Cross-Realm Proxy Authorization Using Resource Principal Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack the ability to enforce fine-grained authorization policies for cross-realm access requests in distributed computing environments, particularly in cloud platforms like Oracle Cloud Infrastructure, where entities from one realm seek access to resources in a different realm, and their identities are unknown.
Innovation Solution
A method involving a resource principal checker is used to generate a resource principal token and session token based on predefined policies, enabling authorization for cross-realm operations, and a proxy service establishes a trusted connection to project identities across realms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cross-realm access requests are allowed without identity projection, then system simplicity is maintained, but fine-grained authorization control is lost
Solution Approach 1:
The patent introduces a proxy service as an intermediary component that receives cross-realm requests, projects the requesting entity's identity into the target realm, and forwards the request with proper authentication. This mediator enables fine-grained authorization control without requiring direct integration between realms, thus maintaining system simplicity while achieving reliable authorization.
Solution Approach 2:
The system segments the cross-realm access control into distinct functional components: the proxy service that handles identity projection, the token generation mechanism, and the policy enforcement layer. This segmentation allows each component to be optimized independently and simplifies the overall system architecture by distributing complexity across specialized modules.
2Reliability
If identity projection mechanisms are implemented, then fine-grained authorization is enabled, but processing overhead increases
Solution Approach 1:
The proxy service performs identity projection and token generation as preliminary actions before the actual resource access operation. By pre-establishing the authenticated identity context and validating authorization policies in advance, the system avoids repeated authentication overhead during the actual resource operations, thus reducing overall processing time while maintaining accurate authorization control.
3Reliability
If resource principal tokens are generated for each request, then secure authorization is achieved, but computational overhead increases
Solution Approach 1:
Instead of creating entirely new authentication mechanisms, the system generates resource principal tokens that are cryptographic copies or projections of the original entity's identity credentials. These token copies contain the necessary authorization information to access resources in the target realm without requiring the original credentials, thus maintaining security while reducing computational overhead compared to full authentication ceremonies.
Data Source
AI summary
Techniques are disclosed for using a proxy service to generate resource principals corresponding to a cross-realm request. A request to perform an operation in a target realm (TR) may be received by the proxy service of a host realm (HR). The request may comprise identity data that indicates an identifier of the requestor in one or more identity realms (e.g., in at least the TR). The proxy service of the HR may establish a trusted connection with a proxy service of the TR. The proxy service of the HR may transmit request data that indicates the identity of the requestor within the TR, causing the proxy service in the TR to generate a resource principal object corresponding to the identity of the requestor in the TR, whereby the resource principal object is used to execute (or to attempt execution of) the requested operation in the TR.