SaaS Application Access Control Using DNS Policy Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control methods for Software as a Service (SaaS) applications in private networks face issues with data security due to false or missing recognition of IP addresses, leading to compromised application access security.
Innovation Solution
An access control method utilizing domain name resolution to determine target access policies through a central domain name system and application gateway, ensuring accurate identification of applications by correlating domain names with access policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IP address-based access control is used for SaaS applications, then access control can be implemented, but false or missing recognition occurs leading to compromised security
Solution Approach 1:
The patent introduces a domain name resolution mechanism as an intermediary between the access control system and SaaS applications. Instead of directly using IP addresses, the system resolves domain names to obtain accurate application identifiers, thereby improving recognition precision while maintaining access control functionality
Solution Approach 2:
The patent replaces the mechanical IP address matching system with a domain name resolution-based identification system. This substitution eliminates the false and missing recognition issues inherent in IP address-based methods by using more reliable domain name-to-application mapping
2Measurement precision
If domain name resolution is implemented to improve identification accuracy, then false and missing recognition are prevented, but system complexity increases
Solution Approach 1:
The patent leverages the existing domain name system (DNS) infrastructure to perform identification functions. By making the access control system compatible with the universal DNS protocol, the system gains accurate application identification capabilities without adding significant complexity, as DNS resolution is already a standard network function
Solution Approach 2:
The system uses the existing domain name system to automatically resolve application identifiers. The DNS infrastructure serves itself to provide resolution services, eliminating the need for the access control system to maintain its own complex resolution mechanism, thereby reducing overall system complexity
Data Source
AI summary
The present disclosure relates to the field of network technologies and discloses an application access control method and system, and a device, a medium and a program product thereof. The present disclosure provides an application access control method. The method includes: generating, by a security management application client, an access request after detecting access to a target application, and sending the access request to a central domain name system; performing, by the central domain name system, domain name resolution on the access request to obtain a target application domain name of the target application, and sending the target application domain name to an application gateway; and determining, by the application gateway, a target access policy for the target application based on a matching result of the target application domain name in a first configuration file, and controlling, based on the target access policy, a terminal device.