Network-Level Application Access Control for Dynamic User Policies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network technologies lack effective network-level enforcement of application service access controls, which can be bypassed, leading to inconsistent user experiences and limited administrative control over application access.
Innovation Solution
Implement a dynamic user application control service using network and policy-based application programming interfaces (APIs) to enforce policy-based access controls based on user-specific, location-, and time-based criteria, without relying on client- or enterprise-side application event monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If application-level access control is implemented, then user experience is improved, but control reliability deteriorates because it can be bypassed
Solution Approach 1:
The patent introduces a network-level intermediary system that acts as a mediator between the application service and the end device. This intermediary implements policy-based access control at the network layer, preventing bypass attempts that would occur at the application level. The network-level enforcement point ensures that control policies are applied consistently regardless of the application used, resolving the contradiction between user experience and control reliability.
2Reliability
If network-level access control is implemented, then control reliability is improved, but device complexity increases
Solution Approach 1:
The patent extracts the access control functionality from the end devices and relocates it to the network infrastructure. By taking out the complex policy enforcement logic from individual devices and centralizing it at the network level, the system achieves reliable control without increasing device complexity. The network element handles all policy evaluation and enforcement, while end devices simply communicate their application usage preferences.
3Measurement precision
If client-side application monitoring is implemented, then access control precision is improved, but loss of time increases due to continuous monitoring
Solution Approach 1:
The patent implements preliminary action by having end devices proactively report their application usage preferences and current applications to the network before access control decisions are needed. This eliminates the need for continuous monitoring, as the network already has the necessary information to make precise access control decisions based on pre-reported data, thus reducing time loss while maintaining precision.
4Ease of operation
If enterprise-side access control is implemented, then administrative control is improved, but adaptability deteriorates because it cannot respond to dynamic user needs
Solution Approach 1:
The patent implements dynamics by enabling real-time updates of application usage preferences and dynamic adjustment of access control policies based on changing user needs and contexts. The system allows users to modify their application preferences on-the-fly, and the network-level enforcement dynamically adapts to these changes without requiring enterprise-side reconfiguration. This resolves the contradiction between administrative control and adaptability by making the control system responsive to dynamic user requirements.
Data Source
AI summary
A method, network device, system, and non-transitory computer-readable storage medium are described in relation to an dynamic user application control service that includes receiving from an application device, a request for access controls associated with a user application and an end device; generating, per the request, policies pertaining to the access controls, wherein the policies include time-based rules, location-based rules, or application type-based rules; obtaining a current location of the end device; comparing, by the network device, a current time with the time-based rules, the current location with the location-based rules, or an application type for the user application with the application-type rules; generating, per the comparing, a policy decision among the policies pertaining to the access controls; and applying, per the policy decision, the time-based rules, the location-based rules, and the application type-based rules for establishment of an application session with the end device.