Fine-Grained Token Access Control via Segmented Entitlements
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current token-based authorization systems lack fine-grained access control mechanisms, limiting their ability to restrict access to specific service types, instances, and resource types, which can lead to potential security vulnerabilities and unauthorized operations.
Innovation Solution
The proposed method introduces a token-based authorization system that includes an access control server to filter entitlements based on a subset of existing entitlements, using a standard semantic to restrict access to specific scopes, allowing for fine-grained control and limiting the impact of unauthorized operations by untrusted components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional token-based authorization systems are used, then authentication is simple and fast, but fine-grained access control to specific service types, instances, and resource types cannot be achieved
Solution Approach 1:
The patent segments the authorization system into distinct components: token issuance remains simple while a separate access control server handles fine-grained entitlement verification. The token itself is segmented to include specific scope information that enables precise access control without complicating the overall authentication flow.
Solution Approach 2:
The access control server acts as an intermediary between the token-based authentication system and the protected resources. It receives access requests, verifies tokens against fine-grained entitlements, and makes authorization decisions, thereby enabling precise access control without requiring changes to the existing token issuance mechanism.
2Reliability
If broad entitlements are granted in tokens, then access is convenient, but security vulnerabilities and unauthorized operations increase
Solution Approach 1:
The patent applies local quality by granting different levels of access rights to different tokens and resources. Instead of uniform broad or restrictive entitlements, each token is issued with specific scopes that match the required access level for particular service types, instances, and resource types, achieving both security and convenience where needed.
Solution Approach 2:
The system uses partial action by issuing tokens with only the necessary entitlements for specific operations rather than comprehensive broad access. The access control server evaluates each request against the token's specific scopes, allowing convenient access to authorized resources while restricting access to unauthorized ones.
3Reliability
If fine-grained access control is implemented, then security is enhanced, but system complexity and processing overhead increase
Solution Approach 1:
The patent extracts the fine-grained access control logic into a separate access control server component. This extraction allows the core token issuance and authentication mechanisms to remain simple while the complex entitlement verification is handled by a dedicated service, reducing overall system complexity through modularization.
4Reliability
If fine-grained access control is implemented, then security is enhanced, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary action by pre-defining scopes and entitlements in the token issuance process. The access control server uses these pre-defined scopes to quickly evaluate access requests against the token's entitlements, reducing processing time compared to evaluating complex access rules in real-time.
Data Source
AI summary
A computer-implemented method for a token-based authorization in a data processing environment may be provided. The data processing environment comprises at least a user system, an application, an authentication server and an access control server. The method comprises accessing the application via a user system request, redirecting the user access request to an authentication server, authenticating the user, wherein authentication credentials comprise a request for a restricted entitlement, wherein the restricted entitlement represents a subset of existing entitlements managed by the access control server for a resource. The method comprises also sending an access token from the authentication server to the application, requesting execution of an operation comprising invoking the operation by the application providing the access token comprising restricted entitlements, invoking the access control server, and providing the scope of the token comprising the subset of the existing entitlements.