Cloud Resource Naming Control Using Semantic Similarity Thresholds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud resource names that reveal information about the type of data stored can increase security risks by providing clear targets for attackers, and existing naming conventions that obscure data types can still be inferred through open-source intelligence.
Innovation Solution
Implement a system that restricts cloud resource names by using a vector matching engine to check semantic similarity with a dataset of keywords, rejecting names outside a predetermined threshold range, and optionally suggesting alternative names.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cloud resource names reveal information about data type, then resource identification is easier, but security risk increases
Solution Approach 1:
The patent applies semantic transformation to resource names, changing their 'meaning color' from descriptive to generic. Instead of using the original semantic meaning (e.g., 'FinancialReports2022'), the system transforms names to have neutral semantic content that doesn't reveal data types, while maintaining internal distinguishability through controlled semantic variations.
Solution Approach 2:
The patent introduces a naming convention system as an intermediary layer between the actual resource and its identifier. This intermediary uses standardized prefixes, suffixes, and structure patterns that mask the true nature of resources while maintaining organized classification, acting as a buffer that prevents direct exposure of sensitive information.
2Object-affected harmful factors
If cloud resource names use generic naming conventions, then security risk is reduced, but resource distinguishability becomes harder
Solution Approach 1:
The patent segments resource names into distinct components (prefix, identifier, suffix, metadata) where each segment serves a specific function. The prefix and suffix provide security through genericization, while the identifier segment maintains distinguishability through controlled semantic variation, and metadata segments organize resources without exposing sensitive information.
Solution Approach 2:
The patent applies different quality requirements to different parts of the naming system. Generic standardized patterns are applied to security-critical segments (prefixes, suffixes), while controlled semantic variation is applied to identifier segments where distinguishability is needed, creating a heterogeneous naming structure with localized security and functionality.
3Object-affected harmful factors
If internal names seem random to obscure data type, then security is improved, but inference through OSINT remains possible
Solution Approach 1:
The patent changes the parameters of name generation from static randomization to dynamic controlled variation. Instead of using fixed random patterns that can be reverse-engineered, the system dynamically generates names using controlled semantic transformations that maintain consistency within security bounds while preventing external inference through OSINT.
Solution Approach 2:
The patent performs preliminary semantic analysis and transformation during the naming process, proactively removing or masking sensitive information before the name is published. This preliminary action ensures that even if attackers gather extensive OSINT, the fundamental semantic links between resource names and data types have already been broken.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present disclosure provides a method and system for automatically restricting cloud resource names based on their semantic similarity to a set of keywords. The system may include one or more processors to receive a user input including a candidate name for a cloud resource of a cloud system, provide a similarity check query to a vector matching engine containing a dataset of keywords derived from cloud system, the similarity check query including the candidate name, receive a score indicating a degree of similarity between the candidate name and at least one keyword of the dataset contained in the vector matching engine, compare the score to a predetermined threshold range, reject the candidate name in response to the score being outside the predetermined threshold range, and assign the candidate name to the cloud resource if the score is within the predetermined threshold range.