Analytics Task Authorization Using Assignee Credentials
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing analytics computing systems face challenges in configuring automated tasks due to the need for administrative users to access sensitive data and model resources, which poses security risks and inefficiencies, as business users lack the technical knowledge to configure tasks and administrative users require broad access credentials.
Innovation Solution
The system employs an assignee user model where a creator user configures automated tasks using the credentials of an assignee user, with the analytics computing system managing authorization requests to ensure appropriate access levels, thereby allowing administrative users to execute tasks without direct access to sensitive resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If administrative users directly access sensitive data and model resources to configure automated tasks, then task configuration capability is improved, but security risk increases
Solution Approach 1:
The patent introduces an intermediary authentication mechanism that mediates between administrative users and sensitive resources. When an administrative user configures a task, the system automatically obtains temporary credentials through authentication with the resource provider, rather than using the administrative user's permanent credentials. This intermediary credential system allows task configuration while preventing direct exposure of administrative access rights to sensitive resources.
2Productivity
If business users are given access to configure automated tasks, then operational efficiency is improved, but technical knowledge requirements increase complexity
Solution Approach 1:
The patent enables business users to self-configure automated tasks through a simplified interface that abstracts away complex technical details. The system presents resource selection in terms of business-relevant categories and automatically handles credential management, authentication, and task configuration behind the scenes. This allows business users to configure tasks using their existing domain knowledge without requiring technical expertise in credential management or system architecture.
3Adaptability or versatility
If administrative users use broad access credentials to configure tasks, then task execution flexibility is improved, but unauthorized access risk increases
Solution Approach 1:
The patent segments access credentials into task-specific, limited-scope credentials rather than using broad administrative credentials. Each automated task is configured with credentials that provide only the minimum necessary access to specific resources required for that task's function. This segmentation ensures that even if credentials are compromised, the damage is limited to a single task's resource access rather than system-wide administrative access.
Solution Approach 2:
The patent dynamically changes credential parameters (scope, expiration, permissions) based on the specific task requirements. Instead of using static broad-access credentials, the system generates or selects credentials with parameters tailored to each task's needs - such as time-limited access, specific resource subsets, or restricted operation modes. This parameter customization maintains task execution flexibility while minimizing unauthorized access risk through principle of least privilege.
Data Source
AI summary
Various examples are directed to systems and methods for configuring an analytics computing system to perform an automated task. The computing system may receive from a first user computing device associated with a first user, a request to create a first automated task. The computing system may send a first authorization request to a first assignee user computing device associated with the first assignee user and receive a first reply message indicating that the first assignee user authorizes use of the credential of the first assignee user for the first automated task. The computing system may configure the first automated task to execute using the credential of the first assignee user upon occurrence of the first start condition for the first automated task.