Context ID Comparison for Secure Enterprise App Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In enterprise-managed devices, employees face inefficiencies and frustration due to repeated logins to applications, especially Line of Business (LOB) applications, and issues with application access and user data management, leading to productivity losses and security risks from leftover user data.
Innovation Solution
Implementing a system that uses a single sign-on (SSO) check-out process with an agent application to manage user profiles and context IDs, ensuring secure access to SDK-based applications by comparing local and server context IDs, allowing seamless transitions and secure wiping of user data between users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If employees log in repeatedly to individual applications after initial sign-on, then application security is maintained, but productivity decreases and user frustration increases
Solution Approach 1:
The patent merges the application authentication process with the device check-out process. When a user checks out the device, they authenticate once with the EMM system, and this authentication is reused across all LOB applications. The agent application on the device coordinates with the EMM system to establish a single user session that grants access to multiple applications without requiring separate logins for each application.
Solution Approach 2:
The patent implements a universal authentication mechanism where a single sign-on to the EMM system provides access to multiple Line of Business applications. The agent application serves multiple functions: managing device check-out/check-in, coordinating authentication with the EMM system, and enabling access to various LOB applications. This multi-functional approach eliminates the need for separate authentication processes.
2Reliability
If applications remain installed on the device between users, then application availability is maintained, but previous user's data may be accessed by current user
Solution Approach 1:
The patent applies local quality by associating user data with specific user contexts rather than treating all data uniformly. When a user checks out the device, the system retrieves user-specific data from the EMM system and associates it with that user's session. The agent application on the device manages local data storage with user-specific context, ensuring that data is only accessible to the authorized user. This approach maintains application availability while preventing unauthorized access through context-based data protection.
Solution Approach 2:
The patent introduces the EMM system as an intermediary between users and application data. The EMM system acts as a mediator that retrieves, manages, and protects user data, preventing direct access to data stored on the device. The agent application on the device communicates with the EMM system to obtain user-specific data during check-out and to clear or protect data during check-in, ensuring that previous users' data cannot be accessed by current users.
3Object-affected harmful factors
If applications are reinstalled each time a user checks out the device, then user-specific data security is improved, but time and resources are wasted
Solution Approach 1:
The patent implements preliminary action by pre-configuring applications with user-specific data during the device check-out process. Instead of reinstalling applications each time, the system prepares the appropriate user data in advance through the EMM system. When a user checks out the device, the agent application retrieves user-specific data from the EMM system and configures the applications with this data before the user begins work. This eliminates the need for reinstallation while maintaining security through user-specific data association.
Solution Approach 2:
The patent applies discarding and recovering by clearing or protecting user-specific data from the device when a user checks in, and then recovering the appropriate user data when the next user checks out. The agent application manages the lifecycle of user data on the device, discarding or protecting data from previous users and recovering data for current users through coordination with the EMM system. This approach maintains security while avoiding the overhead of full application reinstallation.
Data Source
AI summary
Software development kit (“SDK”) applications may be implemented with user data on an enterprise end-user or shared device subsequent to a single check-out process on the device. A user profile and a context ID for a user can be accessed based on user provided credentials. An agent application can set a value of an agent context ID to a server context ID corresponding to the context ID for the user profile. A status of a local context ID (“LCID”) of an SDK application can be determined in response to an application launch. Using the LCD, a context ID comparison can be performed on the device with a value of a context ID from one of the SDK application, the server, and the agent application based on the LCID status. The SDK application can be implemented with user specific user data obtained from one of the SDK application and the agent application based on a result of the context ID comparison.