Hashed Authorization Tokens for Scalable Multi-Service Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SaaS providers face challenges in implementing a centralized identity service and fine-grained authorization across disparate services, especially in large enterprises with complex server distributions, where traditional authorization systems fail to efficiently manage user permissions and latency requirements.
Innovation Solution
A scalable cross-protocol mechanism that generates and manages {resource,operations} tuples, computes hashes for these tuples, and uses a distributed hash table to optimize authorization token distribution, allowing for efficient and fine-grained access control without increasing latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a centralized authorization server is used to manage fine-grained permissions across all services, then authorization control precision is improved, but system complexity and latency increase
Solution Approach 1:
The patent segments the centralized authorization system into distributed authorization caches deployed across multiple service nodes. Each cache stores a subset of authorization rules locally, enabling fine-grained control precision while distributing system complexity across independent nodes rather than concentrating it in a single centralized server.
Solution Approach 2:
The patent introduces a new dimension of spatial distribution by deploying authorization caches across multiple geographic locations and service nodes. This transforms the single-point centralized authorization model into a multi-dimensional distributed architecture, maintaining control precision through logical centralization while reducing complexity and latency through physical distribution.
2Loss of time
If authorization data is cached locally at service nodes, then latency is reduced, but data consistency and security control may be compromised
Solution Approach 1:
The patent implements a feedback mechanism where the centralized authorization server monitors and updates distributed caches. When authorization rules change, the server pushes updates to relevant caches, ensuring data consistency. The caches also provide feedback about their state and validity, enabling the system to maintain both low latency through local caching and high reliability through continuous synchronization.
Solution Approach 2:
The patent performs preliminary actions by pre-computing and caching authorization decisions before they are needed. The centralized server proactively pushes authorization rules to distributed caches ahead of actual authorization requests, so that when requests arrive, decisions can be made immediately from local cache data, reducing latency while maintaining consistency through the preliminary synchronization.
3Reliability
If fine-grained authorization rules are stored centrally, then security control is improved, but network traffic and server load increase
Solution Approach 1:
The patent extracts authorization data from the centralized server and places it locally in distributed caches at service nodes. This extraction reduces the need for continuous network communication between clients and the central server for authorization checks. Security control is maintained because the extracted data is obtained through secure synchronization protocols, and the caches operate independently without requiring constant network connectivity for authorization decisions.
4Ease of operation
If a fully centralized authorization system is implemented, then security management is simplified, but scalability to large numbers of users and services is limited
Solution Approach 1:
The patent creates a universal authorization framework that combines centralized management capabilities with distributed execution. The system maintains simplified security management through a centralized configuration interface and policy definition, while the distributed cache architecture provides multi-functionality by serving multiple services and users simultaneously. Each cache node can independently serve its local service while the overall system scales to accommodate additional services and users by simply adding more cache nodes.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A scalable cross-protocol mechanism is provided for describing, transmitting and checking large lists of authorizations for operations on network resources. At an authorization server, data is stored that represents operations that can be performed on a plurality of resources of a service provider at the request of one or more users. A set of {resource,operations} tuples is generated, wherein a resource describes an endpoint for a network service and operations is a list of operations that are authorized on an endpoint. The set of {resource,operations} tuples is partitioned into one or more subsets. A subset of the set of {resource,operations} tuples is combined into a string according to a predetermined rule. A hash is then computed, according to a hash function, to generate hash results. Hashes are passed instead of the lists themselves to minimize data transfer and latency.