Project-Based Permission Tokens for Credential-Resistant Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data security systems face security issues due to role-based access control solutions, which can be exploited by attackers through identity or credential theft, leading to unauthorized data access.
Innovation Solution
A data security system that controls permissions based on the scope of projects and data operations, creating tokens that encode required permissions for data transformations, ensuring access is limited to project-defined data sources and operations, and using user-independent access control to prevent identity-related attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If role-based access control is used to simplify permission management, then ease of operation is improved, but security reliability deteriorates due to vulnerability to identity theft and credential compromise
Solution Approach 1:
The patent segments access control into two independent layers: identity-based permissions and project-based permissions. Each layer operates independently, so compromise of one does not automatically compromise the other. The security token contains both identity claims and project scope claims, which are verified separately by the access control system.
Solution Approach 2:
The patent introduces project scope tokens as an intermediary between user identity and data access. Instead of directly granting access based on user roles, the system issues tokens that encode project-specific permissions. This intermediary layer ensures that even if user credentials are stolen, attackers cannot access data outside the project scope defined in the token.
2Reliability
If project-based permission control is implemented to enhance security, then security reliability is improved, but device complexity increases due to multiple verification layers
Solution Approach 1:
The patent creates a universal security token that serves multiple functions simultaneously: it identifies the user, defines project scope, specifies permitted operations, and enforces data access boundaries. This single token replaces what would otherwise require multiple separate verification mechanisms, reducing overall system complexity while maintaining security.
Solution Approach 2:
The patent changes the parameter of permission representation from static role assignments to dynamic token-based claims. The token contains flexible claim structures that can represent different projects, data sources, and operations without requiring changes to the underlying access control logic. This parameter change allows the system to handle complex security requirements through configurable token content rather than complex system logic.
3Adaptability or versatility
If user identity-based access is used to enable flexible operations, then adaptability is improved, but security vulnerabilities increase due to credential theft and unauthorized access
Solution Approach 1:
The patent adds a project scope dimension to the traditional identity-based access control. Instead of operating in a single dimension of user roles and permissions, the system operates in two dimensions: user identity and project scope. This dimensional addition creates a security boundary that prevents attackers from exploiting identity compromise to access unauthorized data, as they cannot satisfy both dimensional requirements.
Solution Approach 2:
The patent performs preliminary verification of project scope permissions before granting data access. The system validates that the requested operation falls within the project scope defined in the security token before executing the operation. This preliminary action prevents unauthorized access attempts from succeeding, even when user credentials are compromised.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media for data security protection are provided. One of the methods includes: receiving a job associated with a project, wherein the project is associated with one or more data sources; identifying a plurality of inputs and a plurality of outputs associated with the job; determining a plurality of required permissions associated with the job, wherein each of the required permissions comprises an operation on a required data source, the operation corresponding to at least one of the inputs or the outputs; verifying that the one or more data sources associated with the project comprise the required data source associated with each of the required permissions; and generating a token associated with the job, the token encoding the required permissions associated with the job, wherein the token is required for execution of the job.