Cloud Access Control via Dynamic Trust Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cloud environments lack visibility and control over access transactions between clouds, particularly in enterprise settings, as they fail to provide security administrators with insights into data sharing, user authorization, and cloud access, leading to potential leaks of sensitive data due to outdated whitelists and blacklists.
Innovation Solution
A system that detects access transactions via resource authorization messages, generates relationship data, and performs access control actions using a cloud trust model, implemented as a graph model with belief propagation techniques, to provide visibility and control over access transactions between clouds without relying on static whitelists or blacklists.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If whitelists and blacklists are used to prevent sensitive data sharing between clouds, then data security is improved, but the system lacks agility and becomes outdated as new clouds and services emerge
Solution Approach 1:
The patent implements a dynamic authorization system that continuously monitors and evaluates cloud trust levels rather than relying on static whitelists and blacklists. The system adapts to new clouds and services by dynamically assessing their trustworthiness based on observed behavior and relationships, allowing the security model to evolve automatically as the cloud ecosystem changes.
Solution Approach 2:
The system incorporates feedback mechanisms that continuously monitor cloud access transactions and update trust models based on observed behavior. This feedback loop allows the system to learn from actual cloud interactions and adjust authorization decisions in real-time, improving both security and adaptability simultaneously.
2Productivity
If enterprises allow cloud-to-cloud data sharing for business operations, then operational efficiency is improved, but visibility and control over data access are lost
Solution Approach 1:
The patent introduces an intermediary authorization service that sits between clouds and enterprises, mediating all cloud-to-cloud data sharing transactions. This intermediary maintains visibility into all access operations while enabling efficient data sharing, allowing enterprises to retain control and visibility without sacrificing operational efficiency.
Solution Approach 2:
The system implements a universal authorization framework that handles multiple types of cloud services and data sharing scenarios through a single cohesive mechanism. This multi-functional approach maintains visibility across diverse cloud transactions while enabling efficient operations across different service types.
3Ease of operation
If users grant broad access permissions to clouds using OAuth protocol, then ease of operation is improved, but security control is weakened due to inability to monitor specific access transactions
Solution Approach 1:
The patent segments broad OAuth access permissions into finer-grained authorization tokens that represent specific access transactions. Instead of granting blanket access, the system breaks down permissions into discrete, monitorable units that can be individually tracked and controlled, maintaining both ease of operation and security control.
Data Source
AI summary
A computing system detects an access transaction based on one or more resource authorization messages transmitted via a resource authorization protocol. The access transaction pertains to access of a protected resource by a consumer cloud, the protected resource hosted by a provider cloud. The computing system generates relationship data based on the resource authorization messages. The relationship data can indicate a resource owner that is granting the access, the consumer cloud, and/or the provider cloud. The computing system performs an access control action in relation to the access transaction based on the relationship data. The access control action can be allowing the consumer cloud access to the protected resource or denying the consumer cloud access to the protected resource.