Cloud Command Queue for Secure Ad-hoc Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large enterprises face security risks due to direct access to public cloud computing resources for running ad-hoc commands, as unauthorized access can expose user credentials, violating security policies.
Innovation Solution
Implementing a system with a cloud-based command queue that intermediates between users and public cloud computing resources, using a command executor agent to poll and execute commands without direct access, ensuring user credentials are not exposed by encrypting and decrypting commands and results as necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If direct access to console or command line interface is provided in public cloud environment, then users can run ad-hoc commands on-demand, but user credentials are exposed and security is compromised
Solution Approach 1:
The patent introduces a message queue as an intermediary component between the user and the cloud-based computing resource. The user sends commands through the message queue rather than directly accessing the console or command line interface. The computing resource polls the message queue for commands and executes them indirectly. This intermediary mechanism enables ad-hoc command execution while preventing direct credential exposure to the cloud environment, thus resolving the security contradiction.
2Adaptability or versatility
If conventional command line interface access is implemented, then command execution capability is provided, but security policies are violated
Solution Approach 1:
The message queue serves as a security-compliant intermediary that enables command execution capability while maintaining security policy compliance. By routing all command interactions through the message queue, the system provides the necessary adaptability for ad-hoc commands without violating security policies that prohibit direct console or command line interface access.
Solution Approach 2:
The system segments the command execution process into distinct components: the user interface layer, the message queue layer, and the computing resource layer. This segmentation isolates the credential-sensitive operations from direct user access, allowing command execution capability to be maintained while security policies are enforced at each layer independently.
3Object-affected harmful factors
If indirect access through message queue is implemented, then credential exposure is prevented, but system complexity increases
Solution Approach 1:
While the message queue intermediary does increase architectural complexity, it prevents credential exposure by eliminating the need for direct authentication mechanisms between users and cloud resources. The complexity is concentrated in a single, well-defined component rather than distributed across multiple security layers, making the system more manageable despite the added intermediary.
Data Source
AI summary
The present invention provides for indirect access to public cloud-based computing environments for the purpose of running ad-hoc commands, on-demand, on any public cloud-based computing resource. Messages including the ad-hoc commands are communicated to a cloud-based command queue, which acts as the intermediary between the user (i.e., command requester) and the public cloud-based computing resources. A command executor agent installed on the cloud-based computing resources, polls the command queue for commands designated for the application(s) currently being executed on the cloud-based computing resources. Results of the command are communicated from the cloud-based computing resource to the command queue, which is periodically polled by a monitoring queue in order for the user/command requester to obtain the results of the execution of the command.