Cloud Platform Third-Party Application Access Token Binding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for users to visit third-party applications via a cloud platform are complex and insecure, requiring frequent input of third-party application account and password information, which increases the risk of information security breaches during transmission.
Innovation Solution
A system and method where the cloud platform receives user input for cloud platform account and password, searches a binding information mapping table to obtain third-party application account information and access information (such as access tokens or encrypted passwords), and transmits this information to the third-party application server for authentication, without storing or transmitting cleartext passwords, using the OAUTH protocol to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the user inputs third-party application account and password information each time to visit a third-party application, then the authentication security is maintained, but the operation complexity increases and user convenience deteriorates
Solution Approach 1:
The system performs preliminary binding between cloud platform account information and third-party application account information in advance. When a user visits a third-party application, the cloud platform server automatically retrieves the pre-bound third-party application account information and access tokens, eliminating the need for users to manually input credentials each time while maintaining security through server-side authentication.
2Ease of operation
If the cloud platform saves and transmits cleartext passwords for third-party applications, then the authentication process is simplified, but the information security risk increases
Solution Approach 1:
The invention extracts and removes the cleartext password from the authentication process. Instead of transmitting plain text passwords, the system uses access tokens (such as OAuth tokens) that do not contain sensitive password information. The cloud platform server retrieves and transmits only the necessary access information, leaving the actual passwords stored securely on the third-party application server where they are needed for authentication verification.
Solution Approach 2:
The system introduces an intermediary mechanism using access tokens as a mediator between the cloud platform and third-party applications. These tokens serve as secure proxies that allow authentication without exposing actual passwords. The tokens are transmitted through the cloud platform server, enabling seamless authentication while maintaining security by never exposing cleartext passwords during transmission or storage on the cloud platform.
3Ease of operation
If the cloud platform binds cloud platform account information with third-party application account information, then user convenience is improved and operation complexity is reduced, but the system complexity increases
Solution Approach 1:
The system implements self-service functionality where the cloud platform server automatically manages the binding process between cloud platform accounts and third-party application accounts. The server autonomously retrieves, stores, and manages access tokens without requiring manual user intervention for each binding operation. This automation reduces the perceived complexity for users while the system handles the underlying complexity through automated token management and binding operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and a method for visiting a third party application through a cloud platform are disclosed. The method includes: receiving a cloud platform account and cloud platform password information inputted by a user; searching a stored binding information mapping table according to a third party application selected by the user to obtain the third party application and obtain access information not comprising cleartext password corresponding to the cloud platform account information, and transmitting the access information to the third party application server; and receiving authentication succeed information returned by the third party application server. According to the present disclosure, complexity of user's operations may be reduced when the user logs on frequently and security level of the user for visiting the third party application may be improved.