Authorization Module for On-Demand Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In on-demand computing environments using OAuth authorization protocols, there is a lack of administrative control over access to protected data resources, as the protocol assumes the end user is the owner and does not allow organizations to restrict access effectively.
Innovation Solution
An authorization module manages protected data resources, allowing administrators to establish access protocols that dictate who can access the data, generating access tokens without revealing user credentials, and enforcing these protocols to control data access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If OAuth authorization protocol is used to enable access to protected data resources, then data access convenience is improved, but organizational administrative control over access is lost
Solution Approach 1:
The system segments access control into two distinct layers: (1) OAuth protocol layer for authentication and basic access token generation, and (2) Organizational policy layer for administrative control and access restriction. This segmentation allows the OAuth protocol to handle authentication conveniently while the organizational layer independently enforces access policies without interfering with the authentication process.
Solution Approach 2:
The patent introduces an intermediary access control mechanism that sits between the OAuth authorization protocol and the protected data resources. This intermediary layer receives access tokens from OAuth, validates them against organizational policies, and makes final access decisions. It acts as a mediator that preserves OAuth's convenience while adding organizational control capabilities.
2Adaptability or versatility
If end user authorization is used to grant access, then user autonomy is improved, but organizational security restrictions are compromised
Solution Approach 1:
The system performs preliminary action by establishing organizational access policies and restrictions before any user authorization occurs. Access control rules, permission hierarchies, and security constraints are pre-configured at the organizational level. When users seek access, their requests are automatically evaluated against these pre-established policies, ensuring organizational security requirements are met before user autonomy is exercised.
Solution Approach 2:
The patent implements a feedback mechanism where user authorization requests are continuously evaluated against organizational policies. The system provides feedback by automatically denying access when organizational restrictions are violated, even if the user has OAuth authorization. This feedback loop ensures that user autonomy operates within organizational security boundaries.
Data Source
AI summary
A system is provided for managing protected data resources. The system includes a resource server configured to store the protected data resources and an authorization module coupled to the resource server and configured to store access protocols. The authorization module further is configured to receive a service request from a user via a client module, evaluate the service request based on the access protocols, and send an access token to the client module if the user satisfies the access protocols.