Cloud Instance Access Management via Temporary Key Pairs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access management systems for cloud instances face challenges in securely granting temporary access to tech support without sharing private keys, which poses security risks and liability issues.
Innovation Solution
A system and method that generates temporary key pairs and credentials for support accounts, allowing controlled access to instances with expiration times, ensuring secure and limited access without sharing the original private key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If private keys are shared with tech support for instance access, then support access is enabled, but security risks and liability issues increase
Solution Approach 1:
The patent segments the authentication credentials into two separate keys: a private key kept secure by the user and a public key shared with the instance. This segmentation allows tech support to access instances through the public key without obtaining the private key, enabling support functionality while maintaining security boundaries.
Solution Approach 2:
The public key acts as an intermediary that enables third-party (tech support) access to cloud instances without exposing the private key. The public key mediates between the user's secure credentials and the instance access requirements, allowing support personnel to authenticate and access instances independently.
2Duration of action of moving object
If continuous access credentials are provided to support accounts, then access availability is improved, but security exposure time increases
Solution Approach 1:
The patent implements dynamic credential validity by associating expiration timestamps with public key credentials. The access rights are not static but change over time, automatically becoming invalid after a specified duration. This dynamic approach allows continuous access availability during the valid period while automatically reducing security exposure once expiration is reached.
Solution Approach 2:
The system employs periodic credential validation where access rights are granted for specific time intervals rather than continuously. The credentials have defined validity periods that periodically renew or expire, creating a rhythm of access grant and access termination that balances availability with security.
3Measurement precision
If multiple support accounts are created with separate credentials, then access control precision is improved, but system complexity increases
Solution Approach 1:
The patent creates a universal public key credential mechanism that can be applied across multiple support accounts and instances. Rather than requiring completely separate authentication systems for each support account, the same public key infrastructure serves multiple purposes: enabling multiple support personnel to access multiple instances with individually controllable credentials, all through a unified system.
Data Source
AI summary
Managing access to instances on a public cloud can include in responding to a request from a user to create a support account for a target instance on a public network. A process can include generating a key pair including a public key and a private key, creating, in the target instance, a support account, and associating the public key with the target instance. Access to the private key can be provided to facilitate a connection to the target instance through the support account. Temporary credentials can be generated and associated with the target instance. Upon expiration of the temporary credentials, the support account can be disabled by removing the support account from the target instance and disassociating the public key with the target instance.