Fine-grained token based access control

Patent metadata

Field	Value
Publication number	US-11277267-B2
Application number	US-202016810893-A
Country	US
Kind code	B2
Filing date	Mar 6, 2020
Priority date	May 7, 2019
Publication date	Mar 15, 2022
Grant date	Mar 15, 2022

Abstract

A computer-implemented method for a token-based authorization in a data processing environment may be provided. The data processing environment comprises at least a user system, an application, an authentication server and an access control server. The method comprises accessing the application via a user system request, redirecting the user access request to an authentication server, authenticating the user, wherein authentication credentials comprise a request for a restricted entitlement, wherein the restricted entitlement represents a subset of existing entitlements managed by the access control server for a resource. The method comprises also sending an access token from the authentication server to the application, requesting execution of an operation comprising invoking the operation by the application providing the access token comprising restricted entitlements, invoking the access control server, and providing the scope of the token comprising the subset of the existing entitlements.

First claim

What is claimed is:

1. A computer-implemented method for a token-based authorization in a data processing environment, wherein the data processing environment comprises at least a user system, an application, an authentication server and an access control server, wherein the user system is connected via a network connection to a server executing the application, wherein the application provides an access to operation, wherein at least the operation is identifiable by its identifier, the method comprising:
accessing the application via a user system request;
redirecting the user access request to an authentication server;
authenticating the user by authentication credentials exchanged between the authentication server and the application, wherein the authentication credentials comprise a request for a restricted entitlement using a standard semantic of a scope, wherein the restricted entitlement represents a subset of existing entitlements managed by the access control server for a resource;
sending an access token together with a refresh token from the authentication server to the application in response to the authentication being successful and the application being registered at the authentication server, wherein the access token and the refresh token comprises the restricted entitlement; and
requesting execution of an operation by the application initiated by the user system, wherein the requesting execution of an operation comprises:
invoking the operation by the application providing the access token comprising restricted entitlements,
invoking the access control server by the operation,
providing an identifier of the user system and the scope of the token comprising the subset of the existing entitlements to the access control server, and
using the subset of entitlements for filtering the existing entitlements by the access control server resulting in an access decision of the user system to the operation.

2. The method according to claim 1 , wherein the standard semantic is based on OAuth2.

3. The method according to claim 1 , wherein the application is an unsecured component.

4. The method according to claim 1 , wherein the request for a restricted entitlement comprised in the authentication credentials is a first request, wherein the first request comprises a maximum subset of existing entitlements.

5. The method according to claim 4 , wherein a subsequent request for a refresh token also comprises a request for a further restricted entitlement.

6. The method according to claim 1 , wherein the operation comprises at least one selected from of the group consisting of an access to predefined data, a database access, a file access, a predefined application programming interface, and an access to a specific subnet of a network.

7. The method according to claim 1 , wherein the access token has a predefined validity time.

8. The method according to claim 7 , wherein predefined validity time is updatable by a privileged user system.

9. An access system for a token-based authorization in a data processing environment, wherein the data processing environment comprises at least a user system, an application, an authentication server and an access control server, wherein the user system is connected via a network connection to a server executing the application, wherein the application provides an access to operation, wherein at least the operation is identifiable by its identifier, wherein the access system comprises one or more memories and one or more processors configured to execute instructions on the one or more memories to perform operations comprising:
accessing the application via a user system request;
redirecting the user access request to an authentication server;
authenticating the user by authentication credentials exchanged between the authentication server and the application, wherein the authentication credentials comprise a request for a restricted entitlement using a standard semantic of a scope, wherein the restricted entitlement represents a subset of existing entitlements managed by the access control server for a resource; and
sending an access token together with a refresh token from the authentication server to the application if the authentication has been successful and the application has been registered at the authentication server, wherein the access token and the refresh token comprises the restricted entitlement, wherein the user system is adapted for requesting execution of an operation by the application initiated by the user system, wherein the requesting execution of an operation comprises:
invoking the operation by the application providing the access token comprising restricted entitlements,
invoking the access control server by the operation,
providing an identifier of the user system and the scope of the token comprising the subset of the existing entitlements to the access control server, and
using the subset of entitlements for filtering the existing entitlements by the access control server resulting in an access decision of the user system to the operation.

10. The system according to claim 9 , wherein the standard semantic is based on OAuth2.

11. The system according to claim 9 , wherein the application is an unsecured component.

12. The system according to claim 9 , wherein the request for a restricted entitlement comprised in the authentication credentials is a first request, wherein the first request comprises a maximum subset of existing entitlements.

13. The system according to claim 12 , wherein a subsequent request for a refresh token also comprises a request for a further restricted entitlement.

14. The system according to claim 9 , wherein the operation comprises at least one selected from the group consisting of an access to predefined data, a database access, a file access, a predefined application programming interface, and an access to a specific subnet of a network.

15. The system according to claim 9 , wherein the access token has a predefined validity time.

16. The system according to claim 15 , wherein predefined validity time is updatable by a privileged user system.

17. A computer program product for a token-based authorization in a data processing environment, wherein the data processing environment comprises at least a user system, an application, an authentication server and an access control server, wherein the user system is connected via a network connection to a server executing the application, wherein the application provides an access to operation, wherein at least the operation is identifiable by its identifier, said computer program product comprising a computer readable storage medium having program instructions embodied therewith, said program instructions being executable by one or more computing systems or controllers to cause said one or more computing systems to:
access the application via a user system request;
redirect the user access request to an authentication server;
authenticate the user by authentication credentials exchanged between the authentication server and the application, wherein the authentication credentials comprise a request for a restricted entitlement using a standard semantic of a scope, wherein the restricted entitlement represents a subset of existing entitlements managed by the access control server for a resource;
send an access token together with a refresh token from the authentication server to the application if the authentication has been successful and the application has been registered at the authentication server, wherein the access token and the r

Assignees

• IBM

Inventors

• Smolny Martin
• Dürr Thomas
• Beck Michael
• Schaeck Juergen

Classifications

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title