Access Policy Manager for Resource Lockout Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in mitigating the risk of denial of service due to faulty access attempts with incorrect credentials, leading to resource locking, especially in environments with high throughput and diverse data storage technologies.
Innovation Solution
An automation tool is configured to manage access to resources by obtaining and applying access policy metadata, using an access policy manager to interface with resource providers, validate credentials, and rotate credentials to prevent account locking, thereby reducing the risk of resource denial.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If credentials are validated at each access attempt, then security is improved, but the risk of account locking increases due to faulty access attempts
Solution Approach 1:
The system performs preliminary actions by obtaining access policy metadata before validating credentials. The automation tool retrieves threshold lock policy values and other access policies in advance, allowing it to make informed decisions about whether to validate credentials without risking account locking. This preliminary retrieval of policy information enables safe credential validation while preventing harmful locking actions.
Solution Approach 2:
The system implements feedback mechanisms where the automation tool continuously monitors access attempts and compares them against retrieved access policy metadata. After each access attempt, the system feedbacks by updating the count of unsuccessful attempts and adjusting future validation decisions based on the threshold lock policy values obtained from the access policy manager, thereby dynamically preventing account locking while maintaining security.
2Measurement precision
If access policy metadata is retrieved for each resource, then access control accuracy is improved, but system complexity increases due to diverse data storage technologies
Solution Approach 1:
The access policy manager serves as an intermediary component between the automation tool and diverse data storage technologies. It abstracts the complexity of different storage systems by providing a unified interface for retrieving access policy metadata. The access policy manager handles the variability in data storage formats and protocols, allowing the automation tool to access policies without directly managing the underlying storage complexity.
Solution Approach 2:
The system achieves universality by creating a single access policy manager that can retrieve access policy metadata from multiple types of data storages. The access policy manager is designed to work with diverse storage technologies through standardized protocols, enabling the automation tool to access policies from different sources without requiring separate specialized interfaces for each storage type.
3Reliability
If credential validation is performed frequently, then authentication security is improved, but productivity decreases due to validation time
Solution Approach 1:
The system performs preliminary retrieval of access policy metadata including threshold lock policy values before credential validation begins. By obtaining this information in advance, the automation tool can prepare validation parameters and make informed decisions about whether to proceed with validation, reducing the time required during actual authentication attempts and improving overall access throughput while maintaining security.
Data Source
AI summary
The present disclosure relates to computer-implemented methods, software, and systems for managing access to protected resource and aim at mitigating the risk of denial of services for the resources. A first request is received by an access policy manager from an automation tool to obtain access policy metadata of a first resource provided at a first data storage. A second request is sent to access an interface at the first data storage to obtain the access policy metadata. The second request is generated according to a type of the first data storage. The access policy metadata relevant for the first resource is obtained to provide the access policy metadata to the automation tool.