Role-Based Authorization Using Diversified Security Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security mechanisms are transport-dependent and do not provide flexible, end-to-end authorization across multiple transport domains, especially when various security token types are used, leading to potential security breaches and cumbersome identity-based authorization processes.
Innovation Solution
A mechanism for role-based authorization that correlates security tokens with roles, allowing for flexible authorization regardless of the security token type, enabling end-to-end authentication and authorization across multiple transport domains using a service providing computing system that accesses and processes security tokens within service request messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security mechanisms are used, then authentication can be performed, but authorization becomes cumbersome and transport-dependent
Solution Approach 1:
The patent introduces security tokens as intermediary objects that carry identity information through multiple transport domains. These tokens act as mediators between the authentication process and authorization decisions, allowing the system to maintain security while simplifying authorization across different transports by relying on the token's embedded identity claims rather than re-evaluating credentials at each step.
Solution Approach 2:
The security token is designed with multi-functionality, serving both as an authentication credential and as an authorization carrier. The token contains identity information that can be used universally across different transport domains (HTTP, MQ, SMTP, etc.) without requiring transport-specific authorization mechanisms, thus reducing overall system complexity while maintaining security.
2Adaptability or versatility
If transport-independent messaging is used, then communication flexibility is improved, but security mechanisms become transport-dependent
Solution Approach 1:
The patent segments the security mechanism into two independent parts: authentication (handled by the security token) and transport-specific processing. The security token contains all necessary identity information that is transport-agnostic, allowing the same token to be used across HTTP, MQ, SMTP, and other transports without requiring transport-specific security configurations, thus maintaining both flexibility and security.
Solution Approach 2:
The patent changes the parameter of security implementation from transport-specific to token-based. Instead of having security mechanisms tied to each transport protocol, the system uses security tokens with embedded identity parameters that can be validated universally across different transports, enabling transport-independent messaging while maintaining consistent security policies.
3Reliability
If identity-based authorization is used, then access control can be implemented, but managing multiple identities becomes complex
Solution Approach 1:
The patent uses copying by embedding identity information into the security token. Instead of managing multiple separate identity credentials, the system creates a copy of the relevant identity claims within the token structure. This allows the authorization system to work with the copied identity information in the token without needing to manage or validate the original credentials across different transports, simplifying identity management while maintaining access control.
4Adaptability or versatility
If multiple security token types are supported, then authentication flexibility is improved, but authorization consistency becomes difficult to maintain
Solution Approach 1:
The patent implements a universal authorization approach where the authorization logic operates on the identity information contained in security tokens regardless of their specific type. The system is designed to handle multiple token types (X.509 certificates, SAML tokens, JWTs, etc.) uniformly by extracting and processing identity claims from each token type in the same way, thus maintaining authorization consistency across diverse token formats.
Solution Approach 2:
The patent changes the authorization parameter from token-type-specific to token-claim-based. Instead of having different authorization logic for different token types, the system processes authorization based on the identity parameters extracted from any token type. This parameter transformation allows the same authorization rules to apply consistently across X.509, SAML, JWT, and other token types, maintaining reliability while supporting flexibility.
Data Source
AI summary
A mechanism for performing role-based authorization of the one or more services using security tokens associated with received service request messages. This role-based authentication is performed regardless of the type of security token associated with the received service request messages. Upon receiving a service request message over the network for a particular service offered by the service providing computing system, the service providing computing system accesses a security token associated with the received service request message. Then, the computing system identifies one or more roles that include the identity associated with the security token, and correlates the roles with the security token. These correlated roles are then used to authorize the requested service. This mechanism is performed regardless of the type of the security token.