Delegated Credential Agents for Secure Process Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for managing access to secure network resources by autonomous computer processes face significant security risks, inefficiencies, and lack of process visibility due to shared or individual accounts, leading to compromised credentials, cumbersome management, and inadequate audit trails.
Innovation Solution
Implementing a long-lived agent process on each machine that manages access tokens using machine-specific accounts, enforcing resource access policies, and maintaining detailed audit trails, thereby reducing security risks and improving control over resource access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a single account is shared among multiple autonomous processes, then credential management is simplified, but security risk increases due to exposure of login credentials
Solution Approach 1:
The patent segments the single shared account into multiple individual accounts, one for each autonomous process. Each process receives its own credentials through secure injection, eliminating the need to share a single account and thereby reducing security risks while maintaining manageable credential distribution through automated provisioning
Solution Approach 2:
The patent introduces a credentials management service as an intermediary that automatically provisions credentials to autonomous processes. This mediator handles credential distribution, storage, and rotation, simplifying management while enhancing security by preventing direct exposure of credentials in code or configuration files
2Object-affected harmful factors
If individual accounts are created for each autonomous process, then security risk is reduced, but credential management becomes cumbersome
Solution Approach 1:
The patent implements self-service through automated credential provisioning where the credentials management service automatically creates, distributes, and manages credentials for each autonomous process without manual intervention. This eliminates the burden of manually managing individual accounts while maintaining the security benefits of separate credentials for each process
Solution Approach 2:
The patent changes the state of credential management from static manual configuration to dynamic automated provisioning. Credentials are injected into processes at runtime through secure channels, and the system automatically handles credential rotation and revocation, transforming management from a cumbersome manual task to an efficient automated process
3Ease of operation
If login credentials are stored in plain text, then ease of access is improved, but security vulnerability increases
Solution Approach 1:
The patent extracts credentials from plain text storage and injects them directly into the memory space of autonomous processes through secure inter-process communication. This removes credentials from vulnerable storage locations where they could be read from disk or configuration files, while maintaining easy access through direct memory injection
Solution Approach 2:
The patent uses secure memory-mapped files or shared memory segments as a protective layer between credential storage and process access. Credentials are stored in protected memory regions that are accessible only to authorized processes, providing both security against plain text exposure and efficient access through memory mapping
4Reliability
If process context information is collected for auditing, then security analysis is improved, but system complexity increases
Solution Approach 1:
The patent implements a universal audit logging mechanism that automatically collects process context information for all autonomous processes through a common logging interface. This multi-functional audit system handles authentication, authorization, and security event logging in a unified manner, improving security analysis without proportionally increasing complexity through standardization
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for granting access to network resources through access credentials given to an agent process running on each computer or machine where resource requesters reside. The system extends a traditional token-granting authorization system to the agent processes, where each agent has administrative access to machine information. The agent uses that access to acquire detailed information about resource requesters. Requester qualifications defined by the system limit requester access to resources, and are enforced both by the agent and by the central system on the network resource server. Resource requesters ask for a token for resource use from the agent, not the central system. The agent uses its credentials to get a token from the central system and then return the token to qualified requesters.