Limiting access to application features in cloud applications

• US 10,657,239 B2
• Filed: 09/29/2017
• Issued: 05/19/2020
• Est. Priority Date: 05/25/2017
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Gravenites, Greg, Rafique, Arif, Modi, Rajan Mahendrakumar, Suresh, Sindhu
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US15/720,940
• Publication Number:
  US 20180341762A1
• Time in Patent Office: 963 Days
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

Techniques are provided for limiting access to a feature in an application. Certain application features, such as access controlled features, are not generally accessible to all users of an integration cloud service system. When a user makes a request to access an access controlled feature, the system can determine whether user information satisfies the requirements to access a requested access controlled feature. If the user satisfies the requirements for the requested access controlled feature, an access key can be dynamically generated based on the user information.

Claims

1. A method for providing access to an application feature, the method comprising:

receiving, by an integration cloud service system of a cloud environment, a request to access an access controlled feature in an application in the cloud environment, wherein the access controlled feature is configured to be accessed by using an access key that is generated based on user information;

dynamically generating, by the integration cloud service system, the access key for the access controlled feature in the application based on the user information, wherein the user information comprises at least one from a group consisting of a user role, a user permission, user environment information, user system version information, and feature information;

validating, by the integration cloud service system, the access key for the access controlled feature in the application based on the user information; and

in response to the access key being valid, executing, by the integration cloud service system the access controlled feature in the application.

2. The method according to claim 1, wherein the user information comprises environment information, a cloud application instance information, and a unique ID of the application feature.

3. The method according to claim 2, wherein the environment information comprises one of a production environment, a development environment, and a test environment.

4. The method according to claim 2, wherein the cloud application instance information comprises a version number of the integration cloud service system.

5. The method according to claim 2, wherein the access key comprises a string of characters that uniquely identifies the environment information, the cloud application instance information, and the unique ID of the application feature.

6. The method according to claim 5, wherein the validating the access key for the feature in the application comprises:

receiving, on a user interface for the access controlled feature, the access key; and

determining whether the access key corresponds to at least one of the environment information, the cloud application instance information, and the unique ID of the application feature; and

in response to the access key corresponding to one of the environment information, the cloud application instance information, and the unique ID, determining that the access key is valid.

7. The method according to claim 5, wherein the validating the access key for the feature in the application comprises:

receiving, on a user interface for the access controlled feature, the access key;

determining whether the access key corresponds to the environment information, the cloud application instance information, and the unique ID of the application feature; and

in response to the access key corresponding to the environment information, the cloud application instance information, and the unique ID, determining that the access key is valid.

8. The method according to claim 1, wherein the feature comprises a functionality configured to be applied to the application.

9. The method according to claim 1, wherein the application is an integrated cloud service application.

10. The method according to claim 1, wherein an end user device of the integration cloud service system receives the request to access the access controlled feature in the application.

11. A computing device for providing access to an application feature, the computing device comprising:

a memory; and

one or more processors in an integration cloud service system of a cloud environment, the one or more processors configured to;

receive a request to access an access controlled feature in an application in the cloud environment, wherein the access controlled feature is configured to be accessed by using an access key that is generated based on user information;

dynamically generate the access key for the access controlled feature in the application based on the user information;

validate the access key for the access controlled feature in the application based on the user information, wherein the user information comprises at least one from a group consisting of a user role, a user permission, user environment information, user system version information, and feature information; and

in response to the access key being valid, execute the access controlled feature in the application.

12. The computing device according to claim 11, wherein the user information comprises environment information, a cloud application instance information, and a unique ID of the application feature.

13. The computing device according to claim 12, wherein the environment information comprises one of a production environment, a development environment, and a test environment.

14. The computing device according to claim 12, wherein the cloud application instance information comprises a version number of the integration cloud service system.

15. The computing device according to claim 12, wherein the validating the access key for the feature in the application comprises:

receiving, on a user interface for the access controlled feature, the access key;

determining whether the access key corresponds to the environment information, the cloud application instance information, and the unique ID of the application feature; and

in response to the access key corresponding to the environment information, the cloud application instance information, and the unique ID, determining that the access key is valid.

16. A non-transitory computer readable storage medium storing instructions which, when executed by one or more processors of a computing device, cause the one or more processors to perform a method comprising:

receiving, by an integration cloud service system of a cloud environment, a request to access an access controlled feature in an application in the cloud environment, wherein the access controlled feature is configured to be accessed by using an access key that is generated based on user information;

dynamically generating, by the integration cloud service system, the access key for the access controlled feature in the application based on the user information, wherein the user information comprises at least one from a group consisting of a user role, a user permission, user environment information, user system version information, and feature information;

validating, by the integration cloud service system, the access key for the access controlled feature in the application based on the user information; and

in response to the access key being valid, executing, by the integration cloud service system the access controlled feature in the application.

17. The computer readable storage medium according to claim 16, wherein the user information comprises environment information, a cloud application instance information, and a unique ID of the feature in the application.

18. The computer readable storage medium according to claim 17, wherein the environment information comprises one of a production environment, a development environment, and a test environment.

19. The computer readable storage medium according to claim 17, wherein the cloud application instance information comprises a version number of the integration cloud service system.

20. The computer readable storage medium according to claim 17, wherein the validating the access key for the feature in the application comprises:

receiving, on a user interface for the access controlled feature, the access key;

determining whether the access key corresponds to the environment information, the cloud application instance information, and the unique ID of the feature in the application ; and

in response to the access key corresponding to the environment information, the cloud application instance information, and the unique ID, determining that the access key is valid.