FINE-GRAINED STRUCTURED DATA STORE ACCESS USING FEDERATED IDENTITY MANAGEMENT

• US 20170155686A1
• Filed: 02/13/2017
• Published: 06/01/2017
• Est. Priority Date: 12/16/2013
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Yanacek, David Craig, Pandey, Prashant
• Granted Patent: US 11,762,970 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/1767 Concurrency control, e.g. optimistic or pessimistic approaches
• CPC Class Codes: G06F 16/1774 Locking methods, e.g. locking methods for file systems allowing shared and concurrent access to files
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

A structured data store service, such as a database service, may implement fine-grained access to data maintained at the database service using federated identity. Fine grained access requests may be received at a database service for specified data maintained for an application provider from a client of the application provider. An access credential may be also be received. Verification of the access credential may be obtained, and the database service may evaluate the fine-grained access request according to a delegation policy corresponding to the access credential to determine whether the fine-grained request is authorized. If authorized, the fine-grained access request may be service. If not authorized, the fine-grained access request may be denied. In some embodiments, multiple application clients may have the same authorization for data, such as read authorization, while another one or more application clients may have different authorization for the data, such as write authorization.

Claims

1-21. -21. (canceled)

22. A system, comprising:

one or more hardware processors; and

memory storing program instructions that when executed implement a delegation service to;

send, in response to a first request from a client, a delegated access credential to the client to permit access to a database, wherein the delegated access credential is associated with a delegation policy allowing access to only a sub-set of a table in the database; and

send, in response to a second request from the database including the delegated access credential, the delegation policy to the database.

23. The system of claim 22, wherein the program instructions are further executable to cause the delegation service to:

prior to sending the delegation policy to the database, verify the delegated access credential included in the second request.

24. The system of claim 22, wherein the program instructions are further executable to cause the delegation service to:

prior to sending the delegated access credential to the client, verify an identity credential included in the first request.

25. The system of claim 24, wherein the program instructions are further executable to cause the delegation service to:

deny a third request for another delegated access credential based at least in part on a determination that another identity credential included in the third request is not verified.

26. The system of claim 25, wherein the program instructions are further executable to cause the delegation service to create the delegation policy that specifies an authorization rule to restrict access to specified columns, fields, or attributes in the table.

27. The system of claim 24, wherein the identity credential comprises a public certificate, and the program instructions are further executable to cause the delegation service to select the delegation policy for the delegated access credential based at least in part on the public certificate.

28. The system of claim 22, wherein the program instructions are further executable to cause the delegation service to:

create the delegation policy in response to a delegation policy creation request; and

store the delegation policy in a delegation policy data store.

29. The system of claim 28, wherein the program instructions are further executable to cause the delegation service to create the delegation policy that specifies a validation policy specifying one or more users, accounts, or clients that are authorized to use the delegation policy.

30. The system of claim 28, wherein the program instructions are further executable to cause the delegation service to create the delegation policy that specifies an authorization rule to restrict access to specified rows in the table.

31. A computer-implemented method, comprising:

sending, in response to a first request from a client, a delegated access credential to the client to permit access to a database, wherein the delegated access credential is associated with a delegation policy allowing access to only a sub-set of a table in the database; and

sending, in response to a second request from the database including the delegated access credential, the delegation policy to the database.

32. The method of claim 31, further comprising:

prior to sending the delegation policy to the database, verifying the delegated access credential.

33. The method of claim 31, further comprising causing the delegation policy to expire based at least in part on the passage of a specified period of time.

34. The method of claim 31, further comprising:

prior to sending the delegated access credential to the client, verifying an identity credential included in the first request.

35. The method of claim 34, further comprising:

receiving a third request for another delegated access credential, the third request including another identity credential;

determining from an identity provider that the other identity credential is not validated; and

denying the third request for the other delegated access credential.

36. The method of claim 34, wherein the identity credential comprises a public certificate, the method further comprising:

determining the delegation policy for the delegated access credential based at least in part on the public certificate.

37. A non-transitory computer-readable storage medium storing program instructions that when executed by one or more hardware processors cause the one or more hardware processors to:

send, in response to a first request from a client, a delegated access credential to the client to permit access to a database, wherein the delegated access credential is associated with a delegation policy allowing access to only a sub-set of a table in the database; and

send, in response to a second request from the database including the delegated access credential, the delegation policy to the database.

38. The non-transitory computer-readable storage medium of claim 37, wherein the program instructions when executed by the one or more hardware processors further cause the one or more hardware processors to:

prior to sending the delegated access credential to the client, verify an identity credential included in the first request.

39. The non-transitory computer-readable storage medium of claim 37, wherein the program instructions when executed by the one or more hardware processors further cause the one or hardware more processors to:

prior to sending the delegation policy to the database, verify the delegated access credential.

40. The non-transitory computer-readable storage medium of claim 37, wherein the program instructions when executed by the one or more hardware processors further cause the one or more hardware processors to:

prior to sending the delegated access credential;

create the delegation policy in response to a delegation policy creation request; and

store the delegation policy in a delegation policy data store.

41. The non-transitory computer-readable storage medium of claim 40, wherein the program instructions when executed by the one or more hardware processors further cause the one or more hardware processors to cause the delegation policy to expire based at least in part on the passage of a specified period of time.