Email Server Access Control via Out-of-Band Device Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security systems face challenges in providing secure access to servers, especially when users attempt to access email servers using unmanaged third-party applications or unenrolled devices, as they lack the necessary profile integration, leading to potential security risks from compromised devices.
Innovation Solution
Implementing a multi-factor authentication method that includes sending an out-of-band message to the user for confirmation and providing an authentication token specific to the user device and application, while also verifying the device's enrollment status through an identity management server to ensure secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If simple username and password authentication is used for third-party mail clients, then ease of operation is improved, but security is worsened because unenrolled devices can access the system
Solution Approach 1:
The system performs preliminary device identification and enrollment verification before granting access. The mail server identifies the device using the user agent string and checks enrollment status with the EMM system in advance, obtaining approval or denial before allowing email access, thus preventing compromised devices from accessing the system
Solution Approach 2:
The patent introduces an intermediary authentication process between the third-party mail client and the mail server. The server acts as a mediator that forwards device information to the EMM system for verification, and only grants access based on the EMM system's authorization, thus enabling security control without requiring direct integration between the mail client and EMM system
2Reliability
If access is denied to unenrolled devices, then security is improved, but ease of operation is worsened because users cannot use third-party mail clients
Solution Approach 1:
The patent makes the authentication system universal by supporting both enrolled devices with EMM integration and unenrolled devices using third-party mail clients. The server handles multiple authentication scenarios: devices with profiles, devices without profiles, and various mail clients, allowing the system to serve diverse user needs while maintaining security through the common EMM verification process
3Reliability
If device identification is implemented to check enrollment status, then security is improved, but device complexity is worsened due to additional authentication steps
Solution Approach 1:
The patent extracts the complex device identification and enrollment verification process from the mail client and relocates it to the mail server. The server performs the user agent string analysis, device identification, and EMM system communication, allowing the mail client to remain simple while the server handles the authentication complexity
Data Source
AI summary
Examples described herein include systems and methods for controlling access to a server, such as an email server or a gateway, in situations where the identity of the requesting device is unknown or where the user device accesses the server using an unknown or unmanaged application. In one example, the system can utilize a user authentication credential included in the request to identify other devices belonging to the user that happen to be enrolled with the system. An out-of-band message can be sent to those enrolled devices, requesting confirmation from the user and, in conjunction with an authentication token, allowing the system to trust the previously unknown device. In the example of an unmanaged application attempting to access an email server, the system can confirm compliance of the requesting device and issue an authentication token that, along with an appropriate command sent to the email server, provides access.