Remote Access Token Scheduling With Bifurcated Credential Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in managing and securing access credentials for cloud resources, particularly when scheduling actions, as they often require multiple retrievals from secrets managers, increasing security vulnerabilities.
Innovation Solution
A bifurcated security approach is implemented using a supplemental security application that authenticates users during onboarding with access tokens based on public data, allowing scheduled actions without exposing secured access credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If access credentials are stored by cloud resources to enable authentication and authorization, then user data can be accessed and services can be provided, but security vulnerabilities increase due to exposure to cyber attacks
Solution Approach 1:
The patent extracts the authentication verification process from the cloud resource itself and relocates it to a supplemental security application. The cloud resource only receives and validates access tokens without storing sensitive credentials, separating the credential storage function from the authentication function to reduce security vulnerabilities.
Solution Approach 2:
The patent introduces a supplemental security application as an intermediary between the user and the cloud resource. This intermediary handles credential verification using public data and issues access tokens, preventing direct exposure of sensitive credentials to the cloud resource while still enabling authentication.
2Reliability
If secrets managers are used to securely store and manage access credentials, then security is improved, but the system complexity increases and multiple retrievals are required for scheduled actions
Solution Approach 1:
The patent creates a simplified copy of the authentication mechanism in the supplemental security application. Instead of relying on complex secrets manager infrastructure, the system uses public data to verify credentials and generates access tokens that can be stored and reused for scheduled actions, reducing system complexity while maintaining security.
Solution Approach 2:
The patent performs credential verification in advance during the authentication process and stores the result in the form of an access token. This preliminary action eliminates the need for multiple retrievals from secrets managers when scheduled actions need to execute, as the access token can be reused without requiring repeated credential access.
3Reliability
If access credentials are retrieved multiple times from secrets manager for scheduled actions, then authentication can be verified, but security exposure increases and performance decreases
Solution Approach 1:
The patent performs credential verification in advance and stores the authentication result in an access token that can be reused for scheduled actions. This eliminates the need for multiple retrievals from secrets managers, improving both security by reducing credential exposure and productivity by enabling efficient scheduled action execution.
4Reliability
If unique access credentials are required for each cloud resource access, then security is maintained, but credential management becomes infeasible as the number grows
Solution Approach 1:
The patent creates a universal authentication system where a single supplemental security application handles credential verification for multiple cloud resources. The access token generated by this universal system can be used across different scheduled actions and cloud resources, eliminating the need to manage unique credentials for each resource while maintaining security through the bifurcated approach.
Data Source
AI summary
Systems and methods for scheduling actions in remote networking environments while minimizing exposure of secured access credentials using a bifurcated security approach. The system may receive confirmation of a first verification that the first user is authorized to access the remote server. The system may, after providing access to the remote server, receive and schedule a first action. The system may generate a first access token for the remote server, wherein the first access token is specific to the first user. The system may authorize, via a second verification, the first action based on determining that the first access token is currently valid.