Cloud Operation Guard Service for Risk Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In cloud platforms, risk-oriented operations can result in irreversible negative consequences, and traditional approaches require extensive analysis of log data to correct and prevent such occurrences, but they cannot mitigate the damage already done.
Innovation Solution
An operation guard system that includes an operation guard service and nodes, which monitor sessions, provide risk scores, and selectively prevent the execution of risk-oriented operations, using a topology list and operation token tree to assess risks and alert users.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional log data analysis is used to detect and correct risk-oriented operations, then the system can identify what, where, who, and when of operations, but the damage has already occurred and cannot be prevented
Solution Approach 1:
The operation guard system performs preliminary risk assessment and validation before allowing risk-oriented operations to execute. By evaluating operations in advance and blocking potentially harmful ones, the system prevents damage before it occurs rather than detecting and correcting it after the fact.
Solution Approach 2:
The operation guard service acts as an intermediary layer between users and cloud resources. It intercepts and validates risk-oriented operations before they reach the target systems, providing a buffer that enables prevention rather than just detection.
2Reliability
If the operation guard system blocks risk-oriented operations, then irreversible damage is prevented, but user productivity may be reduced due to operation restrictions
Solution Approach 1:
The operation guard system applies different levels of scrutiny to different operations. Low-risk operations are allowed to proceed without interruption, while only high-risk operations are blocked or require additional validation. This selective approach maintains productivity for routine tasks while ensuring safety for critical operations.
Solution Approach 2:
The system dynamically adjusts operation validation based on risk parameters. By evaluating specific characteristics of each operation (such as operation type, user context, and target resource), the system can allow or block operations based on their individual risk profiles rather than applying a blanket restriction.
3Reliability
If comprehensive operation monitoring is implemented, then all risk-oriented operations can be identified and prevented, but system complexity increases
Solution Approach 1:
The operation guard functionality is extracted as a separate, dedicated service rather than being embedded throughout the entire cloud platform architecture. This modular approach concentrates the complexity in a single manageable component while keeping the rest of the system simple.
Solution Approach 2:
The operation guard service provides multiple functions through a single unified system: monitoring operations, assessing risk, validating operations, blocking harmful operations, and generating alerts. This multi-functional approach avoids the need for separate systems for each function, reducing overall complexity.
Data Source
AI summary
Methods, systems, and computer-readable storage media for receiving, by an operation guard system executed within a cloud platform, session information representative of a session of a user within the cloud platform, the session information including user information and operation information, determining, by the operation guard system, that the user is signed into a technical group for execution of an operation represented in the operation information, and in response, providing, by the operation guard system, a risk score associated with the operation, and determining, by the operation guard system and at least partially based on the risk score, that the operation is a risk-oriented operation based on the risk score, and in response, preventing execution of the operation and transmitting an alert.