Group-Matched Access Management for Cloud Service Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current OAuth methods fail to prevent unnecessary authority delegation and securely manage access in multi-tenant cloud services, leading to potential security breaches and increased burden on cloud service providers.
Innovation Solution
A system and method that includes an access management service system which determines whether a user and client system belong to the same group, presenting a screen for user confirmation on delegating authority, and only provides access control information if the groups match, thereby preventing unauthorized access and reducing unnecessary delegation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If OAuth authorization is implemented to enable service coordination, then service coordination capability is improved, but security risk increases due to potential unauthorized access and data leakage
Solution Approach 1:
The patent applies preliminary action by performing group matching verification before authorization delegation. The system determines whether the user and client system belong to the same group prior to issuing authorization tokens, preventing unauthorized access before it can occur. This pre-verification mechanism ensures that only legitimate service coordination requests are authorized, thereby maintaining security while enabling service coordination.
2Reliability
If explicit user authorization is required for each service access, then security control is improved, but operational complexity increases
Solution Approach 1:
The patent applies segmentation by dividing the authorization process into two distinct stages: group verification (system-level check) and user authorization (individual-level confirmation). The group matching determination is performed automatically by the system based on pre-stored group information, while user authorization is obtained through a one-time confirmation. This segmentation reduces operational complexity by automating the verification aspect while maintaining security through user confirmation.
3Reliability
If group matching determination is performed before authorization, then unnecessary authority delegation is prevented, but processing time increases
Solution Approach 1:
The patent applies preliminary action by pre-storing group information for both users and client systems in the storage unit. When an authorization request is received, the system performs a quick group matching determination by comparing pre-stored group identifiers rather than performing complex verification procedures. This preliminary setup of group information enables fast matching operations, ensuring accurate access control while minimizing processing time.
4Reliability
If cloud service providers manage access control for all tenants, then security management is improved, but system burden increases
Solution Approach 1:
The patent applies segmentation by separating access control management into two layers: the access management service system handles group-level verification and authorization token issuance, while the cloud service provider focuses on resource protection and tenant isolation. The access management service system stores and manages group information independently, performing group matching determinations without requiring the cloud service provider to implement complex access control logic. This segmentation reduces the system burden on cloud service providers while maintaining comprehensive security management.
Data Source
AI summary
An access management service system that manages use of a service provided by a resource service system, comprises: a holding unit which holds information of a user and information of a client system in a storage unit; a determination unit which, if an authorization request for use of the service is received from the client system due to an instruction from a user having authority to use the service, determines whether a group to which the user belongs and a group to which the client system belongs match based on the information held in the storage unit; and a presentation unit which, if the determination unit determines that the groups match, presents, to the user, a screen for instructing whether or not to permit delegation of the authority of the user to the client system.