Session Password Mediator for Application-Agnostic Resource Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data access control mechanisms in applications do not support secure, application-agnostic resource access without modifying native access control mechanisms or transmitting user credentials over the network, leading to security concerns and increased development resources.
Innovation Solution
Generating session passwords for authenticated users based on access tokens, which are applied to the native access control mechanisms of applications to facilitate secure resource access without modifying the native mechanisms or transmitting credentials over the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user credentials are transmitted over the network to establish access to cloud-based resources, then resource access is enabled, but security is compromised
Solution Approach 1:
The patent introduces a session password as an intermediary credential that mediates between the user's native application access control and the cloud resource access. Instead of transmitting actual user credentials over the network, a temporary session password is generated and used exclusively for the resource access token exchange, eliminating security risks while maintaining operational ease
Solution Approach 2:
The authentication process is segmented into distinct phases: native credential verification, session password generation, and resource access token exchange. This segmentation isolates the sensitive credential verification from the network transmission phase, allowing credentials to remain secure while still enabling resource access
2Reliability
If all applications are updated to include the shared application-agnostic access control mechanism, then secure access control is achieved, but development time and resources are substantially consumed
Solution Approach 1:
The session password mechanism is designed as a universal intermediary that can be applied across any application with native access control mechanisms. Rather than requiring each application to be updated with custom access control code, the same session password approach works universally, achieving reliable secure access control without application-specific modifications
Solution Approach 2:
The session password acts as a universal mediator between diverse applications and cloud resources. This intermediary approach allows any application with standard access control to securely access cloud resources without requiring application-specific updates, significantly reducing development time while maintaining security
3Ease of operation
If authentication is performed on the application side (client side), then access control is implemented, but additional development and computing resources are consumed
Solution Approach 1:
Authentication is performed preliminarily through the native access control mechanism before the session password is generated. This preliminary authentication leverages existing application-side authentication infrastructure, avoiding the need to build additional authentication systems while still implementing comprehensive access control
Data Source
AI summary
Techniques are presented for efficiently provisioning application-agnostic resource access to a variety of applications without modification to the native access control mechanisms of the applications and without transmission of a user's credentials over the network. A user of an application is authenticated by an authorization provider. An access token for the authenticated user is generated. A session password is generated based at least in part on the access token. The session password is applied by the user to the native access control mechanism of an application to facilitate access to resources (e.g., set of subject data) by the application. The resource access is achieved without modification to the native access control mechanism of the application and without transmission of the credentials (e.g., username, password, etc.) of the user over the network.