Token Injection for Managed App Session Stickiness
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer networking technologies face challenges in maintaining session stickiness, providing efficient authentication, and tracking endpoint information in managed applications, particularly when communicating with third-party services, due to issues like load balancing and cumbersome authentication processes.
Innovation Solution
The implementation of automated token or client certificate injection in managed application communications using a mobile application management (MAM) framework, which intercepts requests and modifies network communications to include tokens or certificates that enable session stickiness, single sign-on, and endpoint identification, even when load balancing occurs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If load balancing is used to maximize processing efficiency, then processing efficiency is improved, but session stickiness deteriorates
Solution Approach 1:
The patent introduces a load balancer as an intermediary component that sits between clients and backend servers. This load balancer implements session stickiness by routing requests with matching tokens to the same backend server, while still distributing different sessions across multiple servers to maintain processing efficiency. The load balancer thus mediates between the conflicting requirements of session persistence and load distribution.
2Reliability
If multiple credentials or devices are used for authentication, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The system performs preliminary authentication actions by issuing tokens during initial enrollment or first authentication. These tokens are then automatically injected into subsequent requests, eliminating the need for users to repeatedly provide credentials. The preliminary authentication establishes a persistent session that simplifies subsequent operations while maintaining security through token-based verification.
Solution Approach 2:
The managed application automatically handles authentication by injecting tokens into requests without requiring user intervention. The system serves itself by managing the authentication process, token injection, and session maintenance automatically, freeing users from the burden of manual credential management while maintaining strong authentication security.
3Reliability
If endpoint information is not shared in managed application communications, then security is improved, but measurement precision deteriorates
Solution Approach 1:
The load balancer acts as an intermediary that receives endpoint information from managed applications through token injection. The load balancer uses this information to route requests appropriately and maintain session stickiness, while the managed application itself does not directly share endpoint information with third-party services. This intermediary approach enables tracking while preserving the security model of the managed application.
Data Source
AI summary
Methods and systems for injection of tokens or certificates for managed application communication are described. A computing device may intercept a request from an application executable on the computing device, the request being to access a remote resource. The computing device may modify future network communications between the computing device and the remote resource to include a token or a client certificate, where the token or the client certificate is an identifier that enables the future network communications to be routed to the remote resource for a given computing session without use of data from the remote resource or data indicative of a connection of the remote resource in which to receive the future network communications. The computing device may send the future network communications to the remote resource to enable action to be taken on behalf of the computing device in response to receipt of the future network communications.