Artifact Token Authorization for Cloud Service Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions for allowing applications to access cloud services without an active user token often violate the principle of least privilege, leading to security vulnerabilities by granting access to all users' cloud services.
Innovation Solution
The technique involves generating an artifact token that caches a user's permissions during an active user session, allowing the application to access the user's cloud service without an active user token, while ensuring that access is restricted to the user's own cloud service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the cloud storage service grants the meeting application access to every user's cloud storage folder, then the application can access cloud services without an active user token, but this violates the principle of least privilege and creates security vulnerabilities
Solution Approach 1:
The patent segments the authorization mechanism into two distinct token types: user tokens (tied to specific user sessions) and artifact tokens (independent of user sessions). This segmentation allows the application to operate with artifact tokens that reference specific user identities without requiring active user tokens, thereby maintaining security while enabling functionality. The authorization module validates artifact tokens by checking associated user identities against the allow list, ensuring granular access control.
Solution Approach 2:
The patent introduces artifact tokens as an intermediary mechanism between the application and cloud services. Instead of directly granting the application broad access permissions, the system uses artifact tokens that encapsulate specific user identity references. The authorization module acts as a mediator that validates these artifact tokens and enforces access control policies, allowing the application to access cloud services on behalf of specific users without compromising security.
2Reliability
If the application uses an active user token to access cloud services, then security is maintained, but the application cannot access services after the user logs off
Solution Approach 1:
The patent implements preliminary action by allowing users to pre-configure allow lists of applications that are permitted to access their cloud services via artifact tokens. During the active user session, the system validates the application against this pre-configured allow list and generates artifact tokens accordingly. This preliminary configuration enables the application to maintain access capabilities after the user logs off, while still enforcing security through the pre-established authorization rules.
3Adaptability or versatility
If the application is granted broad permissions to access any user's cloud service, then the application can function independently, but the principle of least privilege is violated
Solution Approach 1:
The patent applies local quality by making artifact tokens identity-specific rather than granting the application universal access permissions. Each artifact token is associated with a specific user identity and references a particular cloud service folder. The authorization module validates artifact tokens by checking the associated user identity against the allow list, ensuring that access permissions are localized to specific user-application pairs rather than granting broad, unrestricted access.
Data Source
AI summary
The techniques disclosed herein enable applications to seamlessly consume cloud-based services while minimizing exposure to security vulnerabilities. Specifically, an application is enabled to access a cloud service on behalf of a user without the user's active user token. Access is granted in a way that does not also grant access to any other user's cloud service. In some configurations, during an active user session, an artifact token is generated that caches the user's permissions. The artifact token may later be redeemed to gain access to the user's cloud service. For example, an application may request that a cloud service generate an artifact token. The request may be in response to a user scheduling the application to perform a task that depends on the cloud service. When the scheduled task is performed, the application may redeem the artifact token to access the user's cloud service.