Connection-Specific Policy Management via Unique Identifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current schemes for managing user access to target systems apply access policies globally, affecting all connections, making it difficult to enforce specific restrictions on individual users or connections, such as clipboard redirection in RDP connections.
Innovation Solution
A policy controller assigns a unique connection identifier for each user client connection, allowing the target system to apply connection-specific access policies, enabling different policies for each connection, even if established with the same protocol or between the same user and system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If global access policies are applied to the target system, then security control is simplified and easy to manage, but the ability to enforce specific restrictions on individual users or connections is lost
Solution Approach 1:
The patent segments the access policy enforcement from the global system level to the individual connection level. Each connection is assigned a unique connection identifier that serves as a key to retrieve and apply specific policy settings. This segmentation allows the system to maintain simple global policy management while enabling granular connection-specific control, as each connection independently retrieves and applies its own policy based on its unique identifier.
2Reliability
If connection-specific access policies are implemented, then granular control and security are enhanced, but system complexity increases
Solution Approach 1:
The patent introduces connection identifiers as intermediary elements that bridge the user client and the target system. These identifiers act as keys that enable the target system to retrieve appropriate access policies without requiring complex direct evaluation of user credentials or connection parameters. The intermediary mechanism simplifies the overall system architecture by decoupling the policy storage, retrieval, and application processes, making the system more manageable despite the increased granularity of control.
3Stability of the object's composition
If global policies are enforced on all connections, then consistent security baseline is maintained, but flexibility to apply different policies to different connections is reduced
Solution Approach 1:
The patent applies local quality by allowing different policy settings to be associated with different connection identifiers. Each connection can have its own localized policy configuration that tailors security and access parameters to specific user needs or connection types. The target system retrieves the appropriate policy locally for each connection based on the connection identifier, enabling both global consistency in policy management and local differentiation in policy application.
Data Source
AI summary
A method of managing a connection-specific policy for accessing a target system includes receiving a request from a user client for a connection with a target system. A unique identifier is determined for the requested connection. Connection settings for connecting to the target system are provided to the user client. The connection settings include the unique connection identifier. A corresponding access policy for the connection identifier is provided to the target system. The target system applies the corresponding access policy on the connection established with the connection settings.