Cloud Permissions Analytics for Multi-Account Identity Propagation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Securing data across multiple cloud providers is challenging due to the lack of a cohesive security model for identities and data movement, leading to complex and inefficient operations for DevOps and Security teams, with increased risks from cloud vulnerabilities and compliance issues.
Innovation Solution
A cloud security platform with a 'hot spot' permissions analytics engine that identifies and visualizes sensitive permissions propagation, enabling automated updates, removal, or restriction of permissions in public cloud environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a comprehensive security model is implemented across multiple cloud providers, then data security and compliance are improved, but device complexity and operational difficulty increase
Solution Approach 1:
The patent segments the complex multi-cloud security problem into manageable components by analyzing permissions at the individual cloud account level and then aggregating results. The system divides identity chains into discrete segments that can be traced and analyzed separately, then combines them to form a comprehensive view. This segmentation allows security analysis without requiring a monolithic complex security model across all clouds simultaneously.
Solution Approach 2:
The patent introduces an intermediary analytics engine that sits between the multiple cloud providers and the security team. This intermediary consolidates permission data from various cloud sources, normalizes it into a unified format, and presents it in a comprehensible manner. The intermediary handles the complexity of multi-cloud security model integration, shielding users from the underlying complexity while maintaining comprehensive security coverage.
2Measurement precision
If detailed permission tracking is implemented across all cloud accounts, then identification of sensitive permission propagation is improved, but loss of time and computational resources increase
Solution Approach 1:
The patent implements preliminary action by pre-computing and storing identity chain information and permission relationships in a normalized format before analysis is needed. The system pre-processes cloud account data, extracts identity chains in advance, and maintains them in an optimized structure. When permission propagation analysis is required, the pre-computed data is readily available, eliminating the need for time-consuming real-time computation and significantly reducing analysis time while maintaining precise tracking.
3Adaptability or versatility
If manual permission management is performed across multiple cloud providers, then flexibility and adaptability are maintained, but productivity and efficiency decrease
Solution Approach 1:
The patent implements self-service by enabling automated permission propagation analysis and identification without requiring manual intervention. The system automatically extracts identity chains from cloud accounts, analyzes permission relationships, identifies sensitive permission propagation patterns, and presents findings ready for action. This automation maintains adaptability to different cloud providers and permission structures while dramatically improving productivity by eliminating manual permission management tasks across multiple clouds.
Data Source
AI summary
A network-accessible service provides an enterprise with a view of identity and data activity in the enterprise's cloud accounts. The service enables cloud provider management models to be normalized with centralized analytics and views across cloud accounts. Based on identity and audit data received from a set of cloud deployments, and according to a cloud intelligence model, a set of permissions associated with each of a set of identities are determined. For each identity, and based on a set of identity chains extracted from the cloud intelligence model, a set of identity account action paths (IAAPs) are then determined. An IAAP defines how the identity obtains an ability to perform a given action in a given account. Using the identity account action paths together with context information, one or more roles, groups and accounts in the enterprise that are propagating permissions within the public cloud environment are then identified.