Cloud IAM Policy Management via Server-Side Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed microservice architecture based cloud services environments, the existing centralized approach to access control policy management is inflexible and scalable, as it requires a standardized policy document format that is common to all resource servers, making it difficult for resource servers with different formats to integrate and evolve policy documents without involving all servers, leading to slow changes and restricted policy representation.
Innovation Solution
Decentralizing the evolution, validation, and enforcement of policy document formats by delegating control to resource servers, allowing each to establish and manage its own policy document format, with the IAM service responsible for centralized storage and management, and using resource server endpoints for validation and storage of policy documents.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a standardized policy document format is established that is common to all resource servers, then the IAM service can manage access control across heterogeneous servers, but the system becomes inflexible and slow to adapt to format changes
Solution Approach 1:
The patent segments the centralized policy document format control into individual resource server-specific formats. Each resource server maintains its own policy document format independently, eliminating the need for system-wide standardization. This segmentation allows each server to adapt its format independently without affecting others, resolving the contradiction between adaptability and change time.
Solution Approach 2:
Instead of the IAM service imposing a standardized format on all resource servers, the patent inverts the approach by allowing resource servers to define and enforce their own formats. The IAM service adapts to each server's format rather than servers adapting to a common format, enabling rapid format changes without system-wide coordination.
2Adaptability or versatility
If the IAM service enforces a common policy document format across all resource servers, then centralized access control is achieved, but heterogeneous resource servers with different formats cannot integrate easily
Solution Approach 1:
The patent applies local quality by allowing each resource server to have its own policy document format tailored to its specific needs and characteristics. The IAM service interacts with each server using that server's native format, eliminating the need for heterogeneous servers to conform to a common format. This resolves the integration problem while maintaining format diversity.
Solution Approach 2:
The IAM service acts as an intermediary that adapts to each resource server's policy document format. Rather than servers adapting to a common format, the IAM service serves as the mediator that handles format-specific interactions with each server independently, enabling heterogeneous servers to integrate without changing their formats.
3Stability of the object's composition
If non-additive changes to the policy document format are scaled across the entire system, then consistency is maintained, but the process becomes slow due to involving every resource server
Solution Approach 1:
The patent segments policy document format management so that each resource server independently manages its own format. Non-additive changes to policy document formats can be made at each server independently without requiring coordination with every other server in the system. This segmentation maintains format stability at each server while dramatically improving the speed of format updates system-wide.
4Adaptability or versatility
If the IAM service maintains centralized control over policy document formats, then system-wide access control consistency is achieved, but the IAM service becomes a bottleneck for format evolution
Solution Approach 1:
The patent extracts the policy document format control authority from the IAM service and places it at each resource server. Each server independently manages and evolves its own policy document format without requiring IAM service intervention for format changes. This extraction eliminates the IAM service bottleneck for format evolution while reducing the IAM service's complexity regarding format management.
Data Source
AI summary
In an example, a method of managing access to resources managed by heterogeneous resource servers having different policy document formats in a cloud services environment includes obtaining, at an identity and access management (IAM) service, a policy document describing privileges of an end user with respect to accessing at least one resource of the resources managed by a resource server of the heterogeneous resource servers; sending the policy document from the IAM service to an resource server endpoint designated by the resource server for validation; storing, by the IAM service, the policy document in a datastore in response to a determination by the resource server endpoint that the policy document is valid; and generating, by the IAM service, an indication that the policy document is invalid in response to a determination by the resource server endpoint that the policy document is invalid.