Cloud Access Manager Token Generation for Security Zones
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face difficulties in providing efficient access rights for applications to data across multiple users with different security access levels on cloud platforms, as each user has unique credentials, making it challenging to implement read and write access.
Innovation Solution
A method and system where an access manager module on the cloud platform determines and generates access tokens based on the registration of applications and user relationships, allowing applications to access data stored in a security data zone by retrieving credentials and issuing a second access token for processing data, including IoT data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If each user provides unique credentials for every application, then data security is maintained, but system complexity and ease of operation deteriorate
Solution Approach 1:
The patent introduces an access manager as an intermediary component that sits between users and data storage zones. This access manager handles credential verification and token generation, allowing applications to access user data without requiring direct user credentials. The access manager mediates the authentication process by issuing temporary access tokens that grant controlled access to security data zones, thereby maintaining security while simplifying the operational complexity of managing multiple user credentials.
2Reliability
If user credentials are stored for each application, then access control is precise, but device complexity increases
Solution Approach 1:
The patent extracts the credential storage and management functionality from the application layer and places it in the access manager component. Instead of each application storing and managing user credentials, the access manager centralizes this function. The access manager stores user credentials securely and issues temporary access tokens to applications, thereby reducing the credential storage complexity in individual applications while maintaining precise access control through token-based authentication.
3Reliability
If access tokens are generated dynamically, then security is improved, but processing time increases
Solution Approach 1:
The patent implements preliminary action by pre-generating and caching access tokens in the access manager before they are needed. When users authenticate, their access tokens are prepared and stored in advance in the access manager's credential storage. When an application needs to access user data, the access manager can quickly retrieve pre-generated tokens rather than creating them from scratch, thereby maintaining security through dynamic tokenization while reducing the processing time required for token generation.
Data Source
AI summary
A method and a system for providing access by an application to data stored in a security data zone of a cloud platform are provided. The method includes determining, in response to a query received from a querying application of the cloud platform, credentials for a security data zone based on determining whether a first access token included in the received query belongs to an application registered at an access manager module of the cloud platform, and whether the user specified in the received query is allowed to use the registered application. The method also includes determining a second access token to the querying application generated based on the determined credentials. The querying application uses a returned second access token to obtain access to data stored in the security data zone to be processed by the querying application.