Named Credentials Engine for Secure Service Integration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Credentials for external services are vulnerable to leakage and dissemination to developers and end users, making it difficult to monitor and maintain security during development and deployment, especially since external services have their own distinct security envelopes separate from the host system.
Innovation Solution
A named credentials engine provides a level of indirection by encapsulating connection data and methods within a named credential object, allowing developers to access external services without exposing credentials to memory, and enabling secure authentication using technologies like OAuth, SAML, and OpenID Connect, while supporting role-based access control and hierarchical credential management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If credentials are directly exposed to developers and end users for accessing external services, then ease of operation is improved, but security is worsened due to vulnerability to leakage and dissemination
Solution Approach 1:
The patent introduces a named credentials engine as an intermediary component that sits between the application code and external services. This engine manages credentials securely in memory without exposing them to developers or end users, while still enabling authentication. The named credentials engine acts as a mediator that handles the authentication process, allowing easy access to external services while preventing credential exposure and leakage.
2Ease of operation
If credentials are stored in memory for authentication, then ease of operation is improved, but security is worsened due to difficulty in monitoring and controlling access
Solution Approach 1:
The named credentials engine implements self-service mechanisms where credentials are automatically managed, protected, and controlled within the system. The engine handles credential storage, retrieval, and rotation automatically without requiring manual security management. This reduces the complexity of security monitoring and control while maintaining authentication capabilities, as the system manages its own credentials securely without external intervention.
3Adaptability or versatility
If separate security envelopes are used for external services, then independence is improved, but integration security is worsened due to difficulty in monitoring credential usage across boundaries
Solution Approach 1:
The named credentials engine provides a universal security mechanism that works across multiple external services and environments. It implements a standardized interface for credential management that can be used with any external service, maintaining independence of individual services while providing centralized security monitoring and control. This universal approach allows consistent security policies to be applied across different security envelopes, enabling reliable monitoring of credential usage throughout the integrated system.
Data Source
AI summary
Controlling access to sensitive data can be difficult during an application development effort. A developer may not be authorized to see the data that is to be used by the application. Credentials used in a development environment to access development data can require modification when the application is migrated to a deployed environment. Changing the code in the deployed environment increases risks of change induced incidents. The technology disclosed allows for the creation of a named credential object, where the credentials for different environments are stored, and where the named credential object is called by metadata. This allows the promotion of code from a development environment to a deployed environment without changes to code, and without giving access to sensitive data to the developer.