Gateway-Mediated Client Access Control for External Server Resources
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for controlling client access to server-hosted resources are inadequate, particularly for clients outside the enterprise network, as they often lack comprehensive security policies and are limited by the type of agent or operating system, leading to inefficiencies and increased computational costs.
Innovation Solution
A gateway intermediary scans client capabilities and modifies user interface elements based on security policies to enforce access controls, including disabling or replacing protocol handlers, launching virtual desktops, or using native applications to ensure secure access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web applications are configured to enforce access controls, then security policy enforcement is improved for enterprise clients, but control over external clients accessing resources is lost
Solution Approach 1:
The patent introduces a gateway as an intermediary component between clients and server-hosted resources. This gateway intercepts protocol handlers and enforces security policies centrally, allowing enterprise administrators to maintain control over external clients without requiring modifications to individual web applications. The gateway acts as a mediator that can inspect and control access requests regardless of the client type or location.
2Reliability
If URI protocol intercept is used in the agent, then access controls are enforced for that specific agent type, but other agent types are not covered
Solution Approach 1:
The patent implements a universal gateway that can intercept and control multiple protocol handlers (HTTP, HTTPS, FTP, SMTP, etc.) across different agent types including web browsers, email clients, and file transfer clients. Instead of implementing separate control mechanisms for each agent type, the gateway provides a single universal interface that can enforce security policies across all client applications that communicate with server-hosted resources.
3Reliability
If protocol handlers are registered with the operating system, then access control can be enforced across multiple agent types, but the registration may be overwritten and requires re-registration
Solution Approach 1:
The patent implements a gateway that performs preliminary interception of protocol handlers before they can be overwritten or lost. By establishing the gateway as a persistent system-level component that pre-intercepts handler calls, the solution ensures continuous access control enforcement without requiring repeated registration. The gateway maintains its position in the protocol handler chain, automatically restoring control if handlers are re-registered or system changes occur.
4Reliability
If computer-vision based techniques are used for access controls, then comprehensive monitoring is achieved, but significant computing resources are consumed
Solution Approach 1:
The patent extracts the computationally intensive computer-vision based monitoring functions from the client devices and relocates them to a centralized gateway server. The gateway performs image analysis, screen capture, and behavioral monitoring on remote servers rather than on individual client devices. This extraction eliminates the need for heavy local processing on clients while maintaining comprehensive monitoring capabilities through centralized analysis of transmitted data.
Data Source
AI summary
Described embodiments provide systems and methods for protecting access to a server. A device intermediary to a client and a server may identify a capability of the client to protect access to the server via an application. The device may determine that an element of a user interface provided by the application to the client is to be modified based at least on the capability. The device may modify, responsive to the determination, the element of the user interface to further protect access to the server in accordance with the capability. The device may provide the modified element to the client for the user interface of the application.