Cross-Realm Authorization Using Projected Identities and Resource Principals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack the ability to enforce fine-grained authorization policies for cross-realm access requests in distributed computing environments, particularly in cloud platforms like Oracle Cloud Infrastructure, where entities from one realm need to access resources in a different realm, and their identities are unknown.
Innovation Solution
A method involving generating a resource principal checker and tokens to authorize cross-realm operations, using resource principal tokens (RPT) and session tokens (RPST) to authenticate and manage resources within the target realm, along with service plans and manifests (SPAMs) to ensure deterministic and efficient bootstrapping of services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cross-realm access requests are permitted in distributed computing environments, then entities from one realm can access resources in different realms, but the requesting entity's identity is unknown within the target realm making authorization difficult
Solution Approach 1:
The patent introduces an identity boundary spanner as an intermediary component that receives cross-realm access requests from entities in a first realm, determines their identities, and generates resource principal objects that enable these entities to access resources in a second realm. This mediator bridges the identity gap between realms, allowing cross-realm access while maintaining reliable authorization through structured identity verification and token generation.
2Measurement precision
If fine-grained authorization policies are implemented for cross-realm requests, then access control precision is improved, but system complexity increases
Solution Approach 1:
The patent segments the authorization system into distinct components: identity boundary spanners for cross-realm request handling, resource principal checkers for authorization verification, and structured resource principal objects. This segmentation allows fine-grained authorization policies to be implemented in a modular fashion, improving authorization precision while managing system complexity through clear separation of concerns and reusable components.
Solution Approach 2:
The patent changes the parameter representation by transforming cross-realm entity identities into standardized resource principal objects with specific parameters and attributes. This parameter transformation enables fine-grained authorization policies to be applied consistently across different realms, improving authorization precision while reducing complexity through standardized identity representation.
3Reliability
If resource principal tokens and session tokens are generated for cross-realm authentication, then security is improved, but processing time and computational overhead increase
Solution Approach 1:
The patent performs preliminary identity determination and resource principal object generation when cross-realm access requests are first received. By pre-establishing the identity verification and creating authorization tokens in advance, the system improves security through proper authentication while reducing processing time for subsequent access operations, as the authorization framework is already in place.
Solution Approach 2:
The patent creates resource principal objects that are analogous to or copies of the original entity identities but adapted for the target realm context. These copied identity representations enable secure cross-realm authentication without requiring extensive real-time verification, thus improving security while minimizing processing time through efficient identity replication.
Data Source
AI summary
Cross-realm authorization techniques are disclosed. The identity of a entity (e.g., a service) may be projected from a host realm (HR) to a target realm (TR) and fine grained policies may be written against the projected identity in the TR. A cross-realm request may be initiated from a requesting entity (RE) of a HR and received by a component of a TR. The identifier of the RE can be overwritten with the TR equivalent either by a component in the HR prior to transmission, or by the receiving component in the TR after reception (e.g., using a Realm to Identifier map provided in an additional header of the request). A resource principal may be generated for the RE using its TR identifier and an operation may be authorized using the resource principal and policies that are specific to the RE and the TR.