Client-Side Security String Evaluation for VPN Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods of access control in data communication networks require administrative burdens and delays due to the need for authentication credentials to be translated and evaluated, especially when components are remotely located, and there is a need for a method to minimize these burdens and delays.
Innovation Solution
A method and system that authorize a client's access to a virtual private network connection based on client-side attributes by transmitting a request to evaluate a security string, where the client evaluates clauses associated with these attributes and responds, allowing for assignment to an authorization group without modifying the credential format, thereby reducing administrative burdens and delays.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional access control methods are used requiring credential translation and evaluation, then access security is maintained, but administrative burden increases and access delays occur
Solution Approach 1:
The client device autonomously evaluates security strings and determines its own authorization level without requiring manual credential translation or administrative intervention. The security string is self-executing code that runs locally on the client, eliminating the need for administrators to manually map credentials to authorization levels.
Solution Approach 2:
The patent extracts the credential translation and evaluation process from the server-side access control infrastructure and relocates it to the client device. By taking out the evaluation burden from the administrative system and placing it on the client, the system reduces administrative workload while maintaining security.
2Reliability
If credential translation and evaluation is performed remotely, then centralized control is maintained, but access delays increase
Solution Approach 1:
The system performs preliminary evaluation by embedding the security string evaluation logic directly in the access request flow. The client evaluates the security string immediately when receiving the access request, rather than waiting for remote translation and evaluation, thus reducing access delay while maintaining centralized security policy enforcement.
Solution Approach 2:
The security string acts as an intermediary between the centralized access control policy and the client device. It carries the evaluation logic from the server to the client, enabling distributed execution while maintaining centralized control over the security policy definition.
3Measurement precision
If complex credential translation is performed, then access control precision is improved, but processing complexity increases
Solution Approach 1:
Instead of performing complex credential translation, the system copies the security evaluation logic directly into the security string that is sent to the client. The client executes this copied logic locally, achieving precise access control decisions without the complexity of translating and interpreting multiple credential formats on the server side.
Data Source
AI summary
An appliance and method for authorizing a level of access of a client to a virtual private network connection, based on a client-side attribute includes the step of establishing, by an appliance, a control connection with a client upon receiving a client request to establish a virtual private network connection with a network. The appliance transmits, via the control connection, a request to the client to evaluate at least one clause of a security string, the at least one clause including an expression associated with a client-side attribute. The client transmits, via the control connection, a response to the appliance comprising a result of evaluating the at least one clause by the client. The appliance assigns the client to an authorization group based on the result of evaluation of the at least one clause.