Authorization Server Resource Identifier Resolution

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In multi-tenant systems, delegating authority using OAuth 2.0 is challenging when the client needs to access resources without knowing the resource owner, especially when the user managing the resource is unknown, making it difficult to request authority delegation by designating the user.

Innovation Solution

An authorization server system that receives a resource identifier from the client, resolves the resource owner, and issues an access token upon user confirmation, allowing the client to access the resource without specifying the user upfront.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If the client requests authority delegation by designating the user, then the authorization process can be completed, but the system cannot handle cases where the resource owner is unknown

Engineering Contradiction:

ImproveAbility to handle authorization requestsVSAvoidAuthorization process complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent introduces an authorization server as an intermediary between the client and resource server. The authorization server receives authorization start requests from clients, resolves resource owners using resource identifiers, and manages the authorization confirmation process. This intermediary handles the complexity of unknown resource owners, allowing clients to simply designate resources without needing to know the owner identity.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Extent of automation

If the user must access the client via web browser to delegate authority, then OAuth 2.0 authorization can be performed, but the client cannot autonomously request delegation in multi-tenant systems

Engineering Contradiction:

ImproveAutonomous authorization request capabilityVSAvoidUser access requirement

Core Design Contradiction:

Extent of automationVSEase of operation

Solution Approach 1:

The patent enables the client to autonomously initiate authorization requests without requiring user intervention to access the client. The client can send authorization start requests to the authorization server, which then resolves the resource owner and manages the confirmation process. This self-service capability allows clients to automatically request authorization delegation in multi-tenant systems.

Inventive Principle:

Principle #25Self-service

3Reliability

If the system requires knowing the resource owner to request authority delegation, then user-specific authorization can be performed, but the system cannot handle resources with unknown owners

Engineering Contradiction:

ImproveAuthorization accuracyVSAvoidResource access flexibility

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent inverts the traditional authorization approach by changing the request parameter from user identity to resource identifier. Instead of the client designating the user to access a resource, the client designates the resource itself. The authorization server then resolves the resource owner using the resource identifier and proceeds with the authorization confirmation process, enabling flexible resource access regardless of owner knowledge.

Inventive Principle:

Principle #13The other way round (Inversion)

Data Source

PatentUS11558391B2System, control method, and storage medium

Publication Date: 2023.01.17 CANON KK

AI summary

The client makes an authorization start request by designating a resource identifier. An authorization server receiving the authorization start request inquires a resource sever of a resource owner of the designated resource identifier. After resolving the resource owner, the authorization server makes an authorization confirmation request to a user terminal corresponding to the resolved user identifier.