Token Providing System for Secured Resource Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In large-scale computing environments, applications running on virtual machines lack secure access to resources without compromising user credentials, making them vulnerable to malicious access if credentials are obtained.
Innovation Solution
A token providing system stores a primary authentication token to obtain temporary authorization tokens from a service provider's authentication system, allowing applications to access secured resources without direct access to credentials, limiting access duration, and restricting scope.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If authentication credentials are provided to application programs or virtual machines for accessing services, then access to services is enabled, but security is compromised if the virtual machine is compromised by a malicious user
Solution Approach 1:
The authentication credentials are segmented into two parts: a long-lived primary authentication token stored securely in the token providing system, and short-lived temporary authorization tokens provided to application programs. This segmentation allows services to be accessed without exposing the full credentials, as the temporary tokens can be revoked individually and do not contain the master authentication information.
Solution Approach 2:
The token providing system acts as an intermediary between the application programs and the services. It receives the primary authentication token, generates temporary authorization tokens, and provides these to application programs. This intermediary layer prevents direct exposure of authentication credentials to application programs or virtual machines, thereby maintaining security while enabling access.
2Object-affected harmful factors
If temporary authorization tokens are used instead of authentication credentials, then security is improved, but system complexity increases due to token management
Solution Approach 1:
The token providing system performs multiple functions: it stores the primary authentication token, generates temporary authorization tokens, validates token requests, and manages token revocation. By consolidating these authentication and authorization functions into a single multi-functional system, the patent reduces overall system complexity compared to having separate mechanisms for each function.
Solution Approach 2:
The token providing system automatically generates temporary authorization tokens when it receives a valid primary authentication token, without requiring manual intervention. The system also automatically manages token expiration and revocation, reducing the operational burden and complexity of manual token management while maintaining security.
Data Source
AI summary
In general, the subject matter described in this specification can be embodied in methods, systems, and program products for providing access to secured resources. A token providing system stores a primary authentication token that is used to obtain temporary authentication tokens. The token providing system provides, to application programs that are unable to access the primary authentication token, the temporary authentication tokens. The token providing system receives, from a first application program of the application programs, a first request to obtain a first temporary authentication token. The first request does not include the primary authentication token. The token providing system transmits a second request to obtain the first temporary authentication token. The second request includes the primary authentication token. The token providing system receives the first temporary authentication token. The token providing system provides the first temporary authentication token for use by the first application program.