Token-Based Access Control via Role Assumption

The patent introduces role-assumption as an intermediary mechanism between users and resources. Instead of directly propagating user credentials to multiple resources, users assume roles that represent groups or resource access patterns. This role-assumption layer mediates the authentication process, allowing users to gain access to resources associated with assumed roles without requiring direct credential propagation to each resource.

The patent creates role-identities as copies or representations of user identities with specific access permissions. When a user assumes a role, they temporarily adopt the permissions associated with that role without sharing their actual credentials. This copying approach allows multiple users to assume the same role and access the same resources without requiring credential propagation among users or from administrators to each user.

The patent implements dynamic role-assumption where users can temporarily assume roles for specific durations or until the role is exited. This dynamic approach combines the security benefits of short-term credentials with the flexibility of group behavior. Users obtain short-term role-identities that expire or can be revoked, yet multiple users can simultaneously assume the same role to achieve group-like access patterns.

The role-assumption mechanism serves multiple functions: it provides short-term security credentials, enables group behavior through shared role access, and maintains centralized control. A single role-identity can be assumed by multiple users, effectively creating group access rights without requiring credential propagation or long-term credential sharing.

The patent extracts the actual user credentials from the authentication process and replaces them with role-identities. User credentials remain securely stored in the identity provider and are never propagated to resources. Instead, short-term role-identities are issued that reference the user's assumed roles, effectively taking out the vulnerable credential propagation step while maintaining access control functionality.

The patent uses short-term, disposable role-identities instead of long-term reusable credentials. These role-identities have limited lifetimes and can be revoked or expire automatically, reducing the window of opportunity for attackers. If compromised, the damage is limited because the credentials are short-lived and can be quickly rotated without affecting the underlying user credentials.