Per-Resource Authority Verification via Segmentation and Intermediary Mediation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current authority verification systems in cloud services lack the ability to manage distinct authorities for each user and resource, leading to difficulties in granting and authenticating user access, and result in inconsistencies and inconvenience in authority management.

Innovation Solution

An authority verification system that includes a per-resource user authority management unit, a user authority management unit, a specification unit, a refinement unit, and a validation unit to determine and manage access authorities for each resource, allowing for granular control of user access rights.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If user authority verification is aggregated into a centralized authentication/authorization service, then security is improved and functions are consolidated, but the ability to manage per-resource user authorities is lost and authority control becomes inflexible

Engineering Contradiction:

ImprovesecurityVSAvoidper-resource authority control

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent segments authority management into two distinct components: (1) user authority verification performed by the centralized authentication/authorization service, and (2) per-resource authority specification performed by the resource-managing application service. This segmentation allows the system to maintain centralized security verification while enabling fine-grained per-resource authority control through the resource authority information stored in the database and specified by the application service.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary mechanism where the resource-managing application service acts as a mediator between the centralized authentication service and the resource access control. The application service receives authentication results from the centralized service, then independently determines per-resource authority based on stored resource authority information, and finally controls resource access accordingly. This intermediary role enables both centralized security and decentralized per-resource control.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If per-resource user authorities are managed in the authentication server, then centralized control is achieved, but system complexity increases and consistency becomes difficult to maintain

Engineering Contradiction:

Improvecentralized authority managementVSAvoidauthority management complexity

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

The patent extracts per-resource authority management functionality from the authentication server and places it in the resource-managing application service. The authentication server retains only user authentication and general authority verification functions, while the application service handles resource-specific authority specification based on locally stored resource authority information. This extraction reduces the authentication server's complexity while maintaining centralized verification capabilities.

Inventive Principle:

Principle #2Taking out (Extraction)

3Reliability

If authority verification is performed by a single centralized service, then security consolidation is achieved, but granular per-resource access control becomes difficult to implement

Engineering Contradiction:

Improvesecurity consolidationVSAvoidgranular authority control precision

Core Design Contradiction:

ReliabilityVSManufacturing precision

Solution Approach 1:

The patent applies local quality by enabling the resource-managing application service to specify different authority requirements for different resources based on local resource authority information stored in its database. Each resource can have its own authority specifications tailored to its specific security requirements, while the centralized authentication service provides uniform verification. This local quality approach enables precise granular control without compromising centralized security consolidation.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS10574645B2Authority verification system, authority verification method, and computer-readable storage medium

Publication Date: 2020.02.25 CANON KK

AI summary

A per-resource user authority management unit that manages user authorities per resource, a user authority refinement unit that refines authorities linked to a user by the per-resource user authorities, and an authority verification unit that determines whether execution of processing with respect to a resource is permitted by using an authority that has been refined by the user authority refinement unit are provided.