Tenant-Specific Access Tokens for Independent Service Authorization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face vulnerabilities due to the use of a single private key for generating digital access tokens, which can compromise security, and piggy-back service systems need to interact with the token issuing system for validation and authorization, leading to scalability issues.
Innovation Solution
Generate tenant-specific digital access tokens with a header, payload, and signature using a tenant-specific private key, allowing piggy-back service systems to validate and authorize access independently without contacting the token issuing system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a single private key is used to generate all digital access tokens for the multi-tenant service, then the token generation process is simplified and faster, but the security of the system becomes vulnerable to breaches
Solution Approach 1:
The patent divides the single private key into multiple tenant-specific private keys, with each tenant having their own unique key pair. This segmentation allows each tenant to be authenticated independently using their specific key, maintaining security while enabling parallel token generation across multiple tenants without requiring a single centralized key management process.
2Reliability
If piggy-back service systems constantly query the token issuing system for digital access token validation, then authentication accuracy is maintained, but system scalability is limited due to increased interaction requirements
Solution Approach 1:
The patent embeds authentication information directly into the digital access token during its generation. The token includes the tenant identifier and authentication data that piggy-back service systems can use to validate tokens independently without needing to constantly query the token issuing system. This preliminary inclusion of validation data enables scalable authentication while maintaining accuracy.
Solution Approach 2:
The digital access token is designed to contain all necessary authentication information needed by piggy-back service systems to validate it independently. The token essentially serves itself by including the tenant identifier and authentication data, eliminating the need for continuous external validation queries and enabling the system to scale without compromising authentication accuracy.
3Reliability
If piggy-back service systems interact with the token issuing system for authorization enforcement, then authorization accuracy is maintained, but system complexity and interaction requirements increase
Solution Approach 1:
The digital access token is designed to serve multiple functions: it contains tenant identification information, authentication data, and authorization details all in one structure. This multi-functionality allows piggy-back service systems to perform both authentication and authorization enforcement using the same token without requiring separate interaction mechanisms, thereby reducing system complexity while maintaining accuracy.
Data Source
AI summary
A method and system for generating a digital access token consumable by a piggy-back service system has been developed. A request for a digital access token for a client is received. The digital access token is associated with a tenant. At least one standard claim associated with a client attribute of the client is generated. The digital access token includes a header, a payload, and a signature. The payload includes the at least one standard claim associated with the client attribute. The digital access token enables the piggy-back service system to independently authorize access by the client to at least one service at the piggy-back service system based on the at least one standard claim. The digital access token is transmitted to a first device associated with the client.