Global Access Token for Cross-Region Cloud Identity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current identity management systems in cloud environments face challenges in providing secure access across diverse devices and user types, including unauthorized access, account hijacking, and inconsistent security between on-premise and cloud environments, particularly when managing access for employees, customers, and partners.
Innovation Solution
A multi-tenant cloud system with a microservices-based architecture that issues global access tokens, enabling secure access to resources across different regions and environments, while integrating with existing applications and identities, and providing unified identity management through a cloud-scale Identity and Access Management (IAM) platform.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a multi-tenant cloud system issues global access tokens for cross-region access, then access scalability and unified identity management are improved, but security consistency and control over cross-region access become more complex
Solution Approach 1:
The patent introduces a token issuance service as an intermediary component that sits between the first data center and the second data center. This service receives authentication requests, issues global access tokens with appropriate claims, and enables secure cross-region access without requiring complex direct integration between data centers. The token acts as a mediator that carries authentication information across regional boundaries.
Solution Approach 2:
The system changes the parameter of access control from local region-specific tokens to global access tokens with standardized claims. This parameter change allows the same token structure and validation logic to be used across multiple regions, improving scalability while maintaining security consistency through standardized token parameters and claims.
2Reliability
If the system validates requests from multiple regions through centralized authentication, then security consistency is improved, but authentication time and system response delay increase
Solution Approach 1:
The system performs preliminary authentication by issuing global access tokens that contain pre-validating authentication claims. Once a user is authenticated in the first data center, their identity and permissions are encoded in the token beforehand, allowing subsequent cross-region access to be validated by simply verifying the token signature and claims rather than performing full authentication again.
Solution Approach 2:
The authentication information is copied into the global access token structure, which then serves as a portable credential. The token contains a copy of the essential authentication claims (user identity, permissions, expiration) that can be validated independently without requiring real-time connection to the original authentication service.
3Reliability
If the cloud gate validates global access tokens with multiple claims, then access security and permission verification are improved, but token validation complexity and processing overhead increase
Solution Approach 1:
The global access token is segmented into distinct claims, each representing a specific aspect of authentication or permission (e.g., user identity, region access, resource permissions). This segmentation allows the validation process to check each claim independently based on its specific requirements, rather than treating the token as a monolithic structure.
Solution Approach 2:
The patent establishes a universal token validation approach where the same validation logic and cloud gate infrastructure can handle multiple types of claims and permission checks. The system is designed to universally validate different claim types through a standardized process, reducing the need for separate validation mechanisms for each claim type.
Data Source
AI summary
Embodiments of a multi-tenant cloud system include a first data center adapted to authenticate a first plurality of registered clients and located in a first geographic area, and a second data center adapted to authenticate a second plurality of registered clients and located in a second geographic area that is different from the first geographic area. The first data center receives a request from a first client of the first plurality of registered clients to access a resource of the second data center and validates the request from the first client and issues a global access token. The second data center receives the request with the global access token. A cloud gate at the second data center, based on the global access token, validates the request and provides the resource to the first client.