Cloud Release Deployment With Restricted Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing environments face challenges in managing incidents and deploying software updates due to data control policies that restrict access to certain data and the control plane, making it difficult for DevOps personnel without access to restricted data to effectively perform incident management and software deployment.
Innovation Solution
Implementing access control techniques that allow DevOps personnel to perform automated and remote operations, provide just-in-time access, and utilize an escort model, while ensuring they do not access restricted data, and requiring operating personnel approval for release deployments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If DevOps personnel are given access to restricted data and control plane to perform incident management and software deployment, then operational effectiveness is improved, but data security and compliance with data control policies deteriorate
Solution Approach 1:
The patent introduces an intermediary system (deployment engine with access control mechanisms) that mediates between DevOps personnel and restricted data/control plane. The system allows DevOps personnel to initiate deployment operations without direct access to restricted data, while the intermediary system validates permissions, transfers appropriate access rights temporarily, and monitors the deployment process to ensure compliance with data control policies.
Solution Approach 2:
The system performs preliminary actions by pre-establishing access control policies, pre-authorizing deployment operations, and pre-transferring access rights before actual deployment occurs. The access control system evaluates and prepares permission transfers in advance, ensuring that DevOps personnel receive necessary access rights only when needed and for specific purposes, thereby maintaining security while enabling operational effectiveness.
2Object-affected harmful factors
If access control policies restrict access to restricted data and control plane, then data security is improved, but ability to perform incident management and software deployment deteriorates
Solution Approach 1:
The access control system dynamically adjusts access rights based on the specific deployment operation being performed. Instead of static access restrictions, the system dynamically transfers access rights to restricted data and control plane only when a deployment operation is authorized and needed. This dynamic approach maintains strong security defaults while enabling efficient deployments when properly authorized.
Solution Approach 2:
The deployment engine performs self-service by automatically transferring access rights, monitoring compliance, and executing deployment operations without requiring continuous manual intervention from DevOps personnel. The system autonomously manages the complex access control processes, reducing the burden on personnel while maintaining security standards.
3Reliability
If manual approval and transfer processes are implemented for releases, then compliance with data control policies is improved, but deployment time and complexity increase
Solution Approach 1:
The access control system implements feedback mechanisms that continuously monitor deployment operations against data control policies. The system provides real-time feedback on compliance status, automatically adjusts access rights based on policy requirements, and logs all actions for auditing. This feedback loop ensures reliable compliance while streamlining the approval process.
Solution Approach 2:
The patent replaces manual mechanical approval processes with automated electronic access control mechanisms. The deployment engine automatically evaluates policies, transfers access rights, monitors compliance, and executes deployments without requiring manual intervention for each step. This substitution of mechanical manual processes with automated electronic systems reduces deployment time while maintaining compliance assurance.
Data Source
Figure 1
Figure 2
Figure 2
AI summary
Releases to the production environment of a cloud computing environment are deployed in a manner that maintains control over restricted data and the data plane of the cloud computing environment. A DevOps personnel is tasked with developing the release. However, the DevOps personnel is not authorized to deploy the release to the cloud computing environment because the DevOps personnel does not have access to restricted data in the cloud computing environment or the ability to modify the cloud computing environment to gain access to restricted data. Operating personnel who has access to restricted data and the right to modify the cloud computing environment is notified of the release and given release specifications providing details of the release. If the operator approves the release, the release is transferred to the cloud computing environment. A deployment engine then automatically deploys the release to the production environment of the cloud computing environment.