Policy-Based Access Control for Mobile Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile device security technologies are ill-suited for modern mobile network environments, lacking a comprehensive and secure system for policy development, verification, and enforcement to control access and resource usage, particularly in diverse and potentially hostile contexts.
Innovation Solution
A policy-based access and resource control system utilizing Policy Decision Points (PDP) and Policy Enforcement Points (PEP) with a client/server architecture, hierarchical policy delegation, and event-driven resolution, along with a caching mechanism for server-provided policies, to provide granular control and secure access management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional authentication and specialized applications are used for mobile device security, then implementation is simple, but they are ill-suited for diverse mobile network environments and lack comprehensive policy control
Solution Approach 1:
The system segments policy control into two distinct components: Policy Decision Points (PDP) that store and evaluate policy rules, and Policy Enforcement Points (PEP) that intercept and enforce decisions. This segmentation allows the complex policy management functionality to be distributed, with PDPs serving as centralized policy repositories and PEPs providing localized enforcement at critical system boundaries, making the system adaptable to mobile networks while managing complexity through functional separation
Solution Approach 2:
The system introduces Policy Decision Points as intermediary components that mediate between policy definitions and enforcement actions. PDPs serve as centralized intermediaries that receive policy queries from PEPs, evaluate them against stored policy rules, and return enforcement decisions. This intermediary layer enables comprehensive policy control for diverse mobile network environments without requiring complex logic at each enforcement point
2Reliability
If comprehensive policy control is implemented, then security coverage is improved, but system complexity increases
Solution Approach 1:
By segmenting the security system into PDPs for policy management and PEPs for enforcement, the system achieves comprehensive security coverage through centralized policy control while managing complexity through distributed architecture. PEPs are placed at multiple system boundaries (network interface, file system, application layer) to provide wide security coverage, while PDPs centralize the complex policy evaluation logic
Solution Approach 2:
The PDP/PEP architecture provides universal policy enforcement across diverse mobile network environments and multiple resource types (network access, file system, device capabilities). The same PDP/PEP mechanism handles different policy scenarios uniformly, achieving comprehensive security coverage through a single versatile framework rather than multiple specialized solutions
3Reliability
If policy decisions are made in real-time without caching, then policy freshness is maintained, but system performance deteriorates
Solution Approach 1:
The system performs preliminary action by caching policy decisions locally at PEPs before they are needed for enforcement. When policy queries are received, PEPs first check their local caches for previously made decisions and reuse them when applicable, avoiding repeated real-time evaluation at the PDP. This preliminary caching action maintains policy freshness through periodic updates while significantly improving system performance by reducing evaluation overhead
Data Source
AI summary
Systems and methods for secure, policy-based, access control and management of mobile computing devices, including policy decision enforcement mechanisms, device and private network presence testing, aspects of file system controls, policy set sanity checking algorithms, performance optimizations.