Cloud Access Control Using Attribute Tokens for Third-Party Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud computing scenarios, third-party services face challenges in obtaining subject and environment attributes from access requests, hindering effective attribute-based access control.
Innovation Solution
A method and apparatus that send subject and environment attributes from a request initiator on a cloud to a third-party service, enabling the third-party service to perform access control using attribute-based access control policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If attribute-based access control is implemented on cloud, then access control capability is improved, but third-party services cannot obtain subject and environment attributes
Solution Approach 1:
The patent introduces an attribute token issuance service as an intermediary component between the cloud platform and third-party services. This service issues attribute tokens containing subject and environment attributes to request initiators, enabling third-party services to obtain necessary attribute information without direct access to cloud internal systems. The attribute token acts as a mediator that securely transfers attribute information across system boundaries.
2Adaptability or versatility
If third-party services perform access control, then access control coverage is improved, but ability to obtain attribute information deteriorates
Solution Approach 1:
The patent implements preliminary action by having the attribute token issuance service issue attribute tokens to request initiators before they access third-party services. The tokens are obtained in advance through authentication with the cloud platform, so when third-party services receive requests, the attribute information is already embedded in the tokens, eliminating the need for third-party services to directly acquire attributes from cloud systems.
3Reliability
If attribute information is sent to third-party services, then access control effectiveness is improved, but system complexity increases
Solution Approach 1:
The patent extracts the attribute information acquisition and management functionality from the core cloud platform into a separate attribute token issuance service. This extraction allows the main cloud platform to remain simple while the specialized service handles the complexity of attribute token generation, validation, and distribution. Third-party services only need to validate tokens rather than implement complex attribute collection mechanisms.
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
A cloud computing technology-based access control method is provided, and includes: A request initiator deployed on a cloud sends an access request to a third-party service. The access request carries subject attribute information and environment attribute information of the request initiator, the subject attribute information indicates identity information of the request initiator on the cloud, and the environment attribute information indicates environment information of the request initiator on the cloud. The third-party service receives the access request. The third-party service extracts the subject attribute information and the environment attribute information from the access request, where the subject attribute information and the environment attribute information are used for calculation based on an access control policy, to determine that the third-party service allows or rejects the access request. In the access control method provided in this application, a subject attribute and an environment attribute on the cloud are sent to the external third-party service, so that the third-party service obtains the subject attribute and the environment attribute of the request initiator on the cloud, to implement an attribute-based access control capability of the third-party service.