Stacked Resource Principal Identities for Secure Cross-Tenancy Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing approaches for enabling resources in different cloud service provider tenancies to access each other require exposing resource principal identities, compromising security and complicating policy management.

Innovation Solution

A system that allows a resource in one tenancy to access resources in another tenancy using the resource principal identity of its higher-level resource, eliminating the need for cross-tenancy policies.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If cross-tenancy policies are used to enable resource access across tenancies, then resource accessibility is improved, but security is compromised and policy complexity increases

Engineering Contradiction:

Improveresource accessibilityVSAvoidsecurity compromise

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces resource principal identities as intermediaries that enable cross-tenancy resource access without exposing internal resource details. Instead of direct access policies between tenancies, the system uses these identity tokens as mediators that authenticate and authorize resource access across tenancy boundaries, thereby maintaining security while enabling accessibility.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the cross-tenancy access control mechanism into distinct components: resource principal identities, session tokens, and policy statements. This segmentation allows each component to handle specific aspects of access control independently, reducing overall policy complexity while maintaining secure resource accessibility across tenancies.

Inventive Principle:

Principle #1Segmentation

2Adaptability or versatility

If resource principal identities are exposed to enable cross-tenancy access, then resource accessibility is improved, but security is compromised

Engineering Contradiction:

Improveresource accessibilityVSAvoidsecurity compromise

Core Design Contradiction:

Adaptability or versatilityVSObject-generated harmful factors

Solution Approach 1:

The patent creates copies of resource identification information in the form of resource principal identities and session tokens. These copies contain the necessary authorization information to access resources across tenancies without exposing the actual internal resource identifiers or sensitive details, thus enabling access while maintaining security.

Inventive Principle:

Principle #26Copying

Solution Approach 2:

Resource principal identities serve as intermediary representations that allow cross-tenancy access without direct exposure of internal resource identities. These intermediaries contain sufficient information for authorization purposes while shielding the actual resource identity structure from external tenancies.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Adaptability or versatility

If complex cross-tenancy policies are written to enable resource sharing, then resource accessibility is improved, but policy management complexity increases

Engineering Contradiction:

Improveresource accessibilityVSAvoidpolicy management complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent extracts the complex policy management burden by separating resource access authorization from tenancy-specific policy configurations. Resource principal identities contain embedded authorization information that eliminates the need for administrators to write and manage complex cross-tenancy policy statements, reducing policy management complexity while maintaining resource accessibility.

Inventive Principle:

Principle #2Taking out (Extraction)

4Ease of operation

If internal resource details are exposed to enable resource sharing, then resource accessibility is improved, but security is compromised

Engineering Contradiction:

Improveresource sharing capabilityVSAvoidsecurity compromise

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent creates simplified copies of resource identification information in the form of resource principal identities. These copies contain the necessary information for resource sharing operations without exposing internal resource details, structures, or sensitive metadata, thus enabling ease of operation while maintaining security.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS20260075054A1Secure resource access management using stacked resource principal identities

Publication Date: 2026.03.12 ORACLE INT CORP

AI summary

A system is disclosed that provides the ability for a resource residing in one tenancy of a cloud service provider infrastructure (CSPI) to use the identity of a higher-level resource upon which the resource is built to access other resources residing in another tenancy of the CSPI. The system obtains a first identity associated with the first resource that is provisioned in a first tenancy of the CSPI and obtains a first token for the first resource. The system executes instructions to obtain a second identity associated with a second resource upon which the first resource is built. The second resource resides in a second tenancy of the CSPI. The system obtains a second identity associated with the second resource and obtains a second token for the first resource. The first resource uses the second token to access resources that reside in the second tenancy of the CSPI.