Persistent Source Values for Tracing Assumed Identity Actions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity and access management systems struggle to track responsibility for actions performed using multiple temporary identities across different domains, as they do not automate the tracking of long-term identities and require complex, custom applications to trace actions back to the original source.
Innovation Solution
Implementing a system that enforces the definition of a persistent source value at the time of assuming a temporary identity, which persists across multiple identities within a session, allowing actions to be traced back to the long-term identity without needing to recreate the entire chain of identities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If complex custom applications are used to trace actions back to long-term identities, then responsibility tracking is possible, but system complexity increases significantly
Solution Approach 1:
The patent applies preliminary action by embedding the persistent source value in the credentials at the time of identity assumption, before any actions are performed. This pre-established marker eliminates the need for complex post-hoc tracing applications, as the source identification is already captured in the credential itself.
Solution Approach 2:
The persistent source value acts as an intermediary element that bridges the temporary identity and the long-term identity. Instead of directly linking identities through complex applications, the persistent source value serves as a simple mediator that carries the source identification through the temporary identity session.
2Measurement precision
If the entire chain of identities is investigated to trace actions, then accurate responsibility determination is achieved, but time and computational resources are wasted
Solution Approach 1:
The patent extracts the essential source identification information (persistent source value) from the complex identity chain and embeds it directly in the credentials. This extraction eliminates the need to investigate the entire identity chain, as the critical information is already available in the credential presented by the temporary identity.
3Reliability
If domains are prevented from viewing logs of other domains for security, then domain isolation is maintained, but ability to trace actions across domains is lost
Solution Approach 1:
The persistent source value embedded in credentials serves as a secure intermediary that enables cross-domain tracing without requiring domains to share or view each other's logs. The source identification travels with the credential across domain boundaries, maintaining security isolation while enabling traceability.
Data Source
AI summary
An Identity and Access Management Service implements persistent source values PSVs) for assumed identities. A source value (e.g., an original identifier of an entity) is persisted across assumed identities, facilitating identification of entities (users or applications) responsible for actions taken by the assumed (e.g., alternative) identities. The Manager receives a request to assume an identity. The request includes the entities current credentials and a PSV. The current credentials are authenticated and a persistent source value policy may be relied on to determine whether and/or how to grant the assumed identity. The PSV may be copied from credentials in the request in order to be included in the credentials for the requested identity that the Manager provides in response to the request. Use of the requested credentials, including the PSV, to access services or resources may be logged, the logs including the PSV from the request to assume the identity.