Conditional Access Termination Service for Instant Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in managing unauthorized access due to unexpired access tokens, leading to potential security breaches and increased network traffic when attempting to shorten token validity times.
Innovation Solution
Implementing a conditional access termination service that allows resource providers to subscribe to events related to potential access issues, enabling instant enforcement of IT policies and revocation of unauthorized sessions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access token validity time is reduced to shorten unauthorized access window, then security is improved, but network traffic increases dramatically
Solution Approach 1:
The patent implements a feedback mechanism where resource providers continuously monitor user compliance status through policy evaluations. When a user's compliance state changes (e.g., employment termination, policy violation), the system immediately detects this change and revokes access tokens, creating a closed-loop feedback system that maintains security without requiring frequent token refreshes.
Solution Approach 2:
The system enables resource providers to autonomously evaluate policy compliance and manage access token validity without constant identity provider intervention. The resource provider subscribes to policy evaluation services and independently determines when to revoke access based on compliance status, reducing unnecessary authentication traffic.
2Quantity of substance
If access token validity time is extended to reduce network traffic, then network traffic is reduced, but security is worsened due to prolonged unauthorized access window
Solution Approach 1:
The system performs preliminary policy evaluations and compliance checks before issuing access tokens with extended validity periods. By pre-assessing user compliance status and configuring appropriate token validity durations based on policy requirements, the system ensures that even with longer-lived tokens, unauthorized access is prevented through advance compliance verification and conditional token issuance.
3Ease of operation
If traditional identity provider centralized policy enforcement is used, then policy management is simplified, but real-time access control is lost after token issuance
Solution Approach 1:
The patent segments the centralized policy enforcement into distributed components: the identity provider handles token issuance and initial policy evaluation, while resource providers independently perform continuous policy evaluations and compliance checks. This segmentation allows real-time access control updates at the resource provider level without requiring constant centralized intervention, maintaining both ease of policy management and real-time control responsiveness.
Solution Approach 2:
The system adds a temporal dimension to policy enforcement by implementing continuous monitoring and evaluation throughout the access token's validity period. Instead of a single-point-in-time check during token issuance, the system performs ongoing compliance verification, enabling real-time detection and response to compliance status changes while maintaining centralized policy configuration.
Data Source
Figure 1
Figure 2
Figure 3A~3D
AI summary
Managing an authenticated user session. A method includes a resource provider computer system subscribing to a conditional access termination service for an entity configured to obtain resources from the resource provider computer system through a user session. The resource provider computer system receives an event, related to resource requests, for the entity from the conditional access termination service. The resource provider computer system receives a request for resources from the entity. The resource provider computer system evaluates the request with respect to the event. The resource provider computer system responds to the request based on evaluating the request with respect to the event.