External Service Access Mapping for Unauthorized SaaS Blocking

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The migration of services from on-premises solutions to cloud-based software as a service (SaaS) introduces security risks due to reliance on external entities, making it challenging to manage access and prevent unauthorized use of both authorized and non-authorized service computing environments.

Innovation Solution

A system and method for monitoring and analyzing data sources generated by user identities accessing service computing environments, mapping authorized and unauthorized connections, and automatically blocking access to ensure secure communication, using large language models (LLM) for security state computation and risk assessment.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If services are migrated to cloud-based SaaS solutions, then service accessibility and flexibility are improved, but security risks increase due to reliance on external entities

Engineering Contradiction:

Improveservice accessibilityVSAvoidsecurity risk

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces a security system as an intermediary between the target computing environment and external SaaS services. This system monitors data sources, analyzes communications, maps connections between user identities and services, and blocks unauthorized access attempts, thereby mediating the security risks while preserving service accessibility

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system continuously monitors data sources generated by user identities accessing SaaS services, analyzes this data to identify communication patterns, and provides feedback by blocking access for unauthorized users. This closed-loop feedback mechanism enables real-time security management while allowing authorized services to function normally

Inventive Principle:

Principle #23Feedback

2Reliability

If access monitoring and analysis is implemented to identify unauthorized connections, then security control is improved, but system complexity increases

Engineering Contradiction:

Improvesecurity controlVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The security system segments the monitoring and analysis process into distinct functional components: data source monitoring, data analysis, connection mapping, and access blocking. This segmentation allows each component to handle specific tasks independently, reducing overall system complexity while maintaining comprehensive security control

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system automatically performs security analysis and access blocking without requiring manual intervention. By implementing self-service capabilities, the system reduces operational complexity and allows security functions to be performed autonomously based on monitored data and predefined security policies

Inventive Principle:

Principle #25Self-service

3Reliability

If automatic access blocking is implemented for unauthorized users, then unauthorized access prevention is improved, but false blocking of authorized users may occur

Engineering Contradiction:

Improveunauthorized access preventionVSAvoidaccess accuracy

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system replaces manual access control decisions with automated analysis of monitored data sources. By using computational analysis to identify communication patterns and map connections, the system reduces human error and improves access accuracy while maintaining strong prevention of unauthorized access

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system changes parameters such as monitoring data sources, analysis criteria, and connection mapping rules to improve access accuracy. By continuously adjusting these parameters based on monitored communications, the system reduces false blocking while maintaining effective unauthorized access prevention

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS20260067282A1Management of access to external authorized services

Publication Date: 2026.03.05 GRIP SECURITY LTD

AI summary

There is provided a method, comprising: analyzing data sources to compute security states between user identities of a target computing environment and service computing environments, according to the analyzing, mapping connections between the user identities and the service computing environment, and assigning a corresponding security state to each connection between first user identities that are authorized to access authorized service computing environments, second user identities that are non-authorized to access the authorized service computing environments, and third user identities that are non-authorized to access non-authorized service computing environments, for each connection, comparing a current security state to a preceding security state, and in response to detecting a change from the preceding security state, automatically blocking access of the second user identities to the authorized service computing environments, and automatically blocking access of the third user identities to access non-authorized service computing environments.