Claims-Based Security Identity Model for Cross-Domain Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current enterprise security infrastructure struggles to enforce access control across different security domains, as symmetric key protocols like Kerberos are ineffective when clients and servers are in distinct domains, necessitating a federated model that requires establishing points of trust for identity verification.
Innovation Solution
A claims-based security model that represents identities as a set of claims, allowing for identity delegation and integration with existing .NET identity models, enabling secure access across multiple domains by abstracting authentication mechanisms and translating data models into CLR classes for .NET environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If symmetric key protocols like Kerberos are used for access control, then security verification can be established within a single domain, but the system cannot function across distinct security domains where no single KDC exists
Solution Approach 1:
The patent introduces a claims-based identity representation system that acts as an intermediary between different security domains. Instead of requiring direct trust relationships between domains, identities are represented as portable claims that can be verified across domain boundaries, enabling cross-domain access control without the complexity of traditional federated model point-to-point trust establishment
Solution Approach 2:
The patent segments the identity verification process into discrete claims that can be independently evaluated. Each claim represents a specific attribute or permission, allowing the system to verify individual aspects of identity across domains without requiring complete trust in the entire federated structure, thus reducing overall system complexity
2Adaptability or versatility
If a federated model is implemented to enable cross-domain access, then points of trust can be established in each domain, but the system complexity increases significantly
Solution Approach 1:
The patent creates a universal claims representation that can function across multiple security domains without requiring domain-specific adaptations. The same claims structure and verification mechanisms work uniformly across different domains, eliminating the need for complex point-to-point trust configurations and reducing federated model complexity while maintaining cross-domain verification capability
3Adaptability or versatility
If existing .NET identity models are maintained for backward compatibility, then existing applications continue to work, but integration with claims-based security model becomes complex
Solution Approach 1:
The patent creates a claims-based identity model that copies and extends the existing .NET identity model structure. By maintaining compatibility with the original identity representation while adding claims-based functionality, the system allows existing applications to continue working without modification while enabling new cross-domain security capabilities, thus reducing integration complexity
Data Source
AI summary
The claims based identity model provides a model which associates security identities with claims. The model represents information contained in the claims, as well as, captures relationships between the security identities described in the claims. Finally, the data model can be easily translated to the existing .NET environment without breaking the backward compatibility for existing .NET applications.