Cloud Session Management via External Token Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional access control methods in cloud infrastructure face challenges such as the need for live connections to identity providers, vulnerability of user attribute information, and costly maintenance of ACL databases, which complicate session management and increase security risks.
Innovation Solution
Implementing a system that validates externally-generated security tokens, extracts claims, and creates internally-generated tokens for secure access to protected resources, eliminating the need for live connections and persistent storage, while using metadata mapping for selective release of user attributes to ensure privacy and reduce maintenance costs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the cloud service provider maintains local persistent storage for user identifiers and security attributes, then access control can be performed without live connections to identity providers, but the stored private user attribute information becomes directly vulnerable to security breaches
Solution Approach 1:
The patent extracts the user identifier from the security token and stores only this identifier locally in persistent storage, while the sensitive user attributes remain in the session object in memory. This separation reduces the vulnerability of stored data while maintaining access control functionality.
Solution Approach 2:
The session object containing user attributes is created temporarily in memory for the duration of the access control decision and then discarded. This ephemeral approach ensures that sensitive attribute information is not persisted long-term, reducing security risks while enabling access control.
2Reliability
If the cloud service provider maintains ACL databases for aliasing between user identifiers and local identifiers, then access control can be performed, but provisioning and maintaining these databases becomes costly and inefficient
Solution Approach 1:
The patent extracts the user identifier from the security token and uses it directly as the local identifier, eliminating the need for complex ACL databases that perform aliasing between different identifier systems. This simplification removes the maintenance burden while preserving access control functionality.
Solution Approach 2:
Instead of maintaining databases to map external identifiers to internal identifiers, the patent inverts the approach by using the external user identifier directly as the internal identifier. This reversal eliminates the need for mapping databases and their associated maintenance costs.
3Reliability
If conventional SSO approaches are used assuming ongoing validation with external identity providers, then security token validation can be performed, but it is not possible to maintain live connections to external identity providers in cloud environments
Solution Approach 1:
The patent performs preliminary validation of the security token by extracting and verifying the user identifier before creating the session object. This upfront validation ensures security without requiring ongoing live connections to external identity providers, simplifying session management.
Solution Approach 2:
The patent creates a session object that copies the essential authentication information from the validated security token. This session object serves as a local copy that enables subsequent access control decisions without requiring repeated validation with external identity providers.
Data Source
AI summary
An information processing system comprises one or more processing devices of at least one processing platform. In one embodiment, the system comprises cloud infrastructure that is configured to validate an externally-generated security token issued to a user, to extract one or more claims from the validated externally-generated security token, and to create a session object to hold the extracted claim or claims. The cloud infrastructure issues an internally-generated security token based on the session object that allows the user to be identified to a protected resource. The internally-generated security token is validated in conjunction with a request from the user for access to the protected resource, and information associated with at least one extracted claim is selectively released responsive to validation of the internally-generated security token. Access of the user to the protected resource is granted or denied based on the selectively-released information.