Service-to-Service Authentication via Token Pattern Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud computing systems face challenges in managing complex token types and authentication schemes, requiring labor-intensive and error-prone code logic changes when new token types or authentication schemes are introduced, leading to inefficient and costly configurations.
Innovation Solution
Deploy an authentication agent that maps features of security tokens and authentication requests to corresponding authentication patterns, allowing efficient modification, addition, or deletion of token types and schemes without altering platform service configurations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If human users directly access and manage cloud resources, then ease of operation is improved, but security risks increase due to exposed credentials and potential misuse
Solution Approach 1:
The patent introduces service accounts as intermediary entities between human users and cloud resources. Instead of users directly accessing resources with their credentials, service accounts act as mediators that perform automated operations. This resolves the contradiction by maintaining ease of operation through automated service access while eliminating security risks associated with exposing human user credentials to machines and services.
Solution Approach 2:
The patent enables services and applications to authenticate and access cloud resources autonomously using service account credentials. The system self-manages authentication without requiring human user intervention, allowing services to independently obtain and use access tokens. This resolves the contradiction by improving ease of operation through automated self-service access while preventing security risks by isolating service credentials from human users.
2Reliability
If service accounts are implemented for machine-to-machine authentication, then security is improved by isolating credentials, but device complexity increases due to additional authentication layers
Solution Approach 1:
The patent creates a universal service account framework that can be applied across multiple cloud services and resources. A single service account infrastructure handles authentication for various services, applications, and automated processes throughout the cloud environment. This resolves the contradiction by improving security through consistent credential isolation while reducing device complexity by providing a unified, reusable authentication mechanism rather than separate solutions for each service.
Solution Approach 2:
The service account acts as a standardized intermediary layer between services and cloud resources. This mediator handles all authentication operations uniformly, providing a simple interface for services to obtain access tokens while managing the complexity of credential management internally. This resolves the contradiction by improving security through the mediator's credential isolation while presenting a simple, low-complexity interface to services.
3Ease of operation
If traditional authentication methods are used for all access, then ease of operation is maintained for human users, but productivity decreases due to manual authentication processes for services
Solution Approach 1:
The patent segments authentication methods by user type: human users continue to interact through familiar interfaces while services use automated service account authentication. This segmentation allows human users to maintain ease of operation through traditional methods while services achieve high productivity through automated token-based authentication without manual intervention.
Solution Approach 2:
The patent implements dynamic authentication where the system automatically selects the appropriate authentication method based on the caller type. Human users experience traditional interactive authentication while services receive automated service account authentication with programmatically obtainable access tokens. This dynamic approach resolves the contradiction by optimizing ease of operation for humans and productivity for services simultaneously.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Techniques of service to service authentication in distributed computing systems are disclosed herein. One example technique includes identifying a token type of a security token and an authentication scheme indicated in an access request for authenticating the access request. The example technique also includes using a combination of the identified token type of the security token and the authentication scheme indicated in the access request as a key to locate an authentication pattern in a mapping table and identifying an authentication policy corresponding to the authentication pattern. The example technique can then include applying the identified authentication policy to the received data package to authenticate the access request based on the security token and conditionally providing the client service access to the platform service.