Client Certificate Translation to Authorization Graph Descriptors

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cloud environments face challenges in integrating technical clients that do not support OAuth2 flows and require deeper verification of client identity for security-critical resources, as client certificates are non-stable and unsuitable as direct authorization descriptors.

Innovation Solution

A cloud computing environment translates client certificates into authorization graph descriptors, which are used to traverse a certificate repository and generate an access token, enabling authentication without additional HTTP requests and abstracting complexity from the business application.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If client certificates are used for authentication at the TLS level, then security verification of client identity is improved, but the non-stable nature of certificates makes them unsuitable as direct authorization descriptors

Engineering Contradiction:

Improveclient identity verificationVSAvoidcertificate stability

Core Design Contradiction:

ReliabilityVSStability of the object's composition

Solution Approach 1:

The patent introduces an intermediary component that translates unstable client certificates into stable authorization graph descriptors. This mediator converts the dynamic certificate data into a stable representation that can be reliably used for authorization decisions, resolving the contradiction between needing reliable identity verification and the instability of certificates themselves.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system changes the parameter representation from raw certificate data (which is unstable) to authorization graph descriptors (which are stable). By transforming the data into a different parameter space, the system maintains the security benefits of certificate verification while achieving the stability needed for consistent authorization decisions.

Inventive Principle:

Principle #35Parameter changes

2Adaptability or versatility

If OAuth2 flows are used for technical clients, then authorization can be obtained, but clients that do not support OAuth2 flows cannot integrate with the application

Engineering Contradiction:

Improveclient integration capabilityVSAvoidauthentication flow complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent implements a universal authentication mechanism that works for all technical clients regardless of whether they support OAuth2 flows. By using TLS-level certificate authentication as the base mechanism and translating certificates to authorization descriptors, the system provides multi-functional support for different client types without requiring each client to implement specific authentication protocols.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Reliability

If additional HTTP requests are made for OAuth2 authentication, then authorization tokens can be obtained, but performance is reduced in time-critical use cases

Engineering Contradiction:

Improveauthorization verificationVSAvoidauthentication performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system performs preliminary translation of client certificates into authorization graph descriptors at the TLS level, before any application-layer processing occurs. This preliminary action eliminates the need for additional HTTP requests to obtain authorization tokens, as the authorization information is already available and verified in the authorization graph descriptor, thus improving performance while maintaining verification reliability.

Inventive Principle:

Principle #10Preliminary action

4Ease of operation

If client certificates are used directly as authorization descriptors, then authentication is simplified, but the non-stable nature of certificates causes issues during runtime changes and revocations

Engineering Contradiction:

Improveauthentication simplicityVSAvoidauthorization consistency

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent creates a stable copy or representation of the client certificate information in the form of an authorization graph descriptor. Instead of using the original unstable certificate directly, the system creates a derived representation that captures the essential authorization information in a stable form, maintaining ease of operation while ensuring authorization consistency even when certificates change or are revoked.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS11503013B2Translation of client certificate authentication into authorization graph descriptors

Publication Date: 2022.11.15 SAP SE

AI summary

A cloud computing environment receives a request from a client. The request relates to access of an application executing in the cloud computing environment and it encapsulates a certificate. This certificate is then translated into an authorization graph descriptor which, in turn, is used to traverse a certificate authorization graph to identify a match within a certificate repository. In response to the identification of the match, an access token is requested including the authorization graph descriptor. The access token is then encapsulated in the request which is then forwarded to an authentication service which provides access to the application if there is a match of the authorization graph descriptor against pre-defined authorization requirements. Related apparatus, systems, techniques and articles are also described.