Cloud Package Policy Objects for Granular Dependency Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud data platforms lack robust security mechanisms for managing third-party packages, leading to insecure and cumbersome dependency management, and fail to provide customers with adequate granular control over package access, exposing them to security vulnerabilities.
Innovation Solution
Implementing a packages policy object with allowlists and blocklists that can be applied during function creation and execution, enabling customers to specify which packages are allowed or blocked, and using a package solver system to manage dependencies and ensure compliance with the policy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cloud data platforms allow third-party packages to be used, then functionality and versatility are improved, but security risks and vulnerability exposure increase
Solution Approach 1:
The patent introduces a package policy object as an intermediary layer between the cloud data platform and third-party packages. This policy object contains allowlists and blocklists that mediate package access, permitting only authorized packages while blocking potentially vulnerable ones. The solver manager acts as another intermediary that enforces these policies during function creation and execution, thus enabling versatile package usage while maintaining security through controlled access.
Solution Approach 2:
The system implements self-service security mechanisms where the package policy automatically manages package authorization without requiring manual security reviews for each package. The allowlist and blocklist structures enable automated decision-making about package permissions, with the solver manager automatically enforcing policies and blocking unauthorized packages, reducing both security risks and manual management overhead.
2Ease of operation
If cloud data platforms provide broad package access, then user flexibility is improved, but manual dependency management effort increases
Solution Approach 1:
The solver manager implements self-service dependency resolution by automatically analyzing function code, identifying required packages, and checking them against the package policy. This automated process eliminates manual dependency management tasks, allowing users to freely specify packages in their functions while the system automatically handles compatibility checking, policy enforcement, and conflict resolution.
Solution Approach 2:
The system performs preliminary validation of packages during function creation by checking packages against allowlists and blocklists before execution. This advance checking prevents incompatible or unauthorized packages from being deployed, eliminating the need for manual dependency management and post-deployment troubleshooting, thus saving time while maintaining flexibility.
3Reliability
If cloud data platforms implement granular package control, then security is improved, but system complexity increases
Solution Approach 1:
The patent segments package control into distinct components: allowlists for authorized packages, blocklists for prohibited packages, and a solver manager for enforcement. This segmentation enables granular security control where each component has a specific function, making the complex security mechanism manageable and maintainable while providing fine-grained package access control.
Solution Approach 2:
The package policy object serves multiple functions simultaneously: it stores authorization rules, acts as a reference for the solver manager, and provides audit trails. This multi-functionality reduces overall system complexity by consolidating security management capabilities into a single versatile component rather than requiring separate mechanisms for each function.
Data Source
AI summary
Methods, systems, and computer programs are presented for a policy to enable customers to create and apply allowed items and restricted items provided by third-party managers. User code is received by a cloud data platform, the code for performing an operation. The cloud data platform receives a policy including allowed items and restricted items. The cloud data platform compares the allowed and restricted items to a specification, and determines a difference based on the comparison. The cloud data platform determines whether to permit the operation based at least in part on the differences.