Web Service Authorization via Segmented Authentication Tokens
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Web service systems lack the ability to provide authorization for access to protected resources, often trusting any entity from a trusted location, leading to potential unauthorized access.
Innovation Solution
A computing system and method that receive requests to access protected Web service resources, determine if authorization is required, and only permit access after receiving authorization from an authorized entity, using protocols like SOAP and WS-RT to manage and communicate authorization status.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional authentication methods are used to protect Web service resources, then trust relationships can be established, but the system cannot provide authorization for specific requests and may trust any entity from a trusted location
Solution Approach 1:
The patent segments the authentication process into two distinct phases: authentication (verifying identity) and authorization (granting specific permissions). This separation allows the system to maintain trust relationships while adding granular control over specific resource access, resolving the contradiction between security and authorization capability.
Solution Approach 2:
The patent introduces an authorization token as an intermediary element between the authenticated entity and the protected resource. This token carries specific authorization information and enables the system to grant or deny access to particular resources without compromising the underlying trust relationship, thus providing adaptability while maintaining security.
2Ease of operation
If the Web service trusts any entity from a trusted location, then access is easily granted, but unauthorized access to protected resources may occur
Solution Approach 1:
The patent applies local quality by assigning different authorization levels to different resources and requests. Instead of a blanket trust approach, each resource can have its own access control policies, allowing the system to easily grant access to authorized entities while protecting specific resources from unauthorized access through localized authorization rules.
Solution Approach 2:
The patent implements preliminary action by obtaining authorization tokens before accessing protected resources. This pre-authorization mechanism ensures that entities have explicit permission before accessing sensitive data or functions, preventing unauthorized access while maintaining ease of operation for legitimately authorized entities.
3Reliability
If authorization is required for protected resources, then security is enhanced, but the system complexity increases
Solution Approach 1:
The patent implements self-service through self-contained authorization tokens that carry all necessary authorization information. The tokens enable the system to verify authorization without requiring complex real-time validation or additional infrastructure, thus enhancing security while minimizing system complexity through autonomous token-based verification.
Data Source
AI summary
A web service includes a protected resource. A requester requests access to the protected resource by sending a request to the web service. The web service prevents access to the web service until the request has been authorized by an authorizer. After the request has been authorized by the authorizer, the web service allows the requester to access the protected resource.