Cloud Identity Gateway for Session-Bound User Credential Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional identity management in heterogeneous cloud computing systems faces inefficiencies and vulnerabilities due to the use of service identities, leading to over-provisioned permissions, computational overhead, network latency, and security risks, particularly in managing end-user access across multiple cloud platforms.
Innovation Solution
Implementing session-bound credential management through an Authorization Gateway that negotiates individual user identities, optimizing credential retrieval and caching, and eliminating persistent connections to reduce memory leaks and computational overhead, while enhancing security and performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If service identities are used to aggregate permissions for multiple end-users, then access control is simplified, but individual user traceability and fine-grained access control are lost
Solution Approach 1:
The patent segments the aggregated service identity into individual user identities. Each end-user is assigned their own identity credentials (client ID, client secret, refresh token) instead of sharing a common service account. This segmentation enables individual user traceability while maintaining simplified access control through automated credential management.
2Reliability
If persistent connections with over-provisioned permissions are maintained, then continuous access is ensured, but computational overhead and memory consumption increase
Solution Approach 1:
The patent implements dynamic credential management where connection persistence is adjusted based on session state. The system maintains credentials in memory during active user sessions for reliable access, but automatically invalidates and removes credentials when sessions end. This dynamic approach ensures continuous access during needed periods while reducing computational overhead and memory consumption when not in use.
3Reliability
If multiple authentication handshakes are performed for each cloud platform, then platform-specific security requirements are met, but network latency increases
Solution Approach 1:
The patent performs preliminary authentication by obtaining access tokens and refreshing credentials in advance during user sessions. The system proactively manages credential lifecycles by refreshing tokens before they expire and maintaining them in memory for quick access. This preliminary action reduces network latency during actual resource access operations while still meeting platform-specific security requirements through proper authentication protocols.
4Stability of the object's composition
If service accounts remain active after end-user session termination, then connection stability is maintained, but security vulnerabilities and resource waste occur
Solution Approach 1:
The patent implements automatic credential invalidation and disposal when end-user sessions terminate. The system discards stored credentials (client ID, client secret, refresh token) associated with terminated sessions and recovers system resources by removing them from memory. This approach eliminates security vulnerabilities from orphaned credentials while maintaining connection stability during active sessions through proper credential lifecycle management.
Data Source
AI summary
A method for managing credentials in a heterogeneous cloud computing system, includes receiving, at a local computing system, a request to access a cloud resource on behalf of an end user, the request including a unique identifier associated with the end user and a resource identifier associated with the cloud resource, identifying, using the resource identifier, a predefined procedure for obtaining credentials for accessing the cloud resource, performing the predefined procedure to obtain the credentials for accessing the cloud resource, and accessing the cloud resource on behalf of the end user using the credentials.