Granular Permission Control for Cloud Data Resources
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing platforms face challenges in ensuring robust and secure user management for data resources, as existing proprietary or open-source software platforms lack sufficient granularity in permission control, leading to potential impacts between data resources of different organizations and insecure data transmission.
Innovation Solution
A method and system for controlling user creation and access to data resources on a software platform, involving user verification based on predetermined permissions, association of executable launch functions, and secure access through secret information from a vault, with the option to create replicas for external access and use load balancing for secure routing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing proprietary or open-source software platforms are used for cloud computing, then users can create and execute data resources on the platform, but the platforms lack sufficient granularity in permission control leading to security vulnerabilities and potential impacts between data resources of different organizations
Solution Approach 1:
The permission control system is segmented into multiple granular levels, allowing independent control over different aspects of data resource access and modification. This enables fine-grained permission management where specific users can be granted or restricted from particular operations on specific data resources, thereby improving security without requiring a complete overhaul of the platform architecture.
Solution Approach 2:
The system performs preliminary verification of user permissions before allowing creation or modification of data resources. By checking user credentials and permission levels in advance, the system prevents unauthorized access and modifications, ensuring security is enforced at the point of interaction rather than requiring complex continuous monitoring mechanisms.
2Adaptability or versatility
If users are allowed to create and modify data resources freely on the platform, then user productivity and platform versatility increase, but data resources belonging to one organisation may impact data resources belonging to another organisation
Solution Approach 1:
The system introduces an intermediary verification mechanism that sits between users and data resources. This intermediary checks user permissions and data resource ownership before allowing operations, preventing direct interference between organizational data resources while still allowing legitimate access. The intermediary acts as a gatekeeper that maintains platform flexibility while blocking harmful cross-organizational impacts.
3Reliability
If traditional access control methods are used, then implementation is simple, but data transmission and access lack sufficient security protection
Solution Approach 1:
The system performs preliminary verification of user permissions and credentials before allowing data resource access or modification. This advance checking ensures that only authorized users can interact with data resources, providing strong security protection without requiring complex continuous monitoring during data transmission and access operations.
Solution Approach 2:
The verification process provides feedback to users about their permission levels and access rights before operations are permitted. This feedback mechanism allows users to understand what operations they can perform on data resources, reducing unauthorized access attempts while maintaining a relatively simple access control interface.
Data Source
AI summary
Methods and systems are disclosed for controlling user creation of data resources on a software platform for storing and executing data resources for multiple users. The methods and systems may be performed using one or more processors or special-purpose computing hardware, and may comprise receiving from a user a user request to create a data resource on the software platform, the user request comprising, or identifying, a specification indicative of the data resource and a user identifier associated with said external user. A further operation may comprise performing verification of said user using the user identifier to determine if said user is permitted to create or modify the data resource indicated in the specification in accordance with a predetermined set of permissions. A further operation may comprise, responsive to verifying said user in accordance with the predetermined set of permissions, creating a version the data resource indicated in accordance with the specification for deployment on the software platform for subsequent access or execution by said user.