SCIM App Segmentation for Context-Based Access Policy Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The traditional enterprise network perimeter has expanded to the Internet due to cloud-based applications, increasing security risks from unsecured devices and unauthorized access, necessitating improved security measures.
Innovation Solution
Implementing a cloud-based system that uses Cross-domain Identity Management (SCIM) to generate optimized application segment policies, reducing the attack surface by allowing access only to necessary users through iterative optimization and machine learning-based policy recommendations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the enterprise network perimeter is expanded to include cloud-based applications and Internet access, then users can access applications remotely and resources can be hosted in the cloud, but security risks increase from unsecured devices and unauthorized access
Solution Approach 1:
The patent segments applications into distinct application segments and users into SCIM groups, creating granular access control policies. Each application segment has specific access policies that define which SCIM groups can access them, replacing the traditional all-or-nothing perimeter approach with fine-grained segmentation that maintains security while enabling remote access.
Solution Approach 2:
The patent implements context-based access controls that evaluate multiple attributes including user identity, device characteristics, location, and application sensitivity. Each access request is evaluated against the specific context of that request, allowing the system to adapt security decisions to local conditions rather than applying uniform perimeter rules.
2Ease of operation
If traditional perimeter-based security with VPN is used, then mobile users can access enterprise resources, but the attack surface increases and security management becomes complex as the perimeter extends to the Internet
Solution Approach 1:
The system automatically generates access policy recommendations by analyzing SCIM group memberships and application segment definitions. The cloud-based system performs iterative optimization calculations to determine the minimum necessary access permissions, reducing manual policy management complexity while maintaining secure access controls.
Solution Approach 2:
The patent transforms security policy management from static perimeter rules to dynamic context-based parameters. Access decisions are made based on multiple changing parameters including user identity, device state, location, and application requirements, allowing the system to adapt to different scenarios without increasing management complexity.
3Productivity
If cloud-based security solutions generate access policies automatically, then policy generation efficiency improves, but the need for optimized policies to reduce attack surface requires complex iterative optimization calculations
Solution Approach 1:
The patent introduces a cloud-based security system as an intermediary that performs iterative optimization calculations between SCIM identity data and application segment definitions. This intermediary system handles the complex optimization mathematics, including determining cost effectiveness of SCIM groups and calculating the minimum set of groups needed for each application segment, while presenting simplified policy recommendations to administrators.
Data Source
AI summary
Systems and methods for generating SCIM-based application segment policies include obtaining log data for a plurality of users of an enterprise where the log data relates to usage of a plurality of applications by the plurality of users, wherein the enterprise is one of a plurality of enterprises associated with the cloud-based system; determining one or more app-segments that are groupings of application of the plurality of applications; and generating access policy of the plurality of applications based on System for Cross-domain Identity Management (SCIM) data and the one or more app-segments.