Application-Independent Access Control for Cloud Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional access control in cloud-services computing environments relies on role-based control implemented by individual applications, which is inefficient and often performs after-the-fact control, failing to provide real-time protection against unauthorized access to confidential information.
Innovation Solution
Implementing application-independent access control using guest introspection services, where a dedicated service virtual machine offloads security functions and performs access control based on user identity, process-related data, and network routing addresses, enabling real-time access control before tasks are initiated.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If role-based access control is implemented by each individual application, then each application can control access to its own resources, but the system complexity increases and real-time security protection is not achieved
Solution Approach 1:
The patent extracts the access control functionality from individual applications and consolidates it into a separate access control subsystem. This subsystem independently evaluates user requests against security policies and makes access decisions, removing the burden of implementing access control logic from each application while maintaining comprehensive security coverage across the entire system.
Solution Approach 2:
The patent introduces an intermediary access control subsystem that sits between users and applications. This intermediary receives user requests, evaluates them against security policies considering multiple factors (user role, resource sensitivity, contextual information), and mediates access by allowing or blocking requests before they reach the applications, thereby centralizing security management.
2Reliability
If after-the-fact access control is performed by individual applications, then access decisions can be made based on application-specific logic, but real-time security protection against unauthorized access is not achieved
Solution Approach 1:
The patent implements preliminary access control by evaluating security policies and making access decisions before the actual resource access occurs. The access control subsystem pre-assesses user requests against security policies, including considerations of user identity, resource sensitivity, and contextual factors, and determines access permission in advance, preventing unauthorized access before it can impact the system.
3Ease of operation
If each application implements its own access control logic, then fine-grained control over application-specific resources is achieved, but administrative overhead increases
Solution Approach 1:
The patent creates a universal access control subsystem that serves multiple applications and resources through a single centralized mechanism. This subsystem handles access control for diverse resources (files, databases, APIs, etc.) and multiple user types through unified policy evaluation, eliminating the need for each application to implement its own access control logic while maintaining fine-grained control capabilities across the entire system.
Data Source
AI summary
Techniques for providing application-independent access control in a cloud-services computing environment are provided. In one embodiment, a method for providing application-independent access control is provided. The method includes obtaining a user identity for accessing the cloud-services computing environment and receiving a user request to perform a task using an application. The method further includes collecting process-related data for performing the task using the application and obtaining one or more network routing addresses. The method further includes determining, based on the user identity, the process-related data, and the one or more network routing addresses, whether the task is to be performed. If that the task is to be performed, the task is caused to be performed using the application; and if the task is not to be performed, the user request is denied.