Back to results
US 2022/0224535 A1Published application
Dynamic authorization and access management
AssigneeCloudentity, Inc.
InventorNathanael Coffing
Life of this patent
Estimating the term…
Abstract
A system that uses an enriched token to dynamically authorize and/or manage access to endpoint(s). The enriched token defines a scope of access with respect to the endpoint(s) and may be generated based at least in part on user context information obtained from an identity provider.
Claims21
A method for dynamic authorization and access management, the method comprising:
- receiving a request to access requested data accessible via one or more endpoints, wherein the request is transmitted to an identity provider for authentication;
- receiving, from the identity provider, a user authentication based on one or more user attributes;
- defining a scope of access to one or more portions of the one or more endpoints based on user context and one or more security policies, wherein the user context includes the user authentication;
- generating an enriched token based on the authenticated request and the defined scope of access, wherein the enriched token provides the defined scope of access;
- and
- controlling access to the requested data in accordance with the defined scope of access provided by the enriched token, wherein the defined scope of access to each portion of an endpoint is dynamically updated based on one or more modifications to the one or more security policies.
3 more elements
At least one computing device connected to a user device and an identity provider, the at least one computing device comprising:
- at least one processor;
- and
- memory storing instructions that, when executed by the at least one processor, communicate with a client application implemented by the user device and implement an authorization control plane that:
- receives an access request from the client application;
- transmits the access request to the identity provider;
- receives user context information from the identity provider;
- generates an enriched token defining a scope of access with respect to one or more endpoints based at least in part on the user context information;
- and
- provides the enriched token to the client application, which uses the enriched token to access data in accordance with the scope of access.
6 more elements
A method comprising:
- receiving, by a first microservice in a microservice mesh, a first request and an enriched token defining a scope of access with respect to one or more endpoints, the first request having been sent by a client application and requiring access to first and second protected portions of second and third microservices, respectively, in the microservice mesh;
- signing, by the first microservice, the enriched token with a first private key to produce a first signed token;
- forwarding, by the first microservice, the first signed token to the second microservice;
- the second microservice verifying the first signed token before granting access to the first protected portion;
- signing, by the second microservice, the enriched token with a second private key to produce a second signed token after the second microservice verifies the first signed token;
- calling, by the second microservice, the third microservice, the calling of the third microservice comprising forwarding the second signed token to the third microservice;
- and
- the third microservice verifying the second signed token before granting access to the second protected portion.
5 more elements
Dependencies are inferred from the claim text.