Remote Session Access Control via Device State Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing remote desktop and application technologies face challenges in securely managing and controlling devices with varying security states, especially on platforms like iOS and Android, where Virtual Channels are not available, and background applications are restricted to conserve battery life, making it difficult to establish direct network communication and enforce corporate security policies.
Innovation Solution
A device state server mechanism that monitors and communicates the device, operating system, and user session state through a push notification service, allowing the remote desktop or application server to determine access permissions and block access if security standards are not met, using a Device State Service that persists state information in the Windows Registry and Environment Variables, and launches a Desktop Blocking Application to inform users of access denial.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If background applications are used to monitor device state on sandboxed platforms, then compliance monitoring capability is improved, but battery consumption increases
Solution Approach 1:
The background application monitors device state at scheduled intervals rather than continuously, checking for state changes only when needed. This periodic monitoring approach maintains compliance monitoring capability while significantly reducing battery consumption compared to continuous monitoring.
Solution Approach 2:
The system uses push notifications to trigger the background application only when state changes are detected, creating a feedback loop that activates monitoring only when necessary. This ensures compliance monitoring remains effective while minimizing unnecessary battery consumption during normal operation.
2Ease of operation
If direct network communication is established between device and remote server, then access control is improved, but security vulnerabilities increase on sandboxed platforms
Solution Approach 1:
The patent introduces a device state server as an intermediary component that mediates between the sandboxed background application and the remote server. This intermediary receives state information from the device, validates it against security policies, and controls access permissions without requiring direct network communication from the sandboxed application, thereby eliminating security vulnerabilities while maintaining effective access control.
3Productivity
If Virtual Channels are used for communication, then network communication capability is improved, but compatibility decreases on iOS and Android platforms
Solution Approach 1:
The patent segments the communication architecture into separate functional components: a sandboxed background application that collects device state, a device state server that processes and validates state information, and a remote server that enforces access policies. This segmentation allows each component to operate independently, enabling the system to function on sandboxed platforms like iOS and Android without requiring Virtual Channel technology, thus maintaining platform compatibility while preserving network communication capability.
Data Source
AI summary
Method and devices are provided for controlling access of a device to a remote desktop or an application running on a remote desktop or application server using a remoting protocol. The method includes: registering the device with a device state server to store identifying information, including a push notification token; using the device state server with access to the device identifying information to wake a device state application on the device in response to detection of connectivity between the device and the remote desktop or application server; monitoring the device to determine a device state; sending the device state from the device to the device state server and then to the remote desktop or application server; and determining based on the received device state if an access to the remote desktop or remote application running in the user session is allowed, otherwise blocking the access.