Dynamic Permission Management via Enterprise License Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Mobile Device Management (MDM) solutions face challenges in dynamically managing permissions for Android applications, leading to static permission settings that cannot be easily changed, especially when contracts with terminal manufacturers are terminated or modified, and result in fragile security policies and unintended system-level permissions being granted.
Innovation Solution
Implementing an Enterprise License Management (ELM) system that allows for dynamic permission management through a license key-based approach, where a terminal requests a Right Object (R/O) from an ELM server, which includes a permission list, enabling the controller to set and reset permissions accordingly, thereby preventing unnecessary system-level permissions from being granted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If an application uses the same signature as the platform to acquire permission, then the application can automatically grant all requested permissions, but the permission cannot be flexibly changed when contracts are terminated or modified
Solution Approach 1:
The patent implements dynamic permission management by replacing static signature-based permission grants with a runtime permission verification mechanism. The permission management module continuously checks license keys and validates permissions against the ELM server, allowing permissions to be dynamically adjusted, revoked, or modified based on current contractual status rather than being fixed at installation time
Solution Approach 2:
The patent introduces an Enterprise License Management (ELM) server as an intermediary between the application and the permission system. This intermediary manages license keys and communicates with the permission management module to verify and control permissions, enabling flexible permission changes without direct platform signature dependency
2Reliability
If the MDM solution restricts application permission, then security policy can be implemented, but the granted permission cannot be changed even if contract terms are varied
Solution Approach 1:
The patent implements a feedback mechanism where the permission management module continuously communicates with the ELM server to verify license keys and update permission status. When contractual terms change, the system receives feedback from the ELM server about valid license keys and automatically adjusts permissions accordingly, maintaining both security enforcement and adaptability
Solution Approach 2:
The system transitions from static permission restriction to dynamic permission management by implementing runtime verification of license keys and permissions. The permission management module can dynamically adjust restricted permissions based on current license validity and contractual terms, allowing security policies to remain enforceable while adapting to changing business conditions
3Ease of operation
If an application is recognized as part of the system with Shared User ID, then system-level permissions are granted, but unintended system-level access is provided to third parties
Solution Approach 1:
The patent introduces the ELM server and permission management module as intermediaries between third-party applications and the system-level permission layer. Even when applications are recognized as part of the system with Shared User ID, the intermediary verifies license keys and validates whether system-level permissions should be granted, preventing unauthorized third-party access while maintaining ease of system integration
Solution Approach 2:
The system applies preliminary anti-action by implementing permission verification before granting system-level access. The permission management module checks license keys and validates permissions against the ELM server before allowing an application recognized as part of the system to access protected resources, preventing unintended system-level access before it can occur
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of operating a terminal using Mobile Device Management (MDM) solution includes: installing an application, requesting for registration by a license key received from an Enterprise License Management (ELM) server, receiving a Right Object (R/O) that corresponds to the license key and comprises a permission list, setting at least one permission based on the permission list comprised in the received R/O, and performing the set permission. A terminal using MDM comprises an MDM application configured to control an installed application to acquire a required permission, a ELM agent configured to request for registration by a license key from an ELM server, and receive a R/O that corresponds to the license key and comprises a permission list, and an ELM permission enforcer configured to set at least one permission based on the permission list comprised in the received R/O.