Cloud Authentication Tenant Linking for Dynamic Access Tokens

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cloud systems face inefficiencies and high operational risks when changing client information associations for access tokens, as pre-association with all tenants results in extensive work and potential errors.

Innovation Solution

A cloud system that manages user, client, and issued information to issue access tokens using client information not pre-associated with tenants, allowing dynamic addition of client information to management databases based on user and issued information associations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If client information is pre-associated with all tenants in the client management information, then access token issuance is straightforward, but the work amount increases significantly and operational errors may occur

Engineering Contradiction:

Improveaccess token issuance reliabilityVSAvoidclient information management time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary registration of client information in the issued information management information before actual tenant access requests occur. This allows the system to have client information ready in advance without requiring pre-association with specific tenants, reducing both work amount and error risks while maintaining reliable access token issuance.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The issued information management information acts as an intermediary between client information and tenant associations. Instead of directly associating client information with all tenants (which increases work and error risks), the system uses the issued information management information as a intermediate layer to manage client information, enabling efficient access token issuance without extensive pre-association work.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If client information is pre-associated with all tenants, then access tokens can be issued to any tenant, but the system complexity and operational risks increase

Engineering Contradiction:

Improveaccess token issuance flexibilityVSAvoidclient management information complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system segments client information management into two separate components: client management information (for registered clients) and issued information management information (for issued client information). This segmentation allows the system to maintain flexibility in issuing access tokens to multiple tenants without requiring complex pre-association logic, as the issued information management information independently tracks which clients have been issued access tokens for which tenants.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The issued information management information serves as an intermediary that decouples the relationship between client management information and tenant associations. This intermediary layer enables the system to issue access tokens flexibly across tenants without directly embedding complex association logic in the client management information, thereby reducing system complexity while maintaining versatility.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Ease of operation

If the system checks only client management information for tenant associations, then the process is simple, but clients not pre-associated cannot access tenants

Engineering Contradiction:

Improveclient access convenienceVSAvoidinformation management structure

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

The system merges two information sources for client verification: client management information (for client registration status) and issued information management information (for access token issuance records). By combining these two sources, the system enables clients not pre-associated with specific tenants to still access tenants if they have been issued access tokens, improving ease of operation while the structured merge of information sources keeps the complexity manageable.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS20260064880A1Cloud system

Publication Date: 2026.03.05 KYOCERA DOCUMENT SOLUTIONS INC

AI summary

A service providing system, in a case in which user information in an authentication request for accessing a specific tenant transmitted from a specific client exists in user management information in association with the target tenant, and client information in the authentication request does not exist in the client management information in association with the target tenant, and this client information exists in issued information management information, adds this client information to the client management information in association with the target tenant, and notifies the client of an access token.