Client App Policy Evaluator for Dynamic Access Revocation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for managing access to network applications are limited in their ability to dynamically authenticate and revoke access based on policy conditions, such as location changes or unauthorized device usage, as they rely on user attributes available to the application server and only react when the user initiates a request.
Innovation Solution
A method and system that includes an asynchronous notification mechanism to the client application to revoke access, utilizing a policy evaluator that receives signals from multiple devices to generate de-authentication signals, and performs actions like blanking the screen, logging off, or invalidating session state and cookies, independent of server requests, ensuring continuous and centralized access revocation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authentication is performed only at the beginning of a session and remains valid until inactivity timeout, then system resource utilization is reduced and network latency is decreased, but network security is compromised because the system cannot dynamically respond to policy violations occurring during the session
Solution Approach 1:
The system pre-establishes authentication tokens and session identifiers during initial login, enabling rapid validation decisions during the session without requiring time-consuming re-authentication or server round-trips for every action
Solution Approach 2:
The client application continuously monitors device attributes and policy conditions during the session, providing real-time feedback to determine when authentication should be revoked, allowing dynamic security responses without constant server communication
2Reliability
If the system continuously monitors user attributes and policy conditions to dynamically revoke access, then network security is improved, but system resource utilization increases and network bandwidth consumption rises
Solution Approach 1:
The client application autonomously evaluates policy conditions and monitors device attributes locally without requiring continuous server communication, enabling dynamic security enforcement while minimizing system resource consumption and network bandwidth usage
Solution Approach 2:
The system monitors only the specific policy-relevant attributes and conditions necessary for security decisions rather than continuously evaluating all possible user actions, reducing computational overhead while maintaining security
3Device complexity
If access revocation relies on user-initiated requests to the application server, then system complexity is reduced, but the system cannot proactively respond to policy violations such as location changes or unauthorized device usage
Solution Approach 1:
The client application continuously monitors device attributes and policy conditions during the session, providing real-time feedback to determine when authentication should be revoked, allowing dynamic security responses without constant server communication
Solution Approach 2:
The client application acts as an intermediary between the device state and the authentication system, locally evaluating policy conditions and autonomously deciding when to revoke access, thereby adding adaptability without significantly increasing overall system complexity
Data Source
AI summary
In some aspects, a method for revoking access to a network application on a client device. The method includes establishing, by a client application on a client device responsive to authenticating a user, access to one or more network applications of one or more first servers of a first entity via an embedded browser of the client application, receiving, by the client application, a notification from a second server of a second entity that access for the user to a network application of the one or more network applications is to be revoked, and performing, by the client application responsive to the notification, one or more revoking actions based at least on a policy.