Central Authorization Server for Multiworkflow Token Reuse
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems require complex procedures for authorization between workflows, especially in REST API scenarios, involving multiple token issuances and maintenance of long lists of trusted service accounts, which is inefficient and resource-intensive.
Innovation Solution
A central authorization server manages trust relationships between workflows, providing a flexible and extensible authorization policy that simplifies token management and authorization processes across multiple workflows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a service account is used for workflow A to call workflow B in REST API scenario, then authorization can be achieved, but workflow B needs to maintain a long list of trusted service accounts which requires continuous updating and increases system complexity
Solution Approach 1:
The patent introduces an authorization server as an intermediary between workflows. Instead of workflow B directly managing trust relationships with multiple service accounts, the authorization server mediates by validating tokens issued to workflow A. This eliminates the need for workflow B to maintain a long list of trusted service accounts, reducing system complexity while maintaining security.
Solution Approach 2:
The patent implements a universal token-based authorization mechanism that works across all workflow interactions. A single token issued by the authorization server can be used by workflow A to access multiple different workflows (workflow B, workflow C, etc.), eliminating the need for separate service accounts and trust relationship configurations for each workflow pair.
2Reliability
If separate tokens are issued for each workflow access to maintain security boundaries, then security is improved, but the authorization procedure becomes complex and requires collaboration between multiple workflows
Solution Approach 1:
The patent creates a universal token that maintains security boundaries while simplifying operations. The single token issued by the authorization server can be used across multiple workflows, eliminating the need for complex multi-step token issuance and browser redirection procedures while preserving security through centralized validation.
Solution Approach 2:
The patent extracts the complex token management and security boundary enforcement logic from individual workflows and centralizes it in the authorization server. This allows workflows to simply validate tokens without implementing complex authorization procedures, reducing operational complexity while maintaining security.
3Adaptability or versatility
If hundreds of workflows need to call workflow B, then service coverage is improved, but workflow B needs to maintain a long list of service accounts which increases resource overhead
Solution Approach 1:
The patent implements a universal token system where a single token can authorize access across hundreds of workflows. Instead of workflow B needing to maintain separate service accounts for each calling workflow, the authorization server validates tokens from any authorized workflow, enabling high adaptability with minimal resource overhead.
Solution Approach 2:
The patent merges the function of hundreds of individual service accounts into a single token-based authorization mechanism. The authorization server consolidates trust relationship management, allowing workflow B to interact with numerous workflows without maintaining a large number of service account credentials, significantly reducing resource overhead.
Data Source
AI summary
A central authorization system comprising i) a plurality of application programming interfaces that receive authorization requests from a plurality of frameworks that execute workflows and ii) an authorization policy server. The authorization policy server receives from a first framework a first authorization request for access to a service by a first workflow, the first authorization request comprising a first token associated with the first workflow. The authorization policy server receives from a second framework a second authorization request for access to the service by a second workflow, the second authorization request including the first token. The authorization policy server determines whether the first token provides for authorizing access to the service by the second framework.