Remote Principal Authorization for Cross-Domain Secure Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack efficient and secure methods for external identities to access secure data resources across different domains, where the data resource owners cannot modify the permissions granted to external identities, risking unauthorized access or insufficient support due to immutable permissions.
Innovation Solution
Implementing remote principal objects (RPOs) that define and manage access permissions immutably, allowing external identities to access secure resources through a verified token service, with an entitlements lifecycle manager governing access lifecycles and permissions based on task-specific groups, ensuring secure and task-specific access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the data resource owner defines and manages permissions for external identities, then access control and security are improved, but the complexity of permission management and the risk of unauthorized access increase when permissions need to be altered
Solution Approach 1:
The patent introduces an intermediary system that acts as a mediator between external identities and data resources. This intermediary manages permissions centrally, allowing the owner to define access policies once without needing to modify complex permission structures when access requirements change. The intermediary handles the complexity of permission management, simplifying the process for owners while maintaining security.
Solution Approach 2:
The patent segments permission management into distinct components: access policies defined by owners, permission templates, and remote principal objects. This segmentation allows owners to define high-level access policies without managing detailed permissions directly. When access needs to be modified, changes are made at the policy level rather than individual permission level, reducing complexity.
2Reliability
If immutable permissions are granted to external identities, then unauthorized access is prevented, but the ability to provide timely support and adapt to changing requirements is reduced
Solution Approach 1:
The patent implements dynamic permission management where access policies can be modified to adapt to changing requirements. Remote principal objects can be created, updated, or deleted based on current needs. Permission templates can be revised without affecting existing immutable permissions, allowing the system to adapt while maintaining security for active permissions.
Solution Approach 2:
The patent allows owners to pre-define permission templates and access policies before external identities need access. These preliminary definitions establish immutable permissions that secure access. When requirements change, new templates or policies can be created without modifying existing immutable permissions, maintaining both security and adaptability.
3Reliability
If the owner creates directory entries for each external identity, then access control is improved, but the time and effort required to manage multiple external identities increases
Solution Approach 1:
The patent introduces remote principal objects that serve as universal representations for external identities across multiple data resources. Instead of creating separate directory entries for each external identity at each resource, a single remote principal object can manage access to multiple resources. This multi-functionality significantly reduces the time and effort required to manage external identities while maintaining access control.
Solution Approach 2:
The patent merges the management of multiple external identities into centralized remote principal objects. These objects consolidate access control for multiple identities and resources, eliminating the need for separate directory entries. The merging reduces administrative overhead and time requirements while maintaining granular access control through permission templates.
Data Source
AI summary
Methods of secure resource authorization for external identities using remote principal objects are performed by systems and devices. An external entity creates a user group and defines entitlements to an owning entity's secure resource as a set of permissions for the group. An immutable access template with the permissions and an access policy for the secure resource are provided to the owning entity for approval. On approval, a remote principal object is created in the owner directory according to the permissions and access policy. A remote principal that is a group member requests access via an interface to the owner domain using external domain credentials. The identity of the remote principal is verified against the remote principal object by a token service. Verification causes generation and issuance of a token, with the enumerated entitlements, to the remote principal interface affecting a redirect for access to the secure resource.