Cloud Credential Issuance Using Temporary Keys Across Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud service providers face issues with credential keys being hard-coded in source code, leading to potential leaks and increased burden for developers to manage temporary credentials, which can result in unintended errors and security risks.
Innovation Solution
A method and apparatus that enables a computing system to issue temporary credentials on behalf of users for various cloud services, allowing selection and management of credential keys through a user interface, with options for valid periods and automatic deletion, thereby reducing the need for hard-coding and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a credential key is hard-coded in source code, then unintended errors or credential failures are prevented during credential process, but the credential key may be leaked when source code is exposed
Solution Approach 1:
The patent extracts the credential key from the source code and stores it separately in a credential management system. The source code only contains a credential identifier, while the actual credential key is retrieved from an external credential store during runtime, preventing exposure in the source code while maintaining reliability.
Solution Approach 2:
The patent introduces a credential management system as an intermediary between the source code and the actual credential key. This mediator retrieves and manages credential keys separately, allowing the source code to reference credentials without containing them, thus preventing leakage while ensuring reliable access.
2Object-affected harmful factors
If a temporary credential is used to prevent leaked key from being continuously utilized, then security is improved, but obtaining temporary credential becomes another burden on the developer
Solution Approach 1:
The patent implements automatic credential retrieval where the system automatically obtains and manages temporary credentials based on stored credential identifiers. The developer only needs to configure the credential identifier once, and the system handles automatic authentication and credential retrieval, eliminating repetitive manual operations while maintaining security.
Solution Approach 2:
The patent performs preliminary credential configuration by storing credential identifiers and authentication information in advance. When credential retrieval is needed, the system automatically uses these pre-configured credentials to obtain temporary access tokens, eliminating the need for developers to manually obtain credentials each time while ensuring security through automatic temporary credential usage.
3Adaptability or versatility
If multiple cloud service credentials are managed separately, then each service can be accessed independently, but the management burden and system complexity increase
Solution Approach 1:
The patent creates a universal credential management system that can handle multiple cloud service credentials through a unified interface. The system stores credential identifiers for different cloud services and automatically retrieves appropriate credentials based on service requirements, enabling multi-cloud access without requiring separate management mechanisms for each service.
Solution Approach 2:
The patent merges the management of multiple cloud service credentials into a single credential management system. Instead of maintaining separate credential stores and retrieval mechanisms for each cloud service, the system combines them into one unified repository with automated selection and retrieval logic, reducing overall complexity while maintaining adaptability to various cloud services.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for providing a credential service may include transmitting, to a user terminal, data of a request page including a cloud service selection field for selecting one cloud service from a list of a plurality of cloud services; receiving, from the user terminal, a request for issuing a temporary key for a credential for calling an API served by a second cloud service selected in the cloud service selection field; transmitting an account issuance request signal to a system of the second cloud service in response to the receiving the request for issuing the temporary key; receiving credential key information for a first account issued to an institution, from the system of the second cloud service in response to the transmitting the account issuance request signal; and transferring the credential key information to the user terminal in response to the request for issuing the temporary key.