Certificate-Based Authorization for Fast Remote Resource Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional authorization methods in computer security are inefficient and laborious, especially for remote users, and do not adapt well to micro-service architectures, requiring local policy databases and trusted third-party entities, leading to complex and slow authorization processes.
Innovation Solution
A certificate-based authorization mechanism that uses existing certificates like X.509 v3 to validate authenticity, eliminating the need for local authorization information and trusted third parties, and allowing authorization based on embedded security attributes within the certificate.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authorization methods are used with remote users, then security checks can be performed, but the authentication process becomes slow and laborious
Solution Approach 1:
The patent applies preliminary action by pre-computing and caching authorization results before they are actually needed. The system performs authorization checks in advance, stores the results in a cache, and retrieves them during actual request processing. This eliminates the need for real-time policy database queries, significantly reducing authentication time while maintaining security reliability.
2Adaptability or versatility
If policy database is remote, then centralized authorization control is achieved, but network contact is required for each request making the process inefficient
Solution Approach 1:
The patent applies copying by creating local copies of authorization data from the remote policy database and storing them in a local cache. Instead of contacting the remote database for every request, the system uses these local copies to perform authorization checks instantly. This maintains centralized control (as the cache is populated from the central database) while dramatically improving productivity by eliminating network latency.
3Speed
If local authorization information is required, then fast authorization is possible, but the need for local policy databases increases system complexity
Solution Approach 1:
The patent applies self-service by implementing a caching mechanism that automatically manages local authorization data. The system autonomously retrieves, caches, and updates authorization information without requiring manual configuration or complex local policy database management. This provides fast local authorization while minimizing system complexity through automated cache management.
4Reliability
If trusted third-party entities are used, then certificate verification is possible, but the authorization process becomes more complex
Solution Approach 1:
The patent applies merging by combining certificate verification and authorization decision-making into a single unified process. Instead of separately verifying certificates through trusted third parties and then checking authorizations, the system integrates both functions, using the certificate verification results directly to inform authorization decisions. This maintains reliability while reducing process complexity.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
An authorization method using provisioned certificates is disclosed. The method includes writing security attributes to fields within a certificate and issuing the certificate to a software application on a principal node. The software application requests to perform actions on one or more resources on a resource node, sending one or more action requests along with a copy of its certificate. The resource node has an agent which verifies the permissions from the certificate and routes the request to its designated resource. The resource node returns one or more messages to the principal node, verifying whether or not complete the requests.