Attribute-Based Access Control for Multi-Tenant Cloud Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current role-based access control systems in multi-tenant computing environments are cumbersome and prone to errors, as they require administrators to manage complex group memberships and nested permissions, leading to stale permissions and difficulties in tracing actual access rights, especially when users change roles or projects.
Innovation Solution
An attribute-based access control system that tags users, resources, and data with attributes, using a policy decision engine to process these attributes and enforce tenant-specific access policies, allowing for granular control and easy management of access rights.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If role-based access control systems are used to manage access in multi-tenant computing environments, then access control functionality is provided, but the system becomes cumbersome and prone to errors due to complex group memberships and nested permissions
Solution Approach 1:
The patent segments the monolithic role-based access control system into attribute-based access control, where access decisions are made by evaluating individual attributes of users, resources, and environments independently through policy rules, rather than managing complex nested roles and group memberships
Solution Approach 2:
The patent changes the fundamental parameters of access control from role-centric to attribute-centric, allowing dynamic assignment of attributes to users and resources that can be independently modified without restructuring entire role hierarchies, thereby simplifying access management operations
2Reliability
If administrators manage complex group memberships and nested permissions in role-based systems, then access control is enforced, but permissions become stale and difficult to trace when users change roles or projects
Solution Approach 1:
The patent implements continuous evaluation of attribute-based access policies, where the system continuously monitors and re-evaluates access permissions based on current attribute values, ensuring access rights remain accurate and traceable as user roles and project assignments change
Solution Approach 2:
The patent transforms static role assignments into dynamic attribute evaluations, where access permissions are determined by current attribute states rather than fixed role memberships, allowing automatic adaptation when users change roles or projects without manual intervention
3Adaptability or versatility
If traditional access control systems are used, then basic access management is provided, but they cannot easily accommodate dynamic changes in user roles and project collaborations
Solution Approach 1:
The patent creates a universal attribute-based access control framework that can accommodate multiple tenants, users, resources, and access scenarios through a single policy evaluation mechanism, eliminating the need for separate role management systems for different access scenarios
Data Source
AI summary
Access to data and resources in a multi-tenant computing system is managed by tagging the data and resources with attributes, as well as by tagging users with attributes. Tenant-specific access policies are configured. When an access request is received from a workload, a policy decision engine processes the attributes that are tagged to the requesting workload (e.g., user, application, etc.) as well as those tagged to the requested data or resource, given a relevant tenant-specific policy. An access decision is provided in response to the access request, and the access decision can be enforced by a tenant-specific enforcement system.