Claims-Based Security for Resource Store Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed networking environments, managing resource access and security across different organizations and providers is cumbersome due to the need for multiple security models based on Access Control Lists (ACLs), which becomes unmanageable, especially in large systems like the Internet, where applications must temporarily suspend access to configure security settings for various providers.
Innovation Solution
A claims-based security system where a resource store receives policy information to derive permissions for accessing secured resources, using identity information from claims submitted during sessions, and maps these permissions to corresponding resource types, allowing authorized operations while maintaining a unified security model across different providers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ACL-based security models are implemented for each resource provider, then resource access control is achieved, but system complexity and administrative burden increase significantly
Solution Approach 1:
The patent implements a universal security model where claims-based identity information can be used across multiple resource providers and access mechanisms. Instead of requiring each provider to implement its own ACL-based security, the system uses a common claims-based approach that works uniformly across databases, file systems, web services, and other resources, eliminating the need for multiple security implementations
Solution Approach 2:
The patent introduces an intermediary security layer that translates claims-based identity information into resource-specific access decisions. This intermediary mechanism sits between the user and various resource providers, handling authentication and authorization uniformly without requiring each provider to implement complex ACL systems directly
2Reliability
If applications must configure security settings for each provider, then access control is enforced, but productivity and ease of operation decrease
Solution Approach 1:
The patent performs security configuration in advance by establishing claims-based identity information during user authentication. Instead of requiring applications to configure security settings at the time of each resource access, the system pre-processes identity verification and stores claims that can be automatically applied when accessing any resource, eliminating repeated configuration steps
Solution Approach 2:
The system enables self-service by allowing applications to automatically use pre-established claims-based identity information without manual security configuration. Applications can independently authenticate and access resources using the claims already available in the system, without requiring administrative intervention or complex setup procedures
3Reliability
If multiple security models are maintained across different providers, then provider-specific security requirements are met, but ease of operation and adaptability decrease
Solution Approach 1:
The patent creates a universal claims-based security framework that can adapt to different resource types and providers while maintaining a consistent interface. The same claims-based mechanism works for databases, file systems, web services, and other resources, providing provider-specific security capabilities through a unified approach rather than requiring separate security models for each provider
Data Source
AI summary
The present invention extends to methods, systems, and computer program products for securing resource stores with claims-based security. From policy information, a resource store populates a security table of permissions. The permissions authorize resource access based on received claims. Sessions submit claims to the resource store. The resource store accumulates claims for a session into a claims list. From the claims list and the security table, the resource store filters out a subset of metadata including resource IDs for resources the session is authorized to access. Since the metadata corresponds to the session, any application using the session is given similar access to resources at the resource store.