Scoped Token Derivation for Cloud Service Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing, users often face difficulties in determining the exact scope required for tokens, leading to over-scoped tokens that pose security risks by providing excessive access to resources.
Innovation Solution
A method and apparatus for determining token scope information, where a server collects data from another server, derives token scope information based on the operation requested by a client, and sends this information to the client to enable the issuance of a scoped token with precise capabilities, thereby preventing excessive access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a user requests a scoped token with broad capabilities to ensure access to required operations, then the user can perform the intended operation, but the token provides excessive access to other restricted resources creating security risks
Solution Approach 1:
The patent segments token scope information into distinct categories (service endpoint, operation type, resource identifier) and derives minimal required scope for each. The token scope is divided into necessary capabilities for the intended operation versus unnecessary capabilities that create security risks, allowing precise allocation of permissions.
Solution Approach 2:
The patent applies local quality by providing different scope information for different service endpoints and operations. Instead of a uniform broad scope, each token request receives customized scope information tailored to the specific operation and resource, ensuring that permissions are localized to exactly what is needed for that particular operation.
2Object-affected harmful factors
If a user determines the exact scope required for a token to minimize permissions, then security risks are reduced, but it becomes difficult for the user to determine the precise capabilities needed
Solution Approach 1:
The patent introduces an intermediary mechanism (the server system) that automatically derives token scope information based on the requested operation and service endpoint. This intermediary translates high-level operation requests into precise scope definitions, relieving users of the burden of manually determining exact permissions while maintaining security.
Solution Approach 2:
The system provides feedback to users about the derived token scope information, allowing them to verify that the scope is appropriate for their intended operation. This feedback loop ensures that the automatically derived scope matches user expectations while maintaining minimal necessary permissions.
3Object-affected harmful factors
If a token is bound to a particular service endpoint to limit access, then security is improved, but the token cannot be used for other valid operations that the user may need to perform
Solution Approach 1:
The patent implements dynamic scope binding where the token scope is determined at the time of token request based on the specific operation and service endpoint needed. Rather than static broad permissions or overly restrictive fixed bindings, the scope dynamically adapts to the actual requirements of each operation, allowing versatile access while maintaining security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method, performed by a server, for determining token scope information so that a client can obtain a scoped token for a cloud service is disclosed. The method comprises requesting and receiving data of a cloud service from another server, receiving a token scope information request for an operation of the cloud service from a client and deriving token scope information based on the data for said operation. The method further comprises sending token scope information to the client so that the client can request a scoped token with capabilities enabling them to access the operation of the cloud service.