Context-Based Data Access Tokens for Multi-Tenant Usage Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing role-based access control (RBAC) systems in cloud computing environments lack fine granularity and flexibility for data access and usage control, particularly in multi-tenant systems, leading to inefficiencies and manual, disjointed processes due to static permissions and platform incompatibilities.
Innovation Solution
A three-phase context-based authorization process that generates cloud-neutral access tokens, which are then converted into cloud-specific tokens, enabling dynamic, fine-grained data access control across multiple platforms, including AWS, Azure, and Salesforce, by automating permission management and integrating with third-party systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Manufacturing precision
If role-based access control (RBAC) is used to control data access, then data access control is implemented, but fine granularity control of data usage purpose cannot be enforced
Solution Approach 1:
The patent segments access control into multiple independent components: data access control, data usage purpose control, and temporal control. Each component is managed separately through specific claims (e.g., claim 1 divides control into access permission and usage permission; claim 15 introduces purpose-specific policies). This segmentation enables fine-grained control without compromising overall system flexibility.
Solution Approach 2:
The patent implements dynamic access tokens that can be modified, extended, or revoked in real-time based on usage context. The system allows purpose-specific policies to be applied dynamically (claim 16), and access tokens to be updated without reissuing entire role assignments (claim 22). This dynamic approach maintains both granularity and adaptability.
2Ease of operation
If static roles are assigned for data access, then access control is simplified, but constant changing of purposes requires constant changing of roles which is tedious and prevents scaling
Solution Approach 1:
The patent separates role assignment from purpose-specific permission assignment. Users are assigned roles for data access (claim 1), while usage purposes are controlled through separate purpose-specific policies (claim 16). This segmentation allows static role management for access while enabling dynamic purpose control without requiring role changes.
Solution Approach 2:
The patent introduces an intermediary layer of purpose-specific policies that mediate between static role assignments and dynamic usage requirements. The system uses access tokens as intermediaries that carry both role-based permissions and purpose-specific constraints (claim 22), allowing purpose changes without role reassignment.
3Reliability
If traditional RBAC is used in multi-tenant systems, then access control is implemented, but platform compatibility becomes complex when each tenant uses different cloud platforms
Solution Approach 1:
The patent implements a universal access control framework that works across multiple cloud platforms (AWS, Azure, GCP, Salesforce). The system uses platform-agnostic access tokens and policies that can be enforced uniformly across different tenants and platforms (claim 24). This universal approach maintains reliable access control while eliminating platform-specific complexity.
4Ease of operation
If users are granted access to data via RBAC, then data access is enabled, but the user can use the data for any purpose including purposes not intended by the data owner
Solution Approach 1:
The patent divides access permission and usage permission into separate controllable entities (claim 1). Data owners can grant access to users while simultaneously specifying intended purposes for usage. The system enforces both access control and usage purpose control independently, preventing unauthorized usage while maintaining ease of access granting.
Solution Approach 2:
The patent implements preliminary control by requiring data owners to specify intended purposes before granting access. The system preemptively defines usage constraints in access tokens (claim 22) and purpose-specific policies (claim 16) that prevent unauthorized usage before it occurs, rather than relying on post-access monitoring.
Data Source
AI summary
System and method for fine granularity control of data access and usage for across multi-tenant systems. A user makes a request to access a particular set of data from a particular remote data source for a specific purpose. The system authorizes the user to validate whether the user is qualified to make the request. The data source is checked to see if the particular data has been granted access for that particular purpose. A cloud neutral token is created and converted into a cloud specific token upon reaching the remote data source. The cloud specific token is used to create a temporary IAM role and IAM policy with a predetermined time to live. After the time to live expires, the IAM role and IAM policy are deleted.