Cloud Access Visualization Using a Unified Identity Model
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity management systems struggle to provide a unified view of access rights and permissions across multiple cloud service providers, leading to inefficiencies and complex queries due to proprietary data models and varying access configurations.
Innovation Solution
A system that normalizes identity management data from multiple cloud service providers to a common terminology, enabling a graphical representation of access rights and permissions across these providers, providing a consistent view of allowed, denied, and chained access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If identity management data from multiple cloud service providers is accessed using each provider's proprietary data model, then the system can maintain compatibility with each CSP's native interface, but the system complexity increases and query performance degrades due to the need to handle each CSP's unique configuration and terminology
Solution Approach 1:
The patent introduces a normalization layer that acts as an intermediary between multiple cloud service providers and the identity management system. This normalization layer translates and standardizes proprietary data models from different CSPs (such as AWS IAM, Azure AD, Google Cloud IAM) into a unified internal representation, eliminating the need to handle each CSP's unique interface separately while maintaining compatibility with all providers
Solution Approach 2:
The patent creates a universal access model that can handle multiple cloud service providers through a single standardized interface. The system defines common identity management concepts (users, groups, roles, permissions, policies) that work across all CSPs, allowing the same identity management operations to function universally regardless of the underlying provider
2Adaptability or versatility
If identity management data from multiple cloud service providers is accessed using each provider's proprietary data model, then the system can maintain compatibility with each CSP's native interface, but the ease of operation decreases due to the inability to provide a unified view of access rights
Solution Approach 1:
The normalization layer serves as a mediator that presents a unified, simplified view of access rights across multiple cloud service providers to users and administrators. It translates complex, provider-specific access configurations into a consistent standardized format, making it easy to manage identities and permissions without dealing with each CSP's unique interface complexities
Solution Approach 2:
The patent merges access rights information from multiple cloud service providers into a unified view. By combining data from different CSPs through a standardized access model, the system presents consolidated information about user permissions, roles, and policies across all providers in a single manageable interface, eliminating the need to separately access and reconcile each provider's data
3Loss of information
If identity management data from multiple cloud service providers is normalized to a common terminology, then a unified view of access rights is achieved, but processing time increases due to the normalization and evaluation steps
Solution Approach 1:
The patent implements preliminary action by pre-normalizing identity management data from cloud service providers and pre-evaluating access rights during idle periods or at scheduled intervals. The system proactively computes and caches normalized access information, so that when queries are executed, the data is already prepared and can be retrieved quickly without performing heavy normalization and evaluation operations in real-time
Solution Approach 2:
The system creates simplified copies of the original proprietary data models from different cloud service providers. Instead of repeatedly processing and normalizing the full complex data structures from each CSP, the system maintains standardized copies of access rights information that have already been normalized, allowing for fast querying and comparison across providers without reprocessing the original complex data
Data Source
AI summary
Systems and methods are disclosed relating to identity governance and privileged access control in a distributed networked computing environment for cloud based computing services. Embodiments disclosed include a logical model developed to describe the effective access of multiple cloud service providers (CSPs), each of which may be based on different access systems. The resulting system can then provide a singular experience across all CSPs used by users, giving users a clear picture of how access is achieved.