Token-Based Sub-Session Control for Online Collaboration Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current online collaborative computing sessions lack mechanisms to enforce organizational policies regarding sub-session participation, particularly for internal versus external participants, as service providers are unaware of attendees' locations, leading to security and IP concerns.
Innovation Solution
Implementing a token-based control system where client devices obtain sub-session tokens from session controllers based on permissions, which are then validated by collaboration servers to enforce internal and external policies, and using firewalls to block unauthorized sub-sessions by mapping sub-sessions to specific network locations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If attendees log in from any location with proper authentication, then accessibility and ease of operation are improved, but security control and policy enforcement deteriorate
Solution Approach 1:
The patent introduces session controllers as intermediary components between clients and collaboration servers. These controllers issue tokens that mediate access control, allowing the system to maintain both open accessibility and strict security enforcement. The token acts as a mediator carrying authorization information that enables policy-based access control without restricting legitimate access.
Solution Approach 2:
The system changes the parameter of access control from location-based restrictions to token-based authorization. By transforming the access control mechanism from checking client locations to validating token permissions, the system achieves both improved accessibility (clients can connect from anywhere) and enhanced security (fine-grained policy enforcement through token validation).
2Device complexity
If service providers are unaware of attendees' locations, then system simplicity and ease of operation are improved, but policy enforcement capability deteriorates
Solution Approach 1:
The patent segments the authentication and authorization functions into separate components. Session controllers handle authentication and issue tokens, while collaboration servers validate tokens and enforce policies. This segmentation allows the system to remain simple in architecture while gaining sophisticated policy enforcement capabilities through the token-based authorization layer.
Solution Approach 2:
The system performs preliminary authentication and token issuance before actual collaboration sessions begin. Session controllers pre-validate client identities and issue tokens containing authorization information in advance. This preliminary action enables policy enforcement to be implemented without adding complexity to the core collaboration functionality.
3Reliability
If token-based control with session controllers is implemented, then policy enforcement and security are improved, but system complexity and device complexity increase
Solution Approach 1:
The patent designs session controllers and tokens with multi-functionality. Session controllers not only issue tokens but also manage session state and coordinate with collaboration servers. Tokens carry multiple types of authorization information that can enforce various policies. This universality reduces the need for separate dedicated components for each function, thereby limiting the increase in system complexity.
Data Source
AI summary
In one embodiment, a client device may send one or more sub-session requests to one or more corresponding session controllers through a computer network to obtain one or more corresponding sub-session tokens that indicate in which sub-sessions of an online collaborative computing session the client device is permitted to participate. The client device may then receive particular sub-session tokens (e.g., based on certain permissions), which may then be sent to a collaboration server to establish one or more permitted sub-sessions of the online collaborative computing session with the client device as indicated by the received sub-session tokens.