Cloud Federated Token Just In Time Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional identity and access governance implementations, such as Role Based Access Control (RBAC) or Attribute Based Access Control (ABAC), are insufficient for managing cloud resources effectively, leading to high-profile cyber breaches due to misconfigured access in the cloud.
Innovation Solution
The implementation of cloud federated token just in time authorization systems, which involve receiving authenticating information from an active directory federation service, querying backend services for validation, and generating a security token with session limits that are enforced by a trusted federated endpoint.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional identity and access governance implementations (RBAC or ABAC) are used, then access control is simplified, but cloud resource security is insufficient leading to cyber breaches
Solution Approach 1:
The patent implements dynamic access tokens with time-limited sessions instead of static RBAC/ABAC permissions. The federation service generates tokens that automatically expire after a specified duration, and the cloud platform continuously validates token authenticity. This dynamic approach ensures that even if credentials are compromised, the window for unauthorized access is limited, directly addressing the security insufficiency of traditional static access control models.
Solution Approach 2:
The patent introduces a federation service as an intermediary between the active directory and the cloud platform. This federation service acts as a trusted third party that issues federated tokens, validates authentication requests, and enforces security policies. The intermediary architecture allows traditional identity systems to securely integrate with cloud resources without requiring complex direct integration, thereby improving security while managing complexity.
2Reliability
If cloud federated token just in time authorization is implemented, then cloud resource security is enhanced, but system complexity increases
Solution Approach 1:
The patent implements preliminary authentication and token issuance before actual resource access. The federation service pre-validates user credentials against the active directory and issues federated tokens with embedded security policies and time limits. This preliminary action ensures that authentication is performed once beforehand, eliminating the need for repeated complex validation during each resource access operation, thereby enhancing security while managing system complexity.
Solution Approach 2:
The cloud platform is configured to automatically validate federated tokens and enforce session limits without requiring manual intervention. The system self-manages token verification, session monitoring, and automatic expiration. This self-service capability reduces the operational complexity of managing enhanced security, as the system autonomously handles the complex authorization decisions that would otherwise require manual security management.
3Reliability
If session limits are enforced on cloud platform, then unauthorized access risk is reduced, but user access flexibility is limited
Solution Approach 1:
The patent changes the parameter of session duration from indefinite to time-limited by embedding expiration timestamps in federated tokens. The federation service configures specific time limits based on security requirements and user roles. This parameter change automatically enforces session limits, reducing unauthorized access risk while maintaining user flexibility within the defined time window. Users retain full access rights during the valid session period, so operational flexibility is preserved within security boundaries.
Data Source
AI summary
Systems and methods for cloud federated token just in time authorization are disclosed. A method may include: (1) receiving, by a cloud authentication services computer program, authenticating information for a user from an active directory federation service computer program; (2) querying, by the cloud authentication services computer program, a plurality of backend services to validate the authenticating information; (3) communicating, by the cloud authentication services computer program, validation to the active directory federation service computer program, wherein the active directory federation service computer program is configured to generate a security token comprising one or more assertion, wherein the assertion comprises a limit on a session with the user at a cloud platform, and wherein the cloud platform is configured to receive the security token and a trusted federated endpoint executed by the cloud platform is configured to enforce the limit on the session.