Workflow Instance Credential Management via Intermediary Mediator
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In workflows, sharing credentials among users for collaboration is insecure and can lead to malicious activities, and users without necessary credentials may be unable to use workflows as intended, while revoking access is difficult.
Innovation Solution
A method and system for creating workflow instances from templates that allow multiple co-authors to collaborate without sharing credentials, using encrypted connections and Access Control Lists to control access, ensuring that co-authors can modify workflows but not the underlying connection credentials, thereby enhancing security and permissions management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If service account credentials are used to configure workflows, then workflows can access any resources in the system, but the workflow has excessive privileges and can be modified by end users to perform malicious activities
Solution Approach 1:
The patent introduces an intermediary credential management system that sits between the workflow and the actual credentials. Instead of giving workflows direct access to service account credentials, the system uses credential requests, approvals, and time-limited credential grants. This intermediary layer allows workflows to access necessary resources while preventing unauthorized modifications and malicious activities through controlled credential lifecycle management.
Solution Approach 2:
The patent implements dynamic credential management where credential access is not static but changes over time based on workflow needs. Credentials are granted for specific time periods, can be revoked, and are managed through a dynamic approval process. This dynamic approach allows workflows to have adequate resource access capability while limiting the window for potential malicious activities through time-bounded credential validity.
2Ease of operation
If users share credentials for collaborative workflow access, then collaboration is improved, but security is compromised and malicious activities may occur
Solution Approach 1:
The patent segments credential access by creating individual credential requests for each user-workflow pairing instead of sharing a single credential set. Each user can request credentials for specific workflows they need to collaborate on, and these credentials are managed independently. This segmentation maintains collaboration capability while improving security by eliminating the risks associated with credential sharing.
Solution Approach 2:
The system introduces an intermediary credential management service that handles collaborative access requests. Instead of users directly sharing credentials, they go through an approved credential request process where the system mediates the access. This intermediary layer enables collaboration while maintaining security through controlled credential distribution and revocation capabilities.
3Ease of operation
If credentials are shared among users for workflow access, then users can access necessary resources, but it becomes difficult to revoke access and reset credentials
Solution Approach 1:
The patent implements dynamic credential management where credentials have defined lifecycles with creation, activation, expiration, and revocation points. Access is not permanent but dynamically controlled through time-limited grants and revocable permissions. This dynamic approach makes credential management easier because access can be automatically expired or manually revoked at any point, eliminating the difficulty of credential revocation that plagues static shared credential systems.
Solution Approach 2:
The system performs preliminary actions by establishing credential expiration policies and revocation mechanisms before security issues arise. Credentials are created with predetermined expiration times and revocation capabilities built in from the start. This preliminary configuration of credential lifecycle management makes future access revocation straightforward and eliminates the need for complete credential resets when access needs to be revoked.
Data Source
AI summary
Aspects extend to methods, systems, and computer program products for creating workflow instances. Workflow templates define different functionalities, such as, for example, between fixed and variable functionality or between functionality authored by different co-authors. Different functionalities defined in a workflow template can be configured to interoperate to provide workflow instances. Functionality defined within a workflow template can be instantiated in a workflow instance based on properties corresponding to the functionality. The properties can include connections with credentials for accessing resources used by the functionality. Connections can obscure access to credentials so that processes outside of a workflow instance cannot use the credentials to access resources.