Cloud-Neutral Access Tokens for Fine-Grained Multi-Tenant Data Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing role-based access control (RBAC) systems in cloud computing environments lack fine granularity control over data access and usage, especially in multi-tenant systems, leading to inefficiencies and manual, disjointed processes due to static permissions and platform incompatibilities.
Innovation Solution
A three-phase context-based authorization process that generates cloud-neutral access tokens, which are then converted into cloud-specific tokens to automate dynamic data access and usage permissions across multiple platforms, ensuring precise control over data access per client, application, data type, and data table.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If role-based access control (RBAC) is used to control data access, then access management is simplified, but fine granularity control over data usage purpose is lost
Solution Approach 1:
The patent segments access control into multiple independent components: data access control (what data can be accessed) and data usage control (how the data can be used). This is achieved through separate policy definitions and enforcement mechanisms that independently evaluate access requests and usage actions, enabling fine-grained control without complicating the overall access management structure.
Solution Approach 2:
The patent introduces policy evaluation modules as intermediaries between users and data resources. These modules act as mediators that enforce both access control policies and usage control policies, translating high-level policy definitions into specific enforcement decisions without requiring direct user-system interactions for each control check.
2Device complexity
If static permissions are implemented in RBAC systems, then system complexity is reduced, but adaptability to changing data usage purposes is prevented
Solution Approach 1:
The patent implements dynamic policy evaluation that adapts to changing data usage purposes without requiring system reconfiguration. Usage control policies are evaluated in real-time based on the specific action being performed, allowing the system to dynamically adjust permissions based on context while maintaining a relatively simple static policy definition structure.
Solution Approach 2:
The patent enables parameter changes in policy definitions without altering the underlying system structure. Usage control policies can be modified to reflect changing business requirements, data sensitivity levels, or compliance requirements, and these changes are automatically enforced through the policy evaluation mechanism without requiring system redesign.
3Manufacturing precision
If manual role configuration is used to enforce data usage purpose, then control precision is improved, but scalability is reduced due to tedious manual processes
Solution Approach 1:
The patent implements self-service policy enforcement where the system automatically evaluates and enforces usage control policies without requiring manual configuration for each access request. The policy evaluation modules automatically assess whether specific data usage actions comply with defined policies, eliminating tedious manual processes while maintaining precise control.
Solution Approach 2:
The patent incorporates feedback mechanisms that automatically monitor data usage actions and enforce policy compliance. The system provides real-time feedback on whether proposed actions comply with usage control policies, enabling automated decision-making and reducing manual configuration requirements while maintaining high control precision.
4Reliability
If separate access control systems are implemented for each cloud platform, then platform-specific requirements are met, but system complexity and integration difficulty increase
Solution Approach 1:
The patent implements a universal policy definition framework that can be applied across multiple cloud platforms. The core usage control policy structure is platform-agnostic, allowing the same policy definitions to be enforced across different cloud environments. Platform-specific adaptations are handled through configurable translation layers rather than separate control systems.
Solution Approach 2:
The patent merges separate access control and usage control functions into a unified policy enforcement architecture. By combining these functions and enforcing them through a common policy evaluation mechanism, the system reduces overall complexity while maintaining the ability to meet platform-specific requirements through configurable policy rules.
Data Source
AI summary
System and method for fine granularity control of data access and usage for across multi-tenant systems. A user makes a request to access a particular set of data from a particular remote data source for a specific purpose. The system authorizes the user to validate whether the user is qualified to make the request. The data source is checked to see if the particular data has been granted access for that particular purpose. A cloud neutral token is created and converted into a cloud specific token upon reaching the remote data source. The cloud specific token is used to create a temporary IAM role and IAM policy with a predetermined time to live. After the time to live expires, the IAM role and IAM policy are deleted.