity by eliminating the need for manual per-device configuration.
Data Source
AI summary
Systems and methods for configuring browser policy settings on client computing devices are provided. In some aspects, a method includes receiving login credentials from a client computing device. The client computing device includes a browser. The method also includes transmitting browser policy data associated with the login credentials to the client computing device. The browser policy data identifies browser policy settings to be installed on the browser. The browser policy settings identified by the browser policy data include four or more of: compliance settings, behavioral settings, browser/software applications, permission to access one or more websites, restrictions on accessing one or more websites, read permission in a remote document storage unit accessible via the browser, or write permission in a remote document storage unit accessible via the browser.