Cloud Hosting Access Control via Multi-Tier Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud hosting services face security vulnerabilities due to weak security capabilities in service accounts, making them susceptible to attacks like brute force cracking and web attacks, which complicates data protection and investigation processes.
Innovation Solution
A three-tiered authentication process involving a client, authentication server, and cloud host, where a proxy server mediates access, performing first, second, and third authentications using business and service account information to enhance security through privilege record management and secure protocol communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If system firewall rules are configured to restrict access to designated ports to designated IP addresses, then the scope of potential attacks is reduced, but the flexibility of service privilege controls is reduced and control granularity is insufficient
Solution Approach 1:
The patent segments the authentication process into three distinct authentication stages (first authentication of business account, second authentication of service account, third authentication of operation authority). This segmentation allows each authentication stage to handle specific security requirements independently, achieving both strong security validation and flexible privilege control without relying solely on coarse-grained firewall rules.
Solution Approach 2:
The patent introduces an authentication server as an intermediary between the client and cloud host. This intermediary performs multi-stage authentication and privilege verification, enabling fine-grained access control based on business relationships and service account permissions, thereby resolving the contradiction between security reliability and control flexibility.
2Ease of operation
If service accounts are used for cloud hosting services, then service deployment is enabled, but security capabilities are weak compared to business accounts
Solution Approach 1:
The patent performs preliminary binding of business accounts to service accounts before service deployment. The authentication server pre-configures the relationships between business accounts and service accounts, and pre-establishes operation authority permissions. This preliminary action ensures that even though service accounts have inherently weaker security, they are protected by the stronger business account authentication layer and pre-configured privilege constraints.
Solution Approach 2:
The patent creates a composite authentication system that combines business account credentials with service account credentials. The first authentication uses business account information (stronger security), while the second authentication uses service account information (enables service deployment). This composite approach leverages the strengths of both account types to achieve both ease of operation and reliability.
3Ease of operation
If cloud hosts are accessed directly using service accounts, then service access is simplified, but investigation capabilities are weakened due to lack of association between service accounts and business accounts
Solution Approach 1:
The patent implements a feedback mechanism where the authentication server records and returns authentication results that link service account operations back to business account identities. When a service account performs operations on the cloud host, the authentication system traces these operations through the bound relationship to the originating business account, enabling investigation and auditing capabilities while maintaining simplified service access.
Data Source
AI summary
Embodiments of the present application relate to a method and device for access control of a cloud hosting service. The method includes receiving a first authentication request from a client, performing a first authentication of the first account information, in the event that the first authentication is successful, generating an authentication password and communicating the authentication password to the client, receiving a second authentication request from a proxy server, wherein the second authentication request comprises the authentication password transmitted to the proxy server by the client, performing a second authentication of the authentication password and causing the proxy server to request the cloud host to perform a third authentication of second account information, and in the event that the third authentication is successful, causing the client to access one or more service resources deployed on the cloud host via the proxy server.