Notification Server Push Notification Credential Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise Mobility Management (EMM) providers face challenges in delivering push notifications to third-party applications across multiple systems and servers without compromising user email account security, as existing methods require storing credentials that can be vulnerable to theft.
Innovation Solution
A system and method that uses a notification server to receive encrypted user credentials, generates a callback URL with embedded credentials, and decrypts them using a private key to access email accounts for push notifications, ensuring secure delivery without storing unencrypted credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If EMM provider directly accesses user email accounts to monitor changes and send notifications, then push notification delivery is enabled, but user credentials are vulnerable to theft and security breaches occur
Solution Approach 1:
The patent introduces a notification service as an intermediary component between the EMM provider and user email accounts. This service receives encrypted credentials from the EMM provider, manages the actual email account access, and handles push notification delivery. The EMM provider never stores or accesses plaintext credentials, eliminating the security vulnerability while maintaining notification functionality.
2Ease of operation
If EMM provider stores email credentials for each user account, then direct email monitoring is enabled, but security concerns arise from credential storage
Solution Approach 1:
The patent extracts the credential storage and management function from the EMM provider system and places it in a dedicated notification service. The EMM provider only stores encrypted credential hashes, while the notification service holds the actual credentials needed for email account access. This separation removes the security risk from the EMM provider while enabling continued email monitoring capability.
3Productivity
If service account with authority to access multiple users' accounts is used, then email monitoring across multiple accounts is enabled, but the service account becomes a high-value target for hackers
Solution Approach 1:
The patent segments the single high-privilege service account into multiple individual user account credentials, each with limited scope. Instead of one service account accessing all email accounts, the system creates separate credential pairs for each user account. This segmentation reduces the impact of any single credential compromise and eliminates the need for a high-privilege service account.
Data Source
AI summary
Examples described herein include systems and methods for providing push notifications to a third-party application executing on a client device. An example can include encrypting user credentials, generating a callback Uniform Resource Locator (“URL”) with at least a portion of the encrypted credentials embedded into the URL, and requesting notifications from an email service to be provided at the callback URL. Upon receiving a notification at the callback URL, a system component can decrypt the credentials within the URL using a private key and log into the email account using those decrypted credentials. The system component can then generate a push notification based on any changes found in the email account and cause the notification to be delivered to the third-party application on the client device.