Digitally Signed Permissions Grants for Secure Privilege Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large-scale computing environments, managing user privileges efficiently while ensuring security and availability is challenging, particularly in centralized systems where immediate updates can lead to potential loss of availability.
Innovation Solution
The implementation of digitally signed permissions grants, where a resource owner uses a private cryptographic key to sign permissions grants, which are then verified by the target resource using a corresponding digital certificate, allowing authorized users to perform specific actions on resources while enabling immediate revocation of permissions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a centralized system is used to manage privileges, then immediate updates to privileges can be achieved, but availability may be lost
Solution Approach 1:
The patent divides the centralized privilege management system into distributed permission grant components stored across multiple target resources. Each target resource maintains its own permission grants independently, eliminating the single point of failure while ensuring privilege updates are propagated through digital signatures rather than centralized control.
Solution Approach 2:
The patent implements local privilege management where each target resource stores and validates permission grants independently using digital signatures. This allows local verification of privileges without requiring continuous connection to a centralized authority, maintaining both update reliability and system availability.
2Reliability
If digitally signed permissions grants are implemented, then security is improved, but device complexity increases due to hardware requirements
Solution Approach 1:
The patent introduces digital certificates as an intermediary mechanism that enables secure permission grants without requiring complex hardware authentication systems. The digital signatures act as mediators between the resource owner and target resources, providing strong security through cryptographic verification while maintaining system simplicity.
3Reliability
If immediate revocation of permissions is enabled, then security risks are reduced, but system complexity increases
Solution Approach 1:
The patent implements preliminary action by requiring permission grants to be digitally signed before being applied to target resources. This pre-authorization mechanism allows immediate revocation simply by removing or invalidating the digital signature, providing rapid security response without complex real-time management systems.
Data Source
AI summary
A resource owner or administrator submits a request to a permissions management service to create a permissions grant which may include a listing of actions a user may perform on a resource. Accordingly, the permissions management service may create the permissions grant and use a private cryptographic key to digitally sign the created permissions grant. The permissions management service may transmit this digitally signed permissions grant, as well as a digital certificate comprising a public cryptographic key for validating the permissions grant, to a target resource. The target resource may use the public cryptographic key to validate the digital signature of the permissions grant and determine whether a user is authorized to perform one or more actions based at least in part on a request from the user to perform these one or more actions on the resource.