Authorization Delegation System for Tenant-Specific Client Registration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authorization delegation systems in cloud services lack a structure to specify the tenant for registered clients, leading to a risk of information leakage when a user's tenant is changed, potentially exposing personal or confidential information.
Innovation Solution
An authorization delegation system that includes an information processing apparatus and an authorization server, which registers clients with the ability to specify and manage tenants, ensuring that data is stored and accessed based on the correct tenant association, using modes such as Client Credentials Grant, Authorization Code Grant, and a hybrid mode to dynamically issue client IDs and secrets, thereby minimizing information leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If a client is dynamically registered in the authorization server using a client certificate, then automatic client registration is achieved, but there is no structure to specify the tenant, leading to information leakage risk
Solution Approach 1:
The system segments the authorization process by introducing a distinct tenant specification step. When a client is dynamically registered, the system now separately identifies and records the tenant information associated with that client, rather than treating all clients uniformly. This segmentation ensures that client registration and tenant association are handled as distinct but linked processes, preventing information leakage between tenants.
Solution Approach 2:
The patent introduces tenant information as an intermediary element between the client and the authorization server. This intermediary contains identification information that links the dynamically registered client to its specific tenant, acting as a mediator that ensures proper data isolation and prevents unauthorized access to other tenants' information while maintaining automated registration functionality.
2Reliability
If tenant specification is added to the authorization system, then information leakage is prevented, but the system complexity increases
Solution Approach 1:
The patent merges the tenant specification functionality into the existing dynamic client registration process. Instead of creating a completely separate tenant management system, the solution combines tenant identification and client registration into a unified flow, where tenant information is captured and stored as part of the client registration data structure, thereby reducing overall system complexity.
Solution Approach 2:
The authorization server is enhanced with multi-functionality to handle both traditional client authentication and tenant-specific authorization. The server now serves dual purposes: maintaining its原有 authentication capabilities while simultaneously managing tenant-client associations. This universal approach allows a single system to handle multiple functions without requiring separate dedicated systems for each function.
Data Source
AI summary
A device transmits an acquisition request for first authorization information indicating that a user's authority to create a tenant-dedicated client is delegated to a vendor client on the basis of first authentication information provided from an authorization server in response to the registration of the vendor client. The device registers the tenant-dedicated client in the authorization server on the basis of the first authorization information, and transmits an acquisition request for second authorization information indicating that the user's authority in a service of a resource server is delegated to the tenant-dedicated client on the basis of second authentication information provided from the authorization server in response to the registration of the tenant-dedicated client. Then the device uses the service of the resource server on the basis of the second authorization information.