Differentiated Authorization Tokens for Multi-Domain Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authorization tokens in multi-domain applications are not differentiated by domain, leading to excessive permissions and the inability to implement least privilege permissions effectively.
Innovation Solution
The system introduces differentiated authorization for domains by separating user and device authorization mechanisms into multiple levels, generating unique authorization tokens for each domain with specific permissions, and implementing granular constraints across various tiers for access control and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single authorization token is used across multiple domains, then system authorization is simplified, but excessive permissions are enabled and least privilege cannot be implemented
Solution Approach 1:
The patent segments the authorization mechanism by introducing domain-specific authorization tokens (DSATs) that are divided into domain-specific components (DSCs). Each DSC is tailored to specific domains and resources, allowing fine-grained control over permissions. This segmentation enables the system to move from a single broad authorization token to multiple specialized tokens, each with appropriate permissions for specific domains, thereby implementing least privilege while maintaining manageable complexity through modular design.
2Reliability
If authorization tokens are differentiated by domain, then least privilege permissions can be implemented, but system authorization complexity increases
Solution Approach 1:
The patent applies local quality by creating domain-specific authorization tokens with permissions tailored to each domain's specific requirements. Each token contains only the necessary permissions for its designated domain, avoiding unnecessary broad access. This localized approach to authorization ensures that each domain receives exactly the permissions it needs (no more, no less), implementing least privilege while managing complexity through domain-specific customization rather than global uniformity.
Solution Approach 2:
The patent introduces a new dimension to authorization by adding domain specificity as an additional layer to the traditional authorization model. Instead of a single-dimensional authorization token that applies universally, the system creates multi-dimensional tokens that incorporate domain identifiers, resource types, and specific permission scopes. This dimensional expansion allows for fine-grained control while organizing complexity through structured categorization of domains and resources.
Data Source
AI summary
Disclosed herein are system, method, and computer program product embodiments for differentiated authorization for domains of a multi-domain application. A computing device may identify a familiarity indicator based on identity information received with a request for access to a multi-domain application. Based on a risk assessment of the familiarity indicator, an access level for the access to the multi-domain application may be identified. A request for an access token that enables access to a first domain of the multi-domain application may be authorized based on the access level. A request for an access token that enables access to a second domain, such as a domain associated with a higher access level than the first domain of the multi-domain application, may be denied based on the access level.