Cloud Data Access via User Impersonation Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
User-impersonation in cloud data providers often requires direct authentication and authorization at every logon attempt, is limited to a single provider, and may not ensure secure interfacing with cloud data providers.
Innovation Solution
A Security Token Service (STS) manages logon information and access requirements, using a Cluster Unique Identifier (CUID) to validate and store information, allowing seamless access to multiple cloud data providers without direct reoccurring authentication and authorization processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If direct authentication and authorization is performed at every logon attempt, then security is maintained, but operational complexity and time consumption increase
Solution Approach 1:
The system performs authentication and authorization in advance by obtaining access tokens during initial logon. These tokens are stored and reused for subsequent operations, eliminating the need for repeated authentication while maintaining security. The token refresh mechanism ensures long-term validity without requiring re-authentication.
Solution Approach 2:
The patent introduces an intermediary token system that mediates between the user and cloud data providers. Instead of direct authentication at every logon, the system uses stored access tokens and refresh tokens as intermediaries to authenticate and authorize subsequent access, reducing time consumption while maintaining security.
2Device complexity
If user-impersonation is limited to a single cloud data provider, then security management is simplified, but versatility and adaptability decrease
Solution Approach 1:
The patent implements a universal user-impersonation system that can interface with multiple cloud data providers (Snowflake, Google BigQuery, AWS Redshift, etc.) using a common token-based architecture. The same STS infrastructure and token management mechanisms work across different providers, achieving multi-functionality without proportionally increasing security management complexity.
3Productivity
If repeated authentication and authorization processes are eliminated, then productivity increases, but security risks may increase
Solution Approach 1:
Authentication and authorization are performed in advance to obtain access tokens that are stored for future use. This preliminary action enables subsequent operations to proceed without repeated authentication, improving productivity while maintaining security through the use of validated tokens.
Solution Approach 2:
The system implements periodic token refresh mechanisms where access tokens are renewed at intervals using refresh tokens. This periodic action maintains security by ensuring tokens remain valid and can be revoked if needed, while allowing continuous operation without repeated user authentication.
Data Source
AI summary
Disclosed herein are system, method, and computer-readable medium embodiments for securely accessing cloud data providers with user-impersonation. An embodiment operates by receiving an initial logon request for a cloud data provider. The embodiment authenticates the request using a cluster unique identifier (CUID) of the cloud data provider. The embodiment then authorizes the request by exchanging an authorization code for an identifier token and a refresh token issued by the cloud data provider. The embodiment then validates the tokens, and stores the refresh token for subsequent user-impersonation logons. Subsequently, the embodiment receives a user-impersonation logon request for the cloud data provider. The embodiment exchanges the refresh token for an access token issued by the cloud data provider, and uses the access token to gain access to the cloud data provider without a user directly having to complete authentication and authorization processes.