Notification Server Callback URL for Secure Email Push
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise Mobility Management (EMM) providers face challenges in delivering push notifications to third-party applications across multiple systems and servers without compromising user email account security, as existing methods require storing credentials that can be vulnerable to theft.
Innovation Solution
A system and method that uses a notification server to receive encrypted user credentials, generates a callback URL with embedded credentials, and decrypts them using a private key to access the email service for push notifications, ensuring that only decrypted credentials are used temporarily and securely, preventing long-term storage of readable credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If EMM provider directly accesses user email accounts to monitor changes and send notifications, then push notification delivery is achieved, but security is compromised due to credential storage requirements
Solution Approach 1:
The patent introduces a notification server as an intermediary between the EMM provider and email accounts. The notification server holds credentials and generates callback URLs, allowing the EMM provider to receive notifications without directly accessing or storing email credentials. This mediator architecture enables notification delivery while eliminating the security vulnerability of credential storage at the EMM provider.
Solution Approach 2:
The patent extracts credentials from the EMM provider's environment and places them exclusively on the notification server. By removing credentials from the EMM provider's system, the patent eliminates the security risk while maintaining notification functionality through the callback URL mechanism that does not require credential storage at the EMM provider.
2Adaptability or versatility
If EMM provider uses service account with authority to access multiple users' accounts, then notification coverage is improved, but security vulnerability increases due to high-privilege credential exposure
Solution Approach 1:
The notification server acts as an intermediary that holds the service account credentials with broad authority. The EMM provider interacts only with the notification server through authenticated API calls, never directly accessing email accounts. This maintains comprehensive notification coverage while containing the security risk to the notification server's controlled environment.
Solution Approach 2:
The system creates a callback URL that serves as a secure proxy for credential-based access. Instead of the EMM provider storing and using high-privilege credentials, it receives notifications through a copied access mechanism (callback URL) that the notification server validates and processes on behalf of the EMM provider.
3Ease of operation
If EMM provider stores email credentials for each user account, then individual account access is enabled, but security risk compounds with the number of stored credentials
Solution Approach 1:
The patent extracts all email credentials from the EMM provider's environment and consolidates them exclusively on the notification server. The EMM provider loses direct credential storage capability but gains notification receiving capability through the callback mechanism. This extraction eliminates the security risk that compounds with the number of stored credentials.
Solution Approach 2:
The notification server serves as an intermediary that manages all credential storage and validation. Individual account access capability is maintained through the notification server's ability to authenticate with email services using stored credentials, while the EMM provider accesses notifications without handling credentials directly.
4Adaptability or versatility
If third-party applications cannot utilize operating-system features, then application compatibility is improved, but push notification reception fails
Solution Approach 1:
The notification server acts as an intermediary that bridges third-party applications and the email notification system. Applications that cannot use native OS push features can still receive notifications through HTTP callback URLs that the notification server invokes when email changes occur, enabling cross-platform compatibility while maintaining reliable notification delivery.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Examples described herein include systems and methods for providing push notifications to a third-party application executing on a client device. An example can include encrypting user credentials, generating a callback Uniform Resource Locator ("URL") with at least a portion of the encrypted credentials embedded into the URL, and requesting notifications from an email service to be provided at the callback URL. Upon receiving a notification at the callback URL, a system component can decrypt the credentials within the URL using a private key and log into the email account using those decrypted credentials. The system component can then generate a push notification based on any changes found in the email account and cause the notification to be delivered to the third- party application on the client device.