Declarative Policy Management in Multi-Tenant Cloud IAM
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current identity and access management systems in cloud environments face challenges in providing secure and unified access across diverse devices and user types, including unauthorized access, account hijacking, and inconsistent security between on-premise and cloud environments.
Innovation Solution
A multi-tenant cloud-based identity and access management system that employs a policy engine for declarative policy management, supporting microservices architecture, and secure access tokens to enforce security models, ensuring unified security across hybrid cloud deployments and various access channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional identity management systems are used in cloud environments, then basic access control is provided, but security consistency across diverse devices and user types cannot be ensured
Solution Approach 1:
The patent implements a universal identity store that centralizes user credentials and attributes, enabling consistent authentication and authorization across multiple cloud applications and diverse access channels. This universal repository ensures that security policies are uniformly applied regardless of the device or user type accessing cloud resources.
Solution Approach 2:
The gateway server acts as an intermediary between users and cloud applications, enforcing security policies, managing authentication tokens, and coordinating access requests. This mediator ensures that all access attempts undergo consistent security evaluation before reaching target applications, maintaining security reliability across diverse access scenarios.
2Reliability
If separate identity management systems are deployed for on-premise and cloud environments, then environment-specific security requirements are met, but unified security management becomes complex
Solution Approach 1:
The patent merges on-premise and cloud identity management into a unified architecture where the gateway server coordinates with both environments. The identity store maintains user credentials that work across both cloud and on-premise applications, while the gateway enforces consistent security policies regardless of whether the request originates from cloud or on-premise sources.
Solution Approach 2:
The gateway server provides multi-functional security management that handles authentication, authorization, token management, and policy enforcement for both cloud and on-premise environments through a single unified system, eliminating the need for separate management infrastructures.
3Reliability
If fine-grained access control policies are implemented, then secure access to specific applications and data is achieved, but policy management and evaluation complexity increases
Solution Approach 1:
The patent segments access control into distinct components: authentication policies (verifying user identity), authorization policies (determining access rights), and attribute-based policies (fine-grained control based on user attributes). This segmentation allows complex security requirements to be managed through modular policy definitions that are evaluated independently by the gateway server.
Solution Approach 2:
The system uses attribute-based access control where security decisions are made by evaluating user attributes (such as role, department, clearance level) against policy conditions. This parameter-based approach allows fine-grained control without hardcoding complex rules, as policies can be dynamically adjusted by changing attribute values and policy conditions rather than restructuring the entire access control system.
4Reliability
If real-time policy evaluation is performed for each access request, then secure access decisions are made, but processing time and system performance are impacted
Solution Approach 1:
The system performs preliminary authentication and attribute retrieval during the authentication phase, storing validated user identity and relevant attributes in the gateway's memory. When access requests are made, the gateway evaluates policies using pre-retrieved attributes rather than querying external systems for each request, significantly reducing processing time while maintaining real-time security evaluation.
Solution Approach 2:
The gateway server maintains continuous session state and cached attribute information for authenticated users, allowing rapid policy evaluation across multiple access requests without repeating authentication or attribute retrieval operations. This continuity enables real-time security decisions with minimal processing overhead for subsequent access requests within the same session.
Data Source
AI summary
One embodiment performs policy evaluation in a multi-tenant cloud-based identity and access management (“IAM”) system. The embodiment receives a request for an IAM service for a tenant of the multi-tenant cloud-based IAM system, and determines an applicable policy associated with the IAM service. The embodiment determines a policy expression of the applicable policy, where the policy expression includes a reference to an attribute value, and where the reference either includes a function or includes an application programming interface (“API”) of an attribute retriever class. The embodiment obtains the attribute value by invoking the function or by invoking the API of the attribute retriever class. The embodiment evaluates the applicable policy at run-time using at least the obtained attribute value, and performs the IAM service based on the result of the evaluating of the policy.