Automated Token Key Lifecycle Management in Multi-Tenant Networks

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current manual workflows for key management in multi-tenant networks are inefficient and prone to errors, lacking automation in managing authentication and authorization tokens with life key management mechanisms.

Innovation Solution

An automated framework for authentication and authorization token management using life key management, which includes an RBAC-based system that employs SAML tokens encrypted with separate keys for each tenant, and an AA key manager that handles key life cycles such as expiration, revocation, suspension, renewal, and destruction automatically, reducing user intervention and potential errors.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If manual workflows are used for key management, then flexibility in key management policies can be maintained, but efficiency and error-proneness worsen

Engineering Contradiction:

Improvekey management efficiencyVSAvoiderror-proneness

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system enables self-service through automated key lifecycle management where the AA key manager automatically performs key generation, distribution, rotation, and revocation without manual intervention. The system monitors token validity periods and automatically renews or revokes keys based on predefined policies, eliminating manual errors while maintaining security control.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system performs preliminary actions by pre-configuring key management policies and validity periods before tokens are issued. Key rotation schedules and revocation criteria are established in advance, allowing the automated system to execute predetermined security actions without requiring manual decision-making during critical operations.

Inventive Principle:

Principle #10Preliminary action

2Productivity

If automated key management is implemented, then efficiency and error reduction improve, but system complexity increases

Engineering Contradiction:

Improvetoken management automationVSAvoidsystem complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The AA key manager serves as an intermediary component that simplifies the overall system architecture. It centralizes key management functions, acting as a single point of control that mediates between multiple tenants and the authentication system. This intermediary approach reduces complexity by consolidating distributed key management tasks into a unified automated service.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The AA key manager implements multi-functionality by handling multiple key management operations (generation, distribution, rotation, revocation, monitoring) through a single automated system. This universal approach eliminates the need for separate manual processes for each key lifecycle event, reducing overall system complexity while improving efficiency.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Reliability

If tokens are encrypted with separate keys for each tenant, then data security and isolation improve, but key management complexity increases

Engineering Contradiction:

Improvedata securityVSAvoidkey management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system applies segmentation by assigning dedicated encryption keys to each tenant, creating logical separation of cryptographic materials. Each tenant's tokens are encrypted with their own unique key, ensuring that compromise of one tenant's key does not affect others. The automated key manager segments key management operations by tenant, tracking and controlling each key's lifecycle independently.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

While maintaining separate keys for each tenant, the system merges key management operations into a unified automated process. The AA key manager combines multiple tenant-specific key operations into a single automated workflow, managing all tenant keys through one system interface rather than requiring separate manual management for each tenant's keys.

Inventive Principle:

Principle #5Merging (Combining)

4Loss of time

If manual key management processes are used, then system simplicity is maintained, but time consumption and operational overhead increase

Engineering Contradiction:

Improvetime consumptionVSAvoidoperational overhead

Core Design Contradiction:

Loss of timeVSEase of operation

Solution Approach 1:

The automated key management system ensures continuity of useful action by continuously monitoring token validity, automatically renewing keys before expiration, and maintaining uninterrupted security coverage. The system operates continuously without manual intervention, eliminating gaps in key management coverage and reducing operational downtime associated with manual key rotation and renewal processes.

Inventive Principle:

Principle #20Continuity of useful action

Data Source

PatentUS10673628B1Authentication and authorization token management using life key service

Publication Date: 2020.06.02 EMC IP HLDG CO LLC

AI summary

Embodiments are directed to a method and system for managing token keys in an authentication and authorization process for a multi-tenant computer network by receiving a user request from a user through a user agent for data access to network clients, generating a key to encrypt and sign a data string to encapsulate a token, passing the token as part of the request to the network clients to receive a response from a client to the user request, notifying, in the event of a key state change, user agents of the key state change asynchronously to other events, and generating a refreshed key for subsequent user requests to encapsulate subsequent tokens for the user.