Cloud Authorization Key Leak Detection via Log Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting leaked cloud authorization keys are inadequate, as they can only identify keys published to the Web and are time-consuming, leading to unexpected charges and data exposure due to unauthorized use.
Innovation Solution
A method that compares request logs from clients with provider logs to detect unauthorized activities associated with authorization keys, enabling comprehensive detection and minimizing damages by automatically identifying leaked keys, regardless of their publication status.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If web crawling patrolling services are used to detect leaked authorization keys, then detection capability is improved for published keys, but detection is incomplete for non-published keys and time consumption increases
Solution Approach 1:
Instead of proactively searching for leaked keys through web crawling, the patent inverts the approach by passively monitoring authorization requests. The system detects leaked keys by analyzing unexpected usage patterns in authorization requests received from various sources, including non-web channels. This inversion enables detection of both published and non-published leaked keys without time-consuming web crawling.
Solution Approach 2:
The patent introduces an intermediary monitoring system that sits between the authorization service and users. This intermediary passively observes and analyzes authorization requests, detecting leaked keys through pattern recognition without requiring direct interaction with potential leak sources. The intermediary approach enables comprehensive detection while minimizing time loss compared to active web crawling.
2Reliability
If web crawling is performed to identify leaked keys, then published keys can be detected, but detection coverage is limited and operational efficiency decreases
Solution Approach 1:
The patent implements continuous monitoring of authorization requests in real-time, providing uninterrupted detection coverage. Unlike periodic web crawling, the continuous monitoring approach constantly analyzes incoming authorization requests, ensuring that leaked keys are detected immediately upon usage regardless of how they were leaked. This continuous action maintains high detection coverage while preserving operational efficiency.
Solution Approach 2:
The monitoring system detects leaked keys through self-service analysis of authorization request patterns without requiring external web crawling operations. The system uses its own observation capabilities to identify leaked keys by analyzing unexpected usage patterns, eliminating the need for separate web crawling processes and thereby maintaining high operational efficiency while achieving comprehensive detection coverage.
3Reliability
If authorization key usage is monitored to detect leaks, then comprehensive detection is achieved, but system complexity increases
Solution Approach 1:
The monitoring system is designed with multi-functionality, serving both as a normal authorization processing component and as a leaked key detection system. The same infrastructure that handles authorization requests also performs detection by analyzing usage patterns, eliminating the need for separate dedicated detection systems. This universality achieves comprehensive detection while minimizing additional system complexity.
Solution Approach 2:
The patent merges the authorization processing function with the leaked key detection function into a single integrated system. By combining these functions, the system achieves comprehensive detection coverage without the complexity overhead of separate monitoring infrastructure. The merged system analyzes authorization requests for both processing and detection purposes simultaneously, maintaining reliability while controlling complexity.
Data Source
AI summary
In one embodiment, a discrepancy detection application automatically detects and addresses unauthorized activities associated with one or more authorization keys based on a request log and a provider log. The request log specifies activities that a client initiated, where the activities are associated with the authorization keys. The provider log specifies activities that a cloud provider performed, where the activities are associated with the authorization keys. In operation, the discrepancy detection application determines that one or more unauthorized activities have occurred based on comparing the request log to the provider log. The discrepancy detection application then performs an action that addresses the unauthorized activities. Advantageously, by detecting discrepancies between activities initiated by the client and activities performed by the cloud provider, the discrepancy detection application automatically detects any leaked authorization keys and minimizes resulting damages incurred by the client.