Trusted Service Token Acquisition for Non-Interactive Cloud Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication systems, such as OAuth, require user presence to validate credentials for non-interactive services accessing cloud-based resources, making it difficult to integrate on-premises services with cloud-based authentication systems without exposing user credentials.
Innovation Solution
A trusted service establishes a trust relationship with an identity provider to acquire tokens without presenting user credentials, allowing it to access cloud services on behalf of users even in their absence, using APIs or token acquisition methods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If user credentials are stored to enable non-interactive access, then automation capability is improved, but security deteriorates due to credential exposure risks
Solution Approach 1:
The patent introduces a trusted service as an intermediary component that mediates between the non-interactive service and the identity provider. The trusted service holds the user's credentials securely and uses them to obtain access tokens, which are then passed to the cloud service. This intermediary approach enables automation while preventing direct credential exposure, as the credentials never leave the trusted service's secure environment.
2Object-affected harmful factors
If OAuth protocol is used to protect user credentials, then security is improved, but usability deteriorates due to requirement of user presence
Solution Approach 1:
The patent implements preliminary action by having the user authenticate once with the identity provider through the trusted service before automated operations begin. The trusted service stores the obtained access tokens and uses them for subsequent automated interactions with the cloud service. This preliminary authentication eliminates the need for user presence during automated background operations, while maintaining OAuth security standards.
3Adaptability or versatility
If on-premises services integrate with cloud authentication systems, then system integration capability is improved, but complexity increases due to authentication protocol requirements
Solution Approach 1:
The trusted service implements self-service by automatically managing the authentication workflow with the identity provider. It handles token acquisition, validation, and refresh operations without requiring manual intervention or complex configuration on the on-premises service side. The on-premises service simply needs to present its credentials to the trusted service, which then handles all authentication complexity internally, enabling easy integration while maintaining security.
Data Source
AI summary
A “trusted service” establishes a trust relationship with an identity provider and interacts with the identity provider over a trusted connection. The trusted service acquires a token from the identity provider for a given user (or set of users) without having to present the user's credentials. The trusted service then uses this token (e.g., directly, by invoking an API, by acquiring another token, or the like) to access and obtain a cloud service on a user's behalf even in the user's absence. This approach enables background services to perform operations within a hosted session (e.g., via OAuth-based APIs) without presenting user credentials or even having the user present.