Cloud Access Policy Matching for Flexible Attribute-Based Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud computing technology-based access control methods require complex reconfiguration when adapting policies to different objects, leading to inefficiencies in applying access control policies across varying scenarios.
Innovation Solution
A cloud management platform that binds request attribute information to access control policies, allowing flexible configuration and verification based on matching attributes, enabling efficient adaptation to complex and changeable scenarios.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If access control policy is bound to specific objects (organization, organizational unit, or account), then the policy can be configured and applied to those objects, but when the policy needs to be applied to another object, reconfiguration is required leading to complex configuration and low efficiency
Solution Approach 1:
The patent introduces attribute-based access control where policies are defined using attributes (e.g., department, location, device type) rather than being bound to specific objects. This allows a single policy configuration to universally apply across multiple objects that share the same attributes, eliminating the need for reconfiguration when applying policies to different objects.
Solution Approach 2:
The patent transforms the access control mechanism from object-specific binding to attribute-based matching. By changing the parameter from specific object identifiers to general attributes, the system achieves flexibility where policies can adapt to different objects dynamically based on attribute matching, rather than requiring manual reconfiguration for each object.
2Measurement precision
If access control policy is reconfigured for each object, then the policy can be precisely applied to each object, but the configuration process becomes time-consuming and inefficient
Solution Approach 1:
The patent pre-defines attributes and their relationships in the system before policy application. Objects are tagged with attributes in advance, and policies are formulated using these attributes. When a policy needs to be applied, the system automatically matches objects based on their pre-defined attributes, eliminating the need for time-consuming manual reconfiguration while maintaining precise policy application.
Solution Approach 2:
The system automatically performs policy matching and application based on object attributes without requiring manual reconfiguration. The attribute-based framework enables the system to self-serve by automatically determining which policies apply to which objects based on attribute matching, significantly reducing configuration time and effort.
3Reliability
If traditional access control methods are used, then the system can verify access requests, but the verification process is inefficient when dealing with complex and changeable scenarios
Solution Approach 1:
The patent introduces dynamic attribute-based policy evaluation. Instead of static object-specific policies, the system uses attributes that can dynamically match different objects and scenarios. This dynamic matching mechanism maintains reliable access verification while efficiently adapting to complex and changeable scenarios without requiring manual policy adjustments.
Solution Approach 2:
The system continuously evaluates access requests against attribute-based policies, providing feedback on whether the request should be granted or denied. This feedback mechanism operates efficiently by leveraging pre-defined attribute relationships, enabling rapid verification decisions even in complex scenarios while maintaining high reliability.
Data Source
AI summary
A cloud computing technology-based access control method includes: The cloud management platform obtains and records a first access control policy configured by an administrator, where configuration of the first access control policy includes configuring at least one piece of first request attribute information, and the first request attribute information includes a first request attribute; the cloud management platform obtains a first access request triggered by a user, where the first access request carries a target request attribute; and the cloud management platform detects whether the target request attribute matches the first request attribute, to obtain a first matching result.