Cloud Security Access Control With External Evaluation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security solutions in a zero trust environment often rely solely on user identity, device, and location for access control, failing to incorporate external evaluation, which can lead to insufficient security measures.
Innovation Solution
A cloud-based security service that enforces access policies including external evaluation rules, transmitting requests to external endpoints for comprehensive user and device verification, utilizing identity-based and non-identity-based rules, and integrating with external APIs for advanced threat assessment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If external evaluation is added to access control, then security is improved, but system complexity increases
Solution Approach 1:
The patent introduces an external evaluation service as an intermediary component between the client device and the third-party application. This service receives access requests, performs comprehensive evaluations using multiple data sources (user identity, device information, location, external threat intelligence), and returns authorization decisions. The intermediary handles the complexity of external evaluations internally while presenting a simple allow/deny interface to the system, thus improving security without significantly increasing overall system complexity.
Solution Approach 2:
The access control system is segmented into distinct functional components: the cloud-based security service that receives requests, the external evaluation service that performs assessments, and the policy enforcement module that makes decisions. By dividing the evaluation process into separate modular components, each with specific responsibilities, the system manages complexity through organization while achieving comprehensive security evaluation.
2Reliability
If multiple evaluation criteria are used, then security is improved, but processing time increases
Solution Approach 1:
The system performs preliminary actions by pre-establishing evaluation policies, configuring external data sources, and preparing assessment criteria before actual access requests are processed. User profiles, device baselines, and threat intelligence feeds are pre-configured and cached where possible, enabling faster real-time evaluation without sacrificing comprehensive security checks.
Solution Approach 2:
The evaluation process maintains continuity by using persistent user profiles, cached device information, and continuously updated threat intelligence feeds. Rather than starting evaluations from scratch for each request, the system leverages previously collected and processed data, maintaining an ongoing assessment of user and device trustworthiness that speeds up subsequent evaluations while preserving security rigor.
Data Source
AI summary
A cloud-based security service that includes external evaluation for accessing a third-party application. The security service receives a request to access a third-party application from a client device. The security service enforces a set of one or more access policies configured for the third-party application including an external evaluation rule. As part of enforcing the external evaluation rule, the security service transmits an external evaluation request to an external endpoint defined in the external evaluation rule. The external evaluation request includes an identity of a user associated with the request. The security service receives the result of the external evaluation. If the external evaluation passed, the security service grants access to the third-party application based at least in part on its passing.