Cloud Access Control with Attribute Tokens for Third-Party Requests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Third-party services in cloud computing environments face difficulties in obtaining subject and environment attributes from access requests, hindering effective attribute-based access control.
Innovation Solution
A method and apparatus that enable a request initiator to send subject and environment attributes to a third-party service via an access request, utilizing attribute token issuance services and cloud management platforms to ensure integrity and reliability, allowing the third-party service to perform attribute-based access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If attribute-based access control is implemented for cloud resources, then access control security is improved, but third-party services cannot obtain subject and environment attributes to perform access control
Solution Approach 1:
The patent introduces an attribute token as an intermediary that carries subject and environment attributes from the cloud environment to the third-party service. The attribute token is generated by the cloud environment based on the subject's credentials and includes encoded attribute information that the third-party service can extract and use for access control decisions, thus bridging the information gap without exposing internal cloud attributes directly.
Solution Approach 2:
The patent segments the attribute information into distinct components: subject attributes (identity, roles, permissions) and environment attributes (cloud platform, resource type, location). These segmented attributes are separately extracted, encoded into the attribute token, and transmitted to the third-party service, enabling structured access control while maintaining information organization and security.
2Adaptability or versatility
If third-party services obtain attribute information from access requests, then access control capability is improved, but the complexity of attribute extraction and verification increases
Solution Approach 1:
The patent applies preliminary action by pre-generating the attribute token in the cloud environment before the third-party service processes the access request. The attribute token is created with all necessary subject and environment attributes already extracted, encoded, and packaged in a standardized format. This preliminary preparation eliminates the need for the third-party service to perform complex attribute extraction and verification, reducing its complexity while maintaining versatile access control capability.
Data Source
AI summary
A cloud computing technology-based access control method is provided, and includes: A request initiator deployed on a cloud sends an access request to a third-party service. The access request carries subject attribute information and environment attribute information of the request initiator, the subject attribute information indicates identity information of the request initiator on the cloud, and the environment attribute information indicates environment information of the request initiator on the cloud. The third-party service receives the access request. The third-party service extracts the subject attribute information and the environment attribute information from the access request, where the subject attribute information and the environment attribute information are used for calculation based on an access control policy, to determine that the third-party service allows or rejects the access request.