Cloud Security Trust Boundary Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing environments are vulnerable to Denial-of-Service (DoS) and distributed denial-of-service (DDoS) attacks, which can cripple the system and compromise security by allocating excessive resources to process malicious input data, even during validation checks.
Innovation Solution
Implementing a trust boundary within the cloud computing environment to separate data evaluation and operation processes into trusted and untrusted portions, where the untrusted portion evaluates user input and the trusted portion performs safe operations, ensuring that malicious data does not impact the trusted portion and protecting sensitive data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the cloud computing environment processes user input data to enable computing tasks, then service functionality is improved, but the system becomes vulnerable to DoS and DDoS attacks that can cripple the environment
Solution Approach 1:
The patent divides the cloud computing environment into a trusted portion and an untrusted portion, separating data evaluation functions from operation functions. The untrusted portion receives and evaluates user input data, while the trusted portion performs safe operations on validated data. This segmentation isolates malicious data processing from critical system operations, preventing DoS attacks from crippling the entire environment while maintaining full service functionality.
2Reliability
If the system validates user input data to prevent malicious attacks, then security is improved, but processing time and computational resources increase
Solution Approach 1:
The patent extracts the data evaluation and validation functions from the trusted portion and places them in the untrusted portion. The untrusted portion handles all security-checking operations, including validating user input data, while the trusted portion only performs operations on data that has already been validated. This extraction eliminates the need for the trusted portion to spend time on security validation, reducing processing delays while maintaining comprehensive security.
3Productivity
If the trusted portion directly processes user input data, then operational efficiency is improved, but the trusted portion becomes vulnerable to malicious data attacks
Solution Approach 1:
The patent introduces an intermediary layer (the untrusted portion) between the trusted portion and user input data. The untrusted portion acts as a mediator that receives, evaluates, and validates all user input data before passing it to the trusted portion. This intermediary protects the trusted portion from direct exposure to malicious data while maintaining efficient data flow to authorized operations, eliminating harmful factors without sacrificing productivity.
Data Source
AI summary
Some examples of security cloud computing environments can be implemented as methods. A processor of a first computer system that lacks permission to store data in a cloud computing environment receives data to be stored in the cloud computing environment. The data is received from a second computer system implementing the cloud computing environment and having permissions to store data in the cloud computing environment. The processor of the first computer system determines that the received data is safe for storage in the cloud computing environment. The processor of the first computer system determines that the received data is safe for storage in the cloud computing environment. The processor of the first computer system provides a notification to the second computer system indicating that the received data is safe for storage in the cloud computing environment, and an identifier that points to the stored data at the computer-readable storage medium.