Controller for Access Token Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for managing access to protected resources across different web sites and applications, such as the OAuth protocol, require users to intervene repeatedly and lack fine-grained control over access rights, leading to operational burdens and potential human errors in privacy management.
Innovation Solution
A controller system that intercepts and examines messages containing request tokens, enforcing pre-established policy settings to determine whether to forward the tokens to service providers, thereby preventing unauthorized access and reducing user intervention by interrupting the authentication and authorization process if the request does not meet policy criteria.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users directly grant access to service providers using OAuth protocol, then access authorization can be achieved, but users must repeatedly intervene and cannot enforce fine-grained access controls
Solution Approach 1:
The patent introduces a controller as an intermediary component that sits between the user and multiple service providers. This controller receives access requests from service providers, enforces pre-configured access policies, and automatically grants or denies access without requiring user intervention. The controller acts as a policy enforcement point that manages access to protected resources across multiple service providers centrally.
Solution Approach 2:
The patent implements preliminary action by requiring users to pre-configure their access policies and preferences before any service provider requests access. These policies are stored in the controller and automatically applied when access requests arrive. This eliminates the need for repeated user interventions during actual access requests, as the controller has already prepared the authorization rules in advance.
2Reliability
If users manually authorize each access request, then fine-grained control is possible, but operational burden increases and human errors occur
Solution Approach 1:
The patent implements self-service by enabling users to configure their own access policies and preferences in the controller. Once configured, the system automatically enforces these policies without requiring ongoing user intervention. The controller autonomously evaluates incoming access requests against the stored policies and makes authorization decisions, reducing both operational burden and potential for human error.
Solution Approach 2:
The patent incorporates feedback mechanisms where the controller monitors access requests and outcomes, and can notify users of unusual patterns or policy violations. This feedback loop enhances reliability by allowing users to review and adjust their policies based on actual usage patterns, while the automated enforcement maintains consistent application of access controls.
3Adaptability or versatility
If users set access policies for each service provider individually, then precise control is achieved, but system complexity increases
Solution Approach 1:
The patent implements universality by designing a single controller that can manage access policies for multiple service providers simultaneously. Instead of requiring separate policy management systems for each service provider, the controller provides a unified interface and centralized policy repository that handles access control across all service providers, reducing overall system complexity while maintaining fine-grained control capabilities.
Solution Approach 2:
The patent applies segmentation by separating the policy management function from individual service providers and consolidating it in a dedicated controller component. This segmentation allows users to manage all access policies in one place rather than dealing with multiple separate systems, reducing complexity while maintaining the ability to enforce granular access controls for each service provider through the centralized controller.
Data Source
AI summary
A method carried out by a controller is disclosed. The method includes receiving (s10) a message including a request token. A request token is a value used by a consumer (300) to request authorization from a user to access protected resources from a service provider (400). A service provider (400) is at least one of a software application and web site that is configured to provide access to protected resources. A consumer {300} is at least one of a software application and a web site that is configured to access a service provider (400) on behalf of a user. The method further includes determining (s20) whether the message meets policy settings governing the access to protected resources; and, if it is determined (s30) that the message does not meet the policy settings, preventing (s34) the request token from being forwarded to the service provider (400) associated with the request token.