Enterprise Network Access Control via Global Proxy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In enterprise-managed device systems, administrators face challenges in enforcing network access restrictions on applications without modifying the application code, particularly in enforcing network whitelist or blacklist rules across various devices and platforms.
Innovation Solution
The solution involves modifying the operating system network permissions for applications, installing and registering a global proxy to route network traffic, and leveraging operating system APIs to restrict network access, ensuring compliance with specified network rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If administrators modify application code to enforce network access restrictions, then network security control is improved, but application development complexity and maintenance burden increase
Solution Approach 1:
The patent introduces a management component as an intermediary between applications and the network. This component intercepts and monitors network requests from applications, enforcing network access rules without requiring modifications to the application code itself. The management component acts as a mediator that sits in the network communication path, examining and controlling traffic based on configured policies.
Solution Approach 2:
The patent segments the network management functionality by separating it from applications. Instead of embedding network control logic within each application, the system creates a distinct management layer that handles network access control independently. This segmentation allows network security policies to be enforced centrally while applications remain unchanged.
2Reliability
If administrators enforce network access rules on all applications, then data security is improved, but system performance and application responsiveness deteriorate
Solution Approach 1:
The patent implements partial monitoring by allowing applications to make network requests without interception for certain categories of traffic or under specific conditions. The management component can be configured to monitor only specific applications, specific network destinations, or specific types of traffic, rather than all network communication universally. This selective approach maintains security for critical traffic while minimizing performance overhead.
3Reliability
If administrators install management components on user devices, then network access control capability is improved, but user device privacy and autonomy worsen
Solution Approach 1:
The patent enables users to maintain control over their devices by allowing them to review, modify, or remove management components and their associated policies. Users can configure which applications are monitored and what network access rules apply, giving them autonomy decisions about their device's network behavior. The system provides self-service capabilities that empower users rather than imposing complete administrative control.
4Adaptability or versatility
If administrators support multiple devices and platforms, then enterprise compatibility is improved, but management system complexity increases
Solution Approach 1:
The patent creates a universal management component that can operate across multiple device types and operating systems. The management component is designed with platform-agnostic architecture, allowing it to function on various devices (smartphones, tablets, computers) and operating systems (Android, iOS, Windows, macOS). This universality enables centralized network access control policies to be enforced consistently across diverse enterprise devices without requiring separate management systems for each platform.
Data Source
AI summary
Disclosed are various examples for enforcing network access permissions on applications that are installed on a client device. A network whitelist or network blacklist can be deployed by a management service onto a managed client device. A management component can facilitate enforcement of the whitelist and/or blacklist to enforce network access rules on installed applications.