Multi-User Application Access Token Mediator

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Multi-user applications executing in high privilege modes pose security risks due to potential bugs or malware accessing resources of non-users or the operating system, and existing solutions are computationally expensive or introduce security vulnerabilities.

Innovation Solution

A method and system that uses access tokens to enable a multi-user application executing in low privilege mode to access resources of multiple users by retrieving and providing evidence of authorization, ensuring access is restricted to authorized resources and revoked upon user logoff, thereby preventing unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If multi-user applications execute in high privilege mode to access multiple users' resources, then resource accessibility is improved, but security risk increases due to potential bugs or malware accessing unauthorized resources

Engineering Contradiction:

Improveresource accessibilityVSAvoidsecurity risk

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent segments the application's access rights by creating separate access tokens for each user, allowing the application to access only specific user resources with specific permissions rather than having blanket high-privilege access to all resources

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces access tokens as an intermediary mechanism between the application and user resources. These tokens mediate access by encoding specific user permissions and scope, allowing the application to safely access multiple users' resources without executing in high privilege mode

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If multi-user applications execute in user privilege mode to ensure security, then security is improved, but resource accessibility worsens due to restricted access to only the running user's resources

Engineering Contradiction:

ImprovesecurityVSAvoidresource accessibility

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The access token acts as an intermediary that allows the application running in user privilege mode to access resources of other users. The token encodes the necessary permissions and scope, enabling secure cross-user access without requiring the application to elevate to high privilege mode

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent changes the access parameters by using tokens that encode different user contexts and permissions. Instead of changing the application's privilege mode, the system changes the access parameters through token-based authentication and authorization

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS10205786B2Multi-user application executing in user privilege mode

Publication Date: 2019.02.12 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

A method and system for providing a multi-user application executing in a user privilege mode with access to resources of multiple users is described. The multi-user application identifies a first user and a second user of the multi-user application. The multi-user application retrieves an access token for the first user and an access token for the second user. Each access token provides evidence of authorization to access a resource in accordance with access rights of the user. The multi-user application accesses resources by providing one of the access tokens as evidence of authorization to access the resource in accordance with the access rights of the user. The multi-user application can thus access resources of multiple users without having to execute in a system privilege mode.