Device Identity Server for Context-Aware Cloud Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
As SaaS applications and legacy applications migrate to the cloud, remote access systems lack visibility into device context, making it difficult to enforce security policies based on varying device security access and requirements, leading to challenges in authorization and access control.
Innovation Solution
A federated identity system that separates user and device identity authentication, using a device identity server to provide an authenticated device identity assertion, which includes device context, allowing the application server to enforce richer security policies and grant varying levels of access based on device posture and compliance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If federated user identity authentication is used for SaaS access, then user authentication across multiple systems is enabled, but device context visibility is lost making security policy enforcement difficult
Solution Approach 1:
The patent segments the identity authentication process into two independent components: user identity authentication (handled by identity provider) and device identity authentication (handled by device identity server). This segmentation allows each component to be processed independently, enabling the system to obtain both user credentials and device context information without interference, thus resolving the contradiction between user authentication capability and device context visibility.
Solution Approach 2:
The patent introduces a device identity server as an intermediary component that specifically handles device identity authentication and provides device context information to the SaaS application. This intermediary bridges the gap between the federated identity system and device context visibility, allowing the application to enforce security policies based on device posture without compromising the existing user authentication flow.
2Reliability
If device context visibility is enhanced for security policy enforcement, then authorization granularity is improved, but system complexity increases
Solution Approach 1:
The patent extracts device identity authentication as a separate, standalone process from the user authentication flow. By taking out device context collection and verification into an independent device identity server, the system enhances security policy enforcement capability without significantly complicating the core authentication mechanism. The separation allows device context to be obtained through a dedicated interface while maintaining the simplicity of the original federated identity system.
3Adaptability or versatility
If separate device identity authentication is implemented, then device posture-based access control is enabled, but authentication process duration increases
Solution Approach 1:
The patent implements preliminary action by having the device identity server pre-compute and cache device identity assertions and context information before they are needed for access control decisions. This preliminary preparation allows the actual authentication process to quickly retrieve pre-validated device context without performing complex verification in real-time, thus enabling device posture-based access control while minimizing additional authentication time.
Data Source
AI summary
A device obtains access to an application resource from a remote application server based on an authenticated device identifier. The device sends a request to access the application resource provided by the remote application server. The device receives a first message from the remote application server directing the device to send an authentication message to a device identity server. The authentication message requests an authenticated device identity for the device. The device attaches metadata associated with the device to the authentication message and sends the authentication message with the attached metadata to the device identity server. The device receives the authenticated device identity from the device identity server and sends the authenticated device identity to the remote application. The device obtains access to the application resource from the remote application server based on the authenticated device identity.