Adaptive Trust Token System for Dynamic Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems, such as role-based access control (RBAC), struggle to provide secure, temporary, and adaptable access to computing systems, especially for service providers, due to complexity, inflexibility, and the inability to accommodate contextual information like location and time.
Innovation Solution
The implementation of a system that provides temporary access with adaptive trust levels, using claims-based authentication and tokens that include specific user information, permissions, and privileges, allowing for real-time adjustments based on user behavior and contextual factors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If role-based access control (RBAC) is implemented for service providers, then access control structure is established, but the system becomes cumbersome and requires constant adjustments when roles change
Solution Approach 1:
The patent implements dynamic access control by transitioning from static RBAC roles to context-aware temporary access tokens. The system dynamically generates tokens with specific permissions that automatically expire, allowing access to adapt to changing service provider roles without manual reconfiguration. This resolves the contradiction by making the access control system flexible and responsive to role changes while maintaining security.
Solution Approach 2:
The system changes the parameters of access control by introducing time-limited tokens with specific permission sets rather than permanent roles. Access permissions are defined by token parameters (expiration time, specific resources, actions) that can be easily adjusted without restructuring the entire access control system. This allows rapid adaptation to role changes while maintaining a simple management structure.
2Adaptability or versatility
If RBAC is used to provide access to service providers, then access permissions are granted, but the system cannot easily adapt to changes in user roles or needs
Solution Approach 1:
The patent employs disposable access tokens that are generated temporarily for specific service provider tasks. These tokens have limited lifetimes and can be easily revoked or renewed without affecting the underlying access control structure. This approach provides high adaptability to role changes while keeping the system easy to operate, as tokens can be quickly issued and revoked based on current service provider needs.
Solution Approach 2:
The system performs preliminary actions by pre-defining permission templates and access policies that can be rapidly applied to service providers. Instead of configuring individual permissions for each role change, the system has pre-configured permission sets that can be assigned via tokens, making the system both adaptable and easy to operate.
3Reliability
If service providers are accompanied inside the building or datacenter, then security is maintained, but employee time is consumed and work is lost
Solution Approach 1:
The patent implements self-service access control where service providers authenticate themselves using tokens that automatically enforce security policies. The system monitors and controls access without requiring employee accompaniment, allowing service providers to work independently while maintaining security. This resolves the contradiction by enabling automatic security enforcement that does not consume employee time.
Solution Approach 2:
The system provides continuous feedback through automated monitoring of token usage and access patterns. Security events are detected and responded to automatically by the system, eliminating the need for human accompaniment while maintaining security oversight. This allows employees to focus on productive work while the system handles security monitoring autonomously.
4Reliability
If RBAC is implemented with multiple roles, then comprehensive access control is achieved, but the system becomes stringent and fixed, unable to accommodate small variations in roles
Solution Approach 1:
The patent segments access permissions into fine-grained token attributes rather than monolithic roles. Each token can specify individual permissions for different resources and actions, allowing the system to provide comprehensive access control coverage while easily accommodating small variations in service provider needs by adjusting individual token parameters rather than restructuring entire roles.
Data Source
AI summary
One example method includes providing temporary access to a computing system and to providing temporary access as a service. The features of a temporary access can be defined by an entity and a user may be able to obtain a token that includes these features, which may be embedded in the token as claims. The user's access is then controlled in accordance with the embedded claims. The temporary access as a service can be federated. The token may include trust levels and tolerance limits. Further, aspects of the temporary access can be monitored and/or changed. Adjustments to trust levels can be automated or manually performed. Further trust for specific users can be gained or lost over time based on at least previous accesses.