Cloud Storage Authorization Bridging via Token Scope Translation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing environments face challenges in determining user authorization for data access when on-premises and off-premises computing systems have unique authorization processes, leading to cumbersome management of authorization standards and security policy enforcement.
Innovation Solution
A proxy system that bridges authorization standards by extracting access scopes and contexts from on-premises tokens, determining user permissions, and generating compatible tokens for cloud environments, ensuring secure data access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If on-premises authorization servers remain on-premises when data is stored in cloud-based storage, then security control and authorization management are maintained, but intimate integration between authorization servers and data storage hardware is eliminated, requiring additional verification steps
Solution Approach 1:
The patent introduces a token-based intermediary mechanism that bridges on-premises authorization servers and cloud-based storage. The authorization server generates tokens containing authorization information that can be verified by cloud storage systems without requiring direct integration or additional verification steps, thus maintaining security while simplifying the authorization process.
Solution Approach 2:
The authorization process is segmented into distinct components: token generation by the on-premises authorization server, token transmission to the cloud storage system, and token verification by the cloud storage system. This segmentation allows each component to operate independently while maintaining secure authorization control.
2Reliability
If multiple unique authorization servers with different authorization processes are used, then specific security requirements for each system are met, but managing authorization standards becomes cumbersome
Solution Approach 1:
The patent implements a universal token format that can be used across multiple authorization servers and cloud storage systems. The token structure includes standardized fields for user identification, authorization scope, and validity period, allowing different authorization servers to issue compatible tokens that can be verified by various cloud storage systems, thereby simplifying authorization management while maintaining system-specific security requirements.
3Reliability
If on-premises tokens are used directly in cloud environments, then user authentication is maintained, but token format incompatibility prevents direct access to cloud storage
Solution Approach 1:
The patent transforms on-premises tokens into cloud-compatible format by changing specific parameters while preserving authentication information. The token transformation includes encoding authorization data in a standardized format, adding cloud-specific metadata fields, and ensuring the token structure meets cloud storage system requirements, thereby maintaining user authentication while achieving cross-platform compatibility.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A computer-implemented method (500) includes receiving, from a user account (10), an operation request (102) to perform an operation on data (162) stored at a distributed computing environment (140). The operation request includes an on-premises token (152) associated with the user account. The method also includes extracting, from the on-premises token, an access scope (212) associated with permissions of the user account for accessing the data stored at the distributed computing environment. The method also includes translating the extracted access scope into query parameters (222) compatible with the data stored at the distributed computing environment. The method also includes determining, using the query parameters, whether the operation request can access the data stored at the distributed computing environment. When the operation request can access the data stored at the distributed computing environment, the method includes executing the operation request.