Context-Based Access Tokens for Multi-Cloud Data Usage Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing role-based access control (RBAC) systems in cloud computing environments lack fine granularity control over data access and usage, particularly in multi-tenant systems, leading to inefficiencies and manual, disjointed processes due to static permissions and platform incompatibilities.
Innovation Solution
A three-phase context-based authorization process that generates cloud-neutral access tokens, which are then converted into cloud-specific tokens to automate dynamic data access and usage permissions across multiple platforms, ensuring precise control over data access per client, application, data type, and data table.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If role-based access control (RBAC) is used to control data access, then data access control is implemented, but fine granularity control of data usage cannot be enforced
Solution Approach 1:
The patent segments access control into two distinct phases: authorization (granting access) and usage control (enforcing purpose). This is achieved through separating the RBAC mechanism from the usage purpose enforcement, allowing independent control over access rights and data usage policies. The usage purpose is tracked through metadata and enforced through continuous monitoring rather than being bundled with access permissions.
Solution Approach 2:
The patent introduces a usage purpose metadata structure as an intermediary between the data owner and the data user. This metadata includes fields for intended purpose, allowed operations, and time constraints, acting as a mediator that carries usage requirements through the system. Additionally, a usage control module serves as an intermediary that intercepts and validates data access requests against usage policies before allowing operations.
2Adaptability or versatility
If roles are constantly changed to enforce dynamic purposes, then data usage control is improved, but manual process complexity increases
Solution Approach 1:
The patent implements dynamic usage control through time-based validation and context-aware enforcement. Usage purposes are defined with temporal parameters (start time, end time, duration) and are automatically validated against current system state. The usage control module dynamically evaluates access requests against usage policies without requiring manual role modifications, adapting to changing conditions automatically through programmed logic rather than manual intervention.
3Adaptability or versatility
If access control is implemented across multiple cloud platforms, then platform compatibility is improved, but system complexity increases
Solution Approach 1:
The patent creates a universal usage control framework that operates independently of underlying cloud platforms. The usage purpose metadata structure and control logic are designed to be platform-agnostic, defining a common interface for usage policy enforcement. The system translates platform-specific access control mechanisms into a unified usage control model, allowing the same usage policies to be enforced across AWS, Azure, GCP, and other platforms without platform-specific customization.
4Ease of operation
If static permissions are used in RBAC, then access control is simplified, but scalability is reduced
Solution Approach 1:
The patent performs preliminary action by establishing usage purposes and policies in advance through structured metadata definitions. Data owners pre-specify usage requirements, allowed operations, and constraints before data is accessed. This preliminary configuration enables automated real-time enforcement without requiring complex runtime decision-making or manual role changes, scaling efficiently as the system can automatically evaluate pre-defined usage policies against any access request without proportional increases in management overhead.
Data Source
AI summary
System and method for fine granularity control of data access and usage for across multi-tenant systems. A user makes a request to access a particular set of data from a particular remote data source for a specific purpose. The system authorizes the user to validate whether the user is qualified to make the request. The data source is checked to see if the particular data has been granted access for that particular purpose. A cloud neutral token is created and converted into a cloud specific token upon reaching the remote data source. The cloud specific token is used to create a temporary IAM role and IAM policy with a predetermined time to live. After the time to live expires, the IAM role and IAM policy are deleted.