Token-Based Access Control for Cloud Service Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems that operate on cloud networks face security risks due to unrestricted access, while overly restricted access can lead to performance reductions, necessitating a balanced approach to manage access to services and resources.
Innovation Solution
A computing system that issues access tokens based on access policies, allowing requesting components to access requested service components while ensuring authentication and authorization, thereby controlling access and maintaining system security and performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If unrestricted access is allowed between services and resources on the cloud network, then system performance and accessibility are improved, but security risks increase
Solution Approach 1:
The patent introduces an access control system with token issuers and token authentication modules as intermediaries between services and resources. These intermediaries validate access requests and issue tokens that grant authorized access, thereby enabling secure communication without requiring unrestricted access between all services. The intermediary validates credentials and manages the access decision, resolving the contradiction by allowing controlled access while maintaining security.
Solution Approach 2:
The system changes the access control parameters from binary (allowed/denied) to granular (fine-grained permission levels). By implementing token-based access control with specific permission scopes, the system can allow certain operations while denying others, enabling optimized performance for authorized operations while blocking potentially harmful access patterns, thus resolving the security-performance tradeoff.
2Object-affected harmful factors
If overly restricted access control is implemented, then security is improved, but system performance and productivity decrease
Solution Approach 1:
The patent implements local quality by granting different access permission levels to different services and resources based on their specific needs and trust levels. Instead of uniform restriction, the system tailors access control policies to individual service-component pairs, allowing high-performance operations for trusted services while maintaining security for untrusted ones. This granular approach resolves the contradiction by optimizing performance for authorized access while maintaining security where needed.
3Object-affected harmful factors
If access control policies are strictly enforced, then system security is improved, but access time and operational complexity increase
Solution Approach 1:
The system performs preliminary action by pre-validating service credentials and pre-issuing access tokens before actual resource access is needed. The token issuer validates service identities and issues tokens in advance, so that when services need to access resources, they can present pre-validated tokens rather than undergoing full authentication at access time. This reduces access time while maintaining security through preliminary verification.
Solution Approach 2:
The patent enables continuity of useful action by implementing continuous token validation rather than one-time authentication. The token authentication module continuously validates tokens during service operations, allowing services to maintain access without repeated authentication delays. This continuous validation approach resolves the contradiction by maintaining security through ongoing verification while avoiding the time penalty of repeated full authentication cycles.
Data Source
AI summary
A computing system controls access between components. A token issuer issues an access token to a requesting component, that is requesting access to a requested service component, based at least in part on an access policy. The requesting component sends the token to the requested service component, which includes a token authentication module that validates the access token and authorizes the requesting component to access a requested service component, and receives the authorization to access the requested service component.