Security State Evaluation for Mobile Device Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices face challenges in securing access to online services due to inadequate security evaluation methods, which fail to consider the dynamic security state of devices and the source of access requests, leading to vulnerabilities in network traffic and application behavior monitoring.
Innovation Solution
A system and method for evaluating the security state of mobile devices before granting access to services, involving a server that assesses the device's configuration, determines a risk level, and communicates this information to an identity provider to authorize or deny access based on the evaluated security state.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security evaluation methods are used for mobile devices, then access to services can be granted, but the security state of devices is not properly assessed leading to vulnerabilities
Solution Approach 1:
The system performs security evaluation actions before granting access to services. The server receives device information, evaluates security state including configuration assessment and risk level determination, and only then decides whether to allow service access. This preliminary security check prevents vulnerable devices from accessing services.
Solution Approach 2:
A server acts as an intermediary between mobile devices and services. The server receives device information, performs security evaluation, communicates risk levels to identity providers, and mediates the access decision. This intermediary approach centralizes security evaluation without adding complexity to individual devices.
2Reliability
If continuous security monitoring is implemented, then security status awareness is improved, but network traffic and computational resources are consumed
Solution Approach 1:
The system performs security evaluations periodically or at specific triggers such as when a device requests service access. Rather than continuous monitoring, the server evaluates device security state at discrete intervals or events, reducing network traffic and computational overhead while maintaining security awareness.
Solution Approach 2:
The mobile device itself provides security information to the server for evaluation. The device collects and transmits its own configuration data and security state information, reducing the need for extensive server-side monitoring and lowering overall system resource consumption.
3Object-affected harmful factors
If strict security evaluation is performed, then malicious access is prevented, but legitimate access may be denied
Solution Approach 1:
The system applies different security evaluation criteria and risk thresholds to different services or access scenarios. Rather than uniform strict evaluation, the security assessment is tailored to the specific service being accessed, allowing legitimate accesses with acceptable risk levels while blocking malicious attempts.
Solution Approach 2:
The server dynamically adjusts security parameters such as risk thresholds, evaluation depth, and access decisions based on the evaluated security state. When devices meet security requirements, access is granted smoothly; when risks are detected, access is denied or additional verification is requested, balancing security and convenience.
Data Source
AI summary
In one approach, a first computing device receives a request from a second computing device. The request is for access by the second computing device to a service provided by a third computing device over a network. In response to receiving the request, the first computing device performs a security evaluation of the second computing device. The evaluation determines a risk level. The first computing device generates, based on the evaluation, a token for the second computing device. The token includes data encoding the risk level. The token is sent to the second computing device and/or third computing device. The sent data is used to configure the service provided to the second computing device.