Resource Access Control Using Validation Token
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data processing systems face inefficiencies in managing access to resources due to the need for frequent validation server checks, leading to increased communication traffic and overhead, especially when validating tokens for low-security resources.
Innovation Solution
Implementing a policy-based system at the resource server to determine whether to validate tokens locally or with the validation server, allowing self-validation for certain resources and reducing unnecessary communication by using digitally signed tokens and token blacklisting for security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the resource server confirms validity of the validation token with the validation server for every resource request, then security is improved, but communication traffic and overhead increase
Solution Approach 1:
The patent applies local quality by implementing different validation strategies for different resources based on their security requirements. High-security resources require server confirmation of token validity, while low-security resources allow local validation without server communication. This differential approach reduces overall communication traffic while maintaining appropriate security levels for each resource type.
2Reliability
If the resource server confirms validity of the validation token with the validation server for every resource request, then security is improved, but system overhead and processing time increase
Solution Approach 1:
The system implements local quality by categorizing resources into high-security and low-security groups. For low-security resources, the resource server performs local validation of tokens without contacting the validation server, significantly reducing processing time. For high-security resources, full server confirmation is performed to ensure security. This selective approach minimizes overall processing time while maintaining security where required.
3Measurement precision
If the validation token includes detailed policy data, then access control precision is improved, but token complexity increases
Solution Approach 1:
The patent applies segmentation by dividing access control into two distinct phases: token issuance with embedded policy data, and token validation against resource-specific policies. The validation token contains policy data specifying permitted operations and resources, enabling precise access control. The resource server segments the validation process by first checking local policies embedded in the token, then confirming with the validation server only when necessary, thereby managing complexity while maintaining precision.
Data Source
AI summary
Access to a resource controlled by a resource server (6, 8) is provided using a validity token issued by a validation server (4). When a resource request from a user (12) is received at the resource server (6, 8), then the resource server (6, 8) determines if the resource request satisfies a policy. If the resource request satisfies the policy, then access to the resource may be permitted without confirming the validity of the validation token with the validation server (4). Conversely, if the resource request does not satisfy the policy, then validation of the validation token with the validation server (4) is performed before the access requested is permitted.