Cloud Database Backup Security via Segmented Hyperscaler Accounts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current database backup systems in cloud environments rely on universal technical accounts with global access rights, which are vulnerable to cyber-attacks, allowing malicious actors to read, write, and delete backups, leading to potential data corruption and cost-intensive tasks.
Innovation Solution
Implementing multiple dedicated hyperscaler accounts with specific access rights for each backup service component process, allowing only the necessary permissions for read, write, delete, or lifecycle management operations, and storing credentials in a secure central credential store separate from the object store.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If universal technical accounts with global access rights are used for database backup operations, then ease of operation is improved, but security is worsened due to vulnerability to cyber-attacks and unauthorized data manipulation
Solution Approach 1:
The patent segments the single universal technical account into multiple dedicated hyperscaler accounts, each with specific access rights tailored to particular backup service component processes. This segmentation isolates security risks so that compromise of one account does not grant access to all backup operations, directly resolving the contradiction by maintaining operational ease through structured access while improving security through account isolation and minimized privilege exposure.
2Object-affected harmful factors
If multiple dedicated hyperscaler accounts with specific access rights are implemented, then security is improved by limiting access rights to specific functions, but device complexity is worsened due to multiple accounts and credential management
Solution Approach 1:
The patent introduces a central credential store as an intermediary component that manages multiple hyperscaler account credentials securely. This mediator handles the complexity of credential storage, retrieval, and rotation, allowing the backup service to benefit from enhanced security through multiple dedicated accounts without directly managing the complexity themselves. The credential store abstracts the complexity while enabling the security improvements.
3Object-affected harmful factors
If credentials are stored in a secure central credential store separate from the object store, then security is improved by preventing unauthorized access, but device complexity is worsened due to additional storage infrastructure
Solution Approach 1:
The patent extracts credential storage from the object store infrastructure and places it in a separate, dedicated credential store. This extraction removes sensitive credential data from the general-purpose object storage system, preventing unauthorized access to credentials even if the object store is compromised. The separation creates a specialized security layer that protects credentials while allowing the object store to focus on its primary data storage function, managing complexity through functional specialization.
Data Source
AI summary
A system and method to create a plurality of hyperscaler accounts having predefined access rights to an object store of a database service in a cloud environment; store hyperscaler credentials specifying access rights to the object store corresponding to the predefined access rights of the hyperscaler accounts in a secure credential store, the hyperscaler credentials providing access to the object store for a specified backup function; map each of a plurality of different backup service component processes to one of the hyperscaler credentials, each of the plurality of backup service component processes operative independent of each other and having a specific backup service functionality; receive a request to execute one of the plurality of different backup service component processes; and authenticate access rights of the backup service component process included in the request based on the mapping.