Cloud Resource Naming via Semantic Similarity Screening
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud resource names that reveal information about the type of data stored can increase security risks by providing clear targets for attackers, and existing naming conventions that obscure data types can still be deciphered using open-source intelligence.
Innovation Solution
Implement a method and system that utilize a vector matching engine to evaluate candidate names against a dataset of keywords, rejecting names outside a predetermined threshold range of similarity to known sensitive words or phrases, and optionally suggesting alternative names.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cloud resource names clearly identify data types and services, then resource identification and management become easier, but security risks increase as attackers can easily identify valuable targets
Solution Approach 1:
The patent applies semantic transformation to change the 'color' or meaning of resource names. Instead of using literal names that reveal data types (e.g., 'FinancialReports2022'), the system transforms them into semantically equivalent but opaque identifiers that maintain internal usability while hiding sensitive information from external observers
Solution Approach 2:
The patent introduces a naming service as an intermediary between resource creation and resource identification. This service automatically generates and manages alternative names that serve as a mediator - they allow internal systems to access resources using meaningful identifiers while preventing external attackers from understanding the nature of stored data
2Object-affected harmful factors
If naming conventions obscure data types to improve security, then attacker targeting becomes harder, but resource management and identification become more difficult
Solution Approach 1:
The patent segments the naming function into two distinct parts: internal identifiers used by resource management systems and external display names shown to users. This segmentation allows each part to serve its specific purpose - internal identifiers maintain manageability while external names provide security through obscurity
Solution Approach 2:
The patent creates a universal naming service that handles multiple functions: generating secure names, validating naming conventions, providing name translations between internal and external systems, and maintaining name mappings. This multi-functional approach resolves the contradiction by making the naming system itself adaptable to different requirements
3Object-affected harmful factors
If random-looking internal names are used to hide data nature, then direct identification becomes harder, but patterns can still be inferred through open-source intelligence gathering
Solution Approach 1:
The patent changes the parameters of resource names from semantic-rich identifiers to controlled random-looking strings with specific constraints. By adjusting parameters such as character sets, length ranges, and pattern restrictions, the system generates names that appear random to external observers but maintain consistency and predictability for internal systems
Solution Approach 2:
The patent performs preliminary security validation during resource creation by checking proposed names against a comprehensive list of sensitive keywords and patterns. This preliminary action prevents names that could be inferred through OSINT from being created in the first place, rather than attempting to detect and block them later
Data Source
AI summary
The present disclosure provides a method and system for automatically restricting cloud resource names based on their semantic similarity to a set of keywords. The system may include one or more processors to receive a user input including a candidate name for a cloud resource of a cloud system, provide a similarity check query to a vector matching engine containing a dataset of keywords derived from cloud system, the similarity check query including the candidate name, receive a score indicating a degree of similarity between the candidate name and at least one keyword of the dataset contained in the vector matching engine, compare the score to a predetermined threshold range, reject the candidate name in response to the score being outside the predetermined threshold range, and assign the candidate name to the cloud resource if the score is within the predetermined threshold range.