In-Session Authorization Rechecks After Access Policy Changes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authorization processes in cloud computing environments do not effectively adapt to changes in access policies during a session, leading to potential unauthorized actions by computing entities.
Innovation Solution
Periodically or intermittently re-executing authorization processes based on a current set of access policies to determine updated sets of authorized actions for computing entities, triggered by time intervals or events, and using cached identity information to streamline the process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If authorization processes are executed only once at session start, then processing efficiency is maintained, but security is compromised as policy changes are not detected
Solution Approach 1:
The system implements periodic re-execution of authorization processes at defined intervals during the session, rather than executing only once at start or continuously. This periodic approach ensures policy changes are detected while maintaining reasonable processing efficiency.
Solution Approach 2:
The system establishes feedback mechanisms that monitor for policy changes and trigger re-execution of authorization processes. This feedback loop ensures that when access policies are modified, the computing entity's authorized actions are re-evaluated to maintain security.
2Reliability
If authorization processes are re-executed frequently, then security is improved by detecting policy changes, but system performance deteriorates
Solution Approach 1:
The system executes authorization processes at periodic intervals rather than continuously or too frequently, balancing security requirements with system performance. This controlled periodic re-execution prevents performance degradation while maintaining security.
Solution Approach 2:
The system dynamically adjusts the authorization re-execution strategy based on session state, policy change events, and system conditions. This dynamic approach optimizes the balance between security and performance by re-executing only when necessary.
3Measurement precision
If complete authorization processes are re-executed, then accuracy of authorized actions is ensured, but processing overhead increases
Solution Approach 1:
The system extracts and re-evaluates only the necessary authorization components that may have changed due to policy modifications, rather than re-executing the complete authorization process from scratch. This extraction approach reduces processing overhead while maintaining accuracy.
Solution Approach 2:
The system performs preliminary checks to identify which authorization elements need re-evaluation based on policy change notifications, preparing only the necessary components for re-execution. This preliminary filtering reduces the overall processing overhead.
Data Source
AI summary
A system executes an authorization process for initiating a session with a computing entity. Executing the authorization process includes determining an identity associated with the computing entity, identifying a current set of access policies associated with the identity, and determining, based on the current set of access policies, a first set of actions that the computing entity is authorized to perform. While executing the session, the system executes a first action in accordance with the current set of access policies. Subsequent to executing the first action, the set of access policies is modified. The system detects an occurrence of a trigger condition, and in response, re-executes the authorization process for the session, including determining, based on the modified set of access policies, a second set of actions the computing entity is authorized to perform that differs from the first set of actions.