Cross-Tenant OAuth Access Token Scoping

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current multi-tenant computing systems face challenges in securely accessing resources from another tenant system, often requiring broad permissions for tasks like mailbox migration, which can lead to unauthorized access and control issues.

Innovation Solution

A system utilizing an OAuth provider with a target tenant and source tenant setup, where a client application is registered with specific permissions and a secret, allowing the target service to obtain an access token from the source tenant's authorization server to access resources within the authorized scope, ensuring controlled access and permissions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If broad permissions are given to cloud-based service for resource migration, then resource access capability is improved, but security and unauthorized access risk worsen

Engineering Contradiction:

Improveresource access capabilityVSAvoidunauthorized access risk

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent segments permissions into specific scopes (e.g., read-only, write access, specific resource types) rather than granting broad permissions. The OAuth authorization server issues access tokens with limited scopes that correspond to specific resource access needs, dividing the permission set into granular units that can be individually controlled.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent applies local quality by making permissions specific to particular resources and operations. Each access token is configured with scope parameters that define exactly which resources can be accessed and what operations are permitted, ensuring that permissions are tailored to the specific local context of each access request rather than applying universally.

Inventive Principle:

Principle #3Local quality

2Reliability

If tenant resources are segregated in multi-tenant system, then security and isolation are improved, but resource sharing capability worsens

Engineering Contradiction:

Improvetenant isolation securityVSAvoidresource sharing capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent introduces an OAuth authorization server as an intermediary between tenants. This mediator manages cross-tenant access by verifying authorization requests, issuing scoped access tokens, and enforcing permission boundaries. The intermediary enables controlled resource sharing while maintaining tenant isolation through centralized authorization management.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent implements a universal OAuth authorization framework that serves multiple functions: it maintains tenant isolation, enables controlled cross-tenant resource sharing, manages permission scopes, and provides a standardized interface for authorization. This multi-functional system resolves the contradiction by providing a single framework that handles both security isolation and resource sharing needs.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS11930016B2Authentication framework for resource access across organizations

Publication Date: 2024.03.12 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

A client application is specified by a target tenant and represented in an OAuth provider, along with a corresponding secret. A source tenant consents to permissions to be executed by the client application on a resource of the source tenant. A target service uses the secret to obtain an access token from an authorization server coupled to the source tenant and uses the access token to obtain access, specified by the permissions, to the resource served by a source service acting on behalf of the source tenant.