Token-Based Resource Access in Multi-Tenant Database Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional database systems expose user identities during resource access, making them vulnerable to unwanted use and attacks like cross-site scripting and cross-site request forgery.
Innovation Solution
Implementing a unique token creation and storage mechanism associated with a tenant identifier in a multi-tenant on-demand database service, allowing access to resources without revealing the user's identity, and redirecting users to a second domain for verification and access provision.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user identity information (session cookie with credentials) is used for resource access, then resource accessibility is enabled, but security vulnerability increases due to unwanted use of user identity
Solution Approach 1:
A unique token is introduced as an intermediary between the user's identity and the resource access mechanism. The token contains encoded information about the user and their authorization, allowing resources to be accessed without directly exposing the user's identity or session credentials. This mediator approach resolves the contradiction by enabling access while protecting identity information from unwanted use.
Solution Approach 2:
Instead of using the original user identity information (session cookie with credentials) for resource access, a copy in the form of a unique token is created and used. The token replicates the necessary authorization information without containing the actual user credentials, thus enabling resource access while preventing harmful exploitation of the original identity data.
2Reliability
If user identity is made known during resource access, then authentication can be performed, but the user becomes vulnerable to attacks like cross-site scripting and cross-site request forgery
Solution Approach 1:
The system creates a unique token that copies the essential authentication information without exposing the actual user identity. This token copy enables authentication and authorization verification while preventing attacks that rely on knowing or manipulating the user's real identity, such as cross-site scripting and request forgery attacks.
Solution Approach 2:
The unique token serves as an intermediary that carries authentication information between the user agent and the server without requiring the server to handle or store sensitive user credentials. This mediator approach maintains authentication reliability while reducing attack surface by not exposing user identity information.
3Ease of operation
If session cookie with user credentials is utilized for access, then resource access is enabled, but the system becomes vulnerable to unwanted use of user identity
Solution Approach 1:
The system replaces direct use of session cookies containing user credentials with a unique token that copies the necessary access authorization information. This allows resource access to continue smoothly while protecting the original user identity data from unwanted use, as the token can be independently validated without exposing the underlying credentials.
Solution Approach 2:
The invention extracts the essential authorization information from the user's identity and session credentials, placing it into a separate unique token structure. This extraction separates the access control function from the user identity, enabling resource access while removing the vulnerability of exposing user credentials during the access process.
Data Source
AI summary
In accordance with embodiments, there are provided mechanisms and methods for enabling access to a resource of a multi-tenant on-demand database service utilizing a token. These mechanisms and methods for enabling access to a resource of a multi-tenant on-demand database service utilizing a token can be utilized to prevent identification of a user attempting to access the resource, and thus unwanted use of the user's identity.