Claims-aware Role-Based Security Token Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security token systems lack a direct and efficient method to specify roles for resource access authorization, leading to complexities in enforcing permission status across multiple tiers of security token services.
Innovation Solution
A role-based security token is formulated by accessing claims, evaluating expressions to assign identities, and identifying role information that specifies the roles required for resource access, allowing the derivation of roles for permission enforcement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If security tokens include detailed role information for authorization, then authorization accuracy is improved, but token complexity increases
Solution Approach 1:
The patent segments role information into two types: direct role specifications and intermediate role information. Direct role specifications provide immediate authorization decisions, while intermediate role information can be further processed. This segmentation allows the token to include only the necessary role details for each authorization scenario, improving accuracy without always requiring full complexity.
Solution Approach 2:
The patent implements partial action by allowing security tokens to include either direct role specifications or intermediate role information, depending on the specific authorization needs. The relying party can process intermediate role information further if needed, or use direct specifications immediately. This partial inclusion of role information types reduces overall token complexity while maintaining authorization accuracy where needed.
2Reliability
If multiple tiers of security token services are used, then authentication capability is improved, but system complexity increases
Solution Approach 1:
The patent makes security tokens universal by designing them to work across multiple tiers of security token services. The same token structure with role information can be processed by first-tier services, second-tier services, and relying parties alike. This multi-functionality allows the token to traverse the multi-tier architecture without requiring different token formats at each level, reducing system complexity while maintaining authentication capability.
Solution Approach 2:
The patent uses intermediate role information as a mediator between different tiers of security token services. Instead of requiring direct role specifications at every tier, intermediate role information can be passed through multiple tiers, with each tier processing it according to its own policies. This intermediary mechanism simplifies interactions across the multi-tier system while preserving authentication capabilities.
3Productivity
If role information is directly specified in security tokens, then permission enforcement efficiency is improved, but information storage requirements increase
Solution Approach 1:
The patent applies partial action by including only the necessary role information directly in security tokens based on specific authorization needs. When direct role specification provides sufficient efficiency, it is included. When less information is needed, only intermediate role information is included, reducing storage requirements. This selective approach optimizes the balance between enforcement efficiency and storage requirements.
Data Source
AI summary
The formulation of a security token that specifies role information corresponding to one or more roles of a requesting entity that is to request an action to be performed on a resource. The formulation begins by accessing one or more claims, each having an expression regarding the requesting entity. The expression for at least one of the claims is evaluated to thereby assign the requesting entity to one or more identities. The identities are then used determine role information to include in a role-based security token that may be submitted to the computing system that manages the resources.