Run-time Trust Management for Access Impersonation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Access management systems face challenges in managing and controlling impersonation sessions in a fine-grained manner, particularly in providing real-time notification and configuration options to impersonatees, leading to potential security risks and inefficiencies.
Innovation Solution
The implementation of a two-part security key system, where one key is sent to the impersonator and another to the impersonatee, allowing the impersonatee to configure and approve the impersonation session, ensuring secure and controlled access through a run-time management system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional access management systems are used for impersonation, then basic authentication is provided, but fine-grained control and real-time notification capabilities are lacking
Solution Approach 1:
The security key is segmented into two separate parts: a first security key provided to the impersonator and a second security key provided to the impersonatee. This segmentation enables fine-grained control where the impersonatee can independently approve or deny impersonation requests without requiring system administrator intervention, thus improving ease of operation while distributing system complexity across multiple components.
2Reliability
If impersonation requests are processed without real-time notification, then processing speed is maintained, but security control is weakened
Solution Approach 1:
The system performs preliminary actions by generating and distributing both security keys before the impersonation request is fully processed. The impersonatee receives the second security key in advance and can immediately approve or deny requests, eliminating delays associated with post-request notification and ensuring security control is maintained without time loss.
3Reliability
If a single security key system is used, then simplicity is maintained, but authorization verification is insufficient
Solution Approach 1:
The access management system acts as an intermediary that coordinates between the impersonator and impersonatee using two security keys. The system receives both keys, verifies their validity, and only then grants access. This intermediary approach strengthens authorization verification by requiring dual key validation while keeping the overall system manageable through centralized coordination.
Data Source
AI summary
Techniques are disclosed for facilitating impersonation for accessing resources through an access management system. When a user (“impersonator”) requests access to impersonate another user (“impersonatee”), the access management system may generate security data having two parts. One part may include a first security key that is sent to the impersonator and a second part may include a second security key that is sent to the impersonatee. Receipt of the second security key notifies the impersonatee about a request for impersonation to access a resource according to access permitted to the impersonatee. The impersonatee, if consenting to impersonation, may provide the security key received to the impersonator, thereby implicitly providing the impersonator with trust at run-time to access the resource. Upon verification of both security keys, by the access management system, access to a resource is provided to the impersonator based on access to the resource permitted to the impersonatee.