Cloud Resource Access with Multi-Level IAM Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud customers desire control over user authentication processes in cloud environments while maintaining security and isolation of their resources, yet existing single-level authentication methods lack sufficient monitoring and control by both the cloud customer and assurance administrators.
Innovation Solution
Implementing a multi-level authentication process involving a third-party identity provider (IdP) for initial user credential verification followed by an identity and access management (IAM) service for additional verification, ensuring both entities have control and monitoring roles.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single-level authentication method is used, then the authentication process is simple and fast, but the cloud customer and assurance administrator lack sufficient control and monitoring over user authentication
Solution Approach 1:
The authentication process is segmented into two distinct levels: a first level performed by an identity provider (IdP) for initial credential verification, and a second level performed by an identity and access management (IAM) service for additional verification. This segmentation allows both the cloud customer (through IdP) and assurance administrator (through IAM service) to have control and monitoring roles in the authentication process, resolving the contradiction between authentication control and process simplicity.
2Reliability
If a multi-level authentication process is implemented, then control and monitoring by cloud customer and assurance administrator is improved, but the authentication process becomes more complex and time-consuming
Solution Approach 1:
The first level of authentication is performed preliminarily by the identity provider before the second level authentication by the IAM service. This preliminary action verifies initial credentials efficiently, and only after successful first-level authentication does the system proceed to the second level of verification. This staged approach reduces overall authentication time compared to performing all verification steps simultaneously, while still providing comprehensive control to both cloud customer and assurance administrator.
3Object-affected harmful factors
If access control is restricted to authorized users only, then security of cloud resources is improved, but user access and productivity may be impacted
Solution Approach 1:
The multi-level authentication system provides feedback mechanisms at each authentication level, allowing users to understand the authentication status and receive guidance. The system feedbacks authentication results to both the cloud customer and assurance administrator, enabling continuous monitoring while maintaining secure access for authorized users. This feedback approach ensures that security restrictions do not unnecessarily impact legitimate user productivity.
Data Source
AI summary
Techniques for a multi-level authentication within a cloud environment are disclosed. A first authentication request is received by an identity and access management (IAM) service from a device associated with a user. The first request is to authenticate the user for accessing one or more cloud resources through a gateway of the cloud environment. Responsive to the first authentication request, a redirection is performed to submit a second authentication request to an identity provider (IdP) to authenticate the user. A first token indicating a first identity for the user based on the first authentical is received by the IAM service, here the first authentication was performed by the IdP. The IAM service performs a second authentication of the user. The IAM service issues a second token indicating a second identity for the user. The device gains access to the one or more cloud resources, based on the second token.