Facet Server Module for Federated Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing policy-based authorization systems fail to function effectively in multi-domain federated authorization environments, leading to replication of subscriber databases and access controls in cloud-based systems.
Innovation Solution
A method is introduced that involves creating and managing 'facets' – secure tokens or keys – which define access permissions and validity conditions, allowing for secure and efficient authorization across multiple domains within a cloud environment, using a facet server module and trust authority module to manage and enforce access to resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing policy-based authorization systems are used in multi-domain federated environments, then enterprise authorization settings are maintained, but replication of subscriber databases and access controls occurs
Solution Approach 1:
The patent introduces a facet server as an intermediary component that mediates between multiple domains and the authorization system. The facet server receives facet requests from domains, validates them against stored facets in the database, and returns authorization decisions. This intermediary architecture eliminates the need for each domain to maintain replicated subscriber databases, as all authorization decisions are centralized at the facet server while still supporting multi-domain federated scenarios
Solution Approach 2:
The facet server implements a universal authorization mechanism that serves multiple domains simultaneously. A single facet database stores authorization rules that can be validated by any domain participating in the federated environment. The system provides multi-functionality by supporting both enterprise authorization settings and multi-domain federated scenarios through the same facet validation mechanism, eliminating the need for separate replicated databases in each domain
2Reliability
If users are on-boarded from participating domains in the domain where resources exist, then access control is enforced, but replication of access controls occurs across domains
Solution Approach 1:
The facet server acts as an intermediary that centralizes access control validation. Instead of each domain maintaining its own replicated access control lists and subscriber databases, the facet server stores facets in a centralized database and validates all access requests. This eliminates access control replication while maintaining enforcement across all domains through the intermediary validation process
Solution Approach 2:
The patent merges access control functionality across multiple domains into a single facet validation system. Access control rules from different domains are combined into unified facets that are stored in a centralized database. The facet server combines validation logic for multiple domains into a single system, eliminating the need for separate replicated access control mechanisms in each domain while maintaining security enforcement
Data Source
AI summary
An example method is provided and includes receiving a request to issue a facet; identifying an endpoint with a resource for which the facet is valid; identifying a set of actions capable of being performed on the resource; creating the facet using the set of actions; and issuing the facet. In other embodiments, the method may include receiving an initial request from an entity for the facet; determining whether the entity has authorization to make the initial request; and request a facet server module to issue the facet. In yet other embodiments, the facet has a condition, and the condition is at least one of a count of use, a time duration, and a periodic time duration. Additionally, in certain cases, determining whether the entity has authorization to make the initial request comprises evaluating validity information against a policy.