SSO Policy Enforcement via Intermediary PDP
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security policies, particularly Separation of Duty (SoD) policies, face challenges in dynamic enforcement across multiple systems without requiring modifications to the applications, leading to potential fraud and abuse due to inadequate access control.
Innovation Solution
A method and system that utilize a Single Sign-On (SSO) system in conjunction with a Policy Decision Point (PDP) processor to perform dynamic separation of duty policy checks, monitoring events of interest, and enforcing access control by generating policy check results to manage access to computer applications, thereby preventing unauthorized access and policy violations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional approaches to Dynamic Separation of Duty (DSD) enforcement are used, then policy checks can be performed at the time rights are used, but modifications to the applications or systems are required
Solution Approach 1:
The patent introduces an intermediary component (policy enforcement point or monitoring system) that sits between the user and the application, intercepting authentication requests and performing DSD policy checks without modifying the application itself. This intermediary handles the complexity of policy enforcement while leaving the original application unchanged.
Solution Approach 2:
The system separates the policy enforcement functionality from the application code by dividing the authentication process into distinct segments: the application's standard authentication, the intermediary's policy verification layer, and the policy decision point. This segmentation allows DSD enforcement without application modification.
2Reliability
If Static SoD policies are enforced at the time access is assigned, then policy violations can be prevented in advance, but dynamic policy violations during usage cannot be detected
Solution Approach 1:
The system performs preliminary DSD policy checks during authentication assignment (static enforcement) to prevent obvious violations before access is granted. This preliminary action establishes a first layer of security without preventing dynamic monitoring later.
Solution Approach 2:
The patent implements dynamic DSD policy enforcement that continuously monitors usage patterns and adjusts policy checks in real-time based on current system state, user actions, and contextual factors. This dynamic approach detects and responds to policy violations that occur during application usage, adapting to changing conditions.
3Loss of time
If manual monitoring of policy violations is performed, then policy checks can be conducted periodically, but real-time enforcement and fraud prevention are insufficient
Solution Approach 1:
The system implements continuous, automated monitoring of DSD policy compliance through persistent background processes that track user actions, authentication events, and system state changes in real-time. This continuous monitoring replaces periodic manual checks, ensuring uninterrupted policy enforcement and immediate detection of violations.
Solution Approach 2:
The patent incorporates real-time feedback mechanisms where the monitoring system continuously receives information about user actions and system state, processes this information against DSD policies, and immediately responds by blocking violations or alerting authorities. This closed-loop feedback system enables real-time fraud prevention rather than delayed detection.
Data Source
AI summary
A method for enforcing policies used with a computer client, the method including receiving, at policy decision point (PDP) processor, information from a single sign-on (SSO) system indicating an occurrence of an event of interest on the computer client, performing, using the PDP processor, a policy check in response to the occurrence of the event of interest, wherein a policy check result is generated, and providing the generated policy check result to the SSO system.