Cloud Identity Brokerage for Least-Privilege Access Partitioning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for managing access to a cloud or a partition thereof. The method and system for identity brokerage for cloud access control. The method and system for managing access to a cloud or a partition thereof. The present disclosure relates to the technical field of cloud access management, specifically addressing challenges in managing user identity permissions and attributes in cloud environments, particularly for large organizations with complex requirements and heavily regulated industries, where existing attribute-based access control (ABAC) systems face inefficiencies and security risks due to over-assignment of permissions.
Innovation Solution
The system and method automate the assignment of attributes to users based on defined policies, enabling least privileged access and allowing users to specify the scope of access during session establishment, while partitioning cloud environments based on user attributes to reduce the number of required cloud environments and maintain a single cloud security principal role identity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If attributes are assigned to users manually or with simple policies, then the system is easy to operate, but it leads to over-assignment of permissions and security risks
Solution Approach 1:
The system enables users to self-provision attributes and manage their own access rights through automated policy evaluation. Users can request attributes and the system automatically evaluates policies to grant appropriate permissions, eliminating manual administration and reducing over-assignment risks while maintaining ease of use.
Solution Approach 2:
The system implements continuous feedback loops where access requests are evaluated against defined policies, and decisions are automatically enforced. This feedback mechanism ensures that attributes are assigned only when necessary, reducing security risks while maintaining operational simplicity through automation.
2Adaptability or versatility
If multiple cloud environments are created for different teams, then access requirements can be met, but the system complexity and cost increase
Solution Approach 1:
Instead of creating separate cloud environments for different teams, the system segments access rights at the attribute level within a single cloud environment. This allows flexible access control for different teams and projects without proliferating environments, reducing complexity while maintaining adaptability.
Solution Approach 2:
The system implements a universal access control framework that serves multiple teams and projects within a single cloud environment. By using universal attribute-based policies, the system provides multi-functional access control without requiring separate dedicated environments for each team.
3Reliability
If granular access policies are implemented, then least privileged access is achieved, but the difficulty of managing and evaluating policies increases
Solution Approach 1:
The system manages policy complexity by changing parameters such as attribute types, values, and policy priorities rather than managing individual granular rules. This parameter-based approach simplifies policy management while maintaining least privileged access through automated evaluation of attribute combinations.
Solution Approach 2:
The system introduces an intermediary policy evaluation layer that automatically translates complex access requests into evaluated decisions based on predefined policies. This intermediary mechanism reduces the burden on administrators to manually manage granular policies while ensuring least privileged access is maintained.
Data Source
AI summary
There are provided methods and systems for cloud access control. For example, a method is provided as instructions on a non-transitory computer-readable medium. The instructions may be configured to cause a processor to perform certain operations. The operations can include receiving information about a connecting entity, and the connecting entity seeking to establish a connection to a cloud environment. The operations can further include determining, based on a policy, one or more attributes associated with the connecting entity. The operations may also include partitioning the cloud environment, according to one or more attributes.